This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit b0757525c62ff99b014653aedf71c3cca1de68ce Author: ligd <[email protected]> AuthorDate: Wed Nov 11 17:19:41 2026 +0800 fs/vfs: terminate the F_GETPATH buffer up front file_vioctl() falls back to inode_getpath() only when the driver ioctl returns -ENOTTY. A driver that returns OK for commands it does not handle leaves the caller's buffer untouched, and callers such as the inotify and file lock code then use uninitialized memory as a path. Store a terminating NUL in the buffer before dispatching FIOC_FILEPATH, so an unwritten buffer reads as an empty path. Signed-off-by: ligd <[email protected]> Signed-off-by: jingfei <[email protected]> --- fs/vfs/fs_ioctl.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/vfs/fs_ioctl.c b/fs/vfs/fs_ioctl.c index 5e9b6cb3328..5b0012f1577 100644 --- a/fs/vfs/fs_ioctl.c +++ b/fs/vfs/fs_ioctl.c @@ -61,6 +61,13 @@ static int file_vioctl(FAR struct file *filep, int req, va_list ap) return -EBADF; } + /* A driver may return OK without filling the path buffer */ + + if (req == FIOC_FILEPATH && arg != 0) + { + *(FAR char *)(uintptr_t)arg = '\0'; + } + /* Does the driver support the ioctl method? */ if (inode->u.i_ops != NULL && inode->u.i_ops->ioctl != NULL)
