casaroli commented on code in PR #20822:
URL: https://github.com/apache/nuttx/pull/20822#discussion_r4399629793
##########
fs/vfs/fs_fstat.c:
##########
@@ -252,10 +254,20 @@ int nx_fstat(int fd, FAR struct stat *buf)
ret = file_get(fd, &filep);
if (ret >= 0)
{
- /* Perform the fstat operation */
+ /* Perform the fstat operation on a local buffer. Copy it to the
+ * caller's buffer after file_put(), so that a bad buffer faults with
+ * no file reference held.
+ */
+
+ /* Clear it first: a file system fills only some of the fields */
- ret = file_fstat(filep, buf);
+ memset(&kbuf, 0, sizeof(kbuf));
Review Comment:
`kbuf` is on the kernel stack, and a file system sets only some fields:
`binfs_fstat()` (fs/binfs/fs_binfs.c:278) sets only `st_mode`, `st_uid`,
`st_gid`, `st_size`, `st_blksize` and `st_blocks`. Without the `memset()`, the
other fields give the caller old kernel stack data.
##########
fs/vfs/fs_stat.c:
##########
@@ -202,9 +205,24 @@ int nx_stat(FAR const char *path, FAR struct stat *buf,
int resolve)
/* The perform the stat() operation on the path. This is potentially
* recursive if soft link support is enabled.
+ *
+ * Fill a local buffer and copy it to the caller's buffer at the end, when
+ * the inode and the path buffer are released. A bad buffer then faults
+ * with nothing held.
+ */
+
+ /* Clear it first: a file system fills only some of the fields, and the
+ * others must not give the caller what the kernel stack held.
*/
- return stat_recursive(path, buf, resolve);
+ memset(&kbuf, 0, sizeof(kbuf));
Review Comment:
The same for `stat()`: `stat_recursive()` calls the `stat()` method of a
mount point with no clear (fs/vfs/fs_stat.c:140), and `binfs_stat()`
(fs/binfs/fs_binfs.c:481) sets only `st_mode`, `st_uid`, `st_gid`, `st_size`,
`st_blksize` and `st_blocks`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
