(nuttx) branch master updated: fs/inotify: free the realpath buffer in the right heap

[xiaoxiang.apache.org via commits]

This is an automated email from the ASF dual-hosted git repository.

xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git


The following commit(s) were added to refs/heads/master by this push:
     new 63580df72f6 fs/inotify: free the realpath buffer in the right heap
63580df72f6 is described below

commit 63580df72f6cce0effabc82b612e7fd9ff7bcc98
Author: zhengyu16 <zhengy...@xiaomi.com>
AuthorDate: Wed Nov 11 14:16:31 2026 +0800

    fs/inotify: free the realpath buffer in the right heap
    
    inotify_add_watch() gets the absolute path from lib_realpath() with a
    NULL buffer, which allocates it with lib_malloc(), and frees it with
    fs_heap_free().  With CONFIG_FS_HEAPSIZE > 0 the fs heap is a separate
    heap, so the buffer is released into the wrong heap.
    
    Resolve the path into a buffer from lib_get_tempbuffer() and release it
    with lib_put_tempbuffer().
    
    Signed-off-by: zhengyu16 <zhengy...@xiaomi.com>
    Signed-off-by: jingfei <jing...@xiaomi.com>
---
 fs/vfs/fs_inotify.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/fs/vfs/fs_inotify.c b/fs/vfs/fs_inotify.c
index 2cfc3364b87..2c2a01a0bfd 100644
--- a/fs/vfs/fs_inotify.c
+++ b/fs/vfs/fs_inotify.c
@@ -1118,6 +1118,7 @@ int inotify_add_watch(int fd, FAR const char *pathname, 
uint32_t mask)
   FAR struct inotify_watch_s *old;
   FAR struct inotify_device_s *dev;
   FAR struct file *filep;
+  FAR char *tmpbuffer;
   FAR char *abspath;
   struct stat buf;
   int ret;
@@ -1135,13 +1136,23 @@ int inotify_add_watch(int fd, FAR const char *pathname, 
uint32_t mask)
       return ERROR;
     }
 
-  abspath = lib_realpath(pathname, NULL, mask & IN_DONT_FOLLOW);
-  if (abspath == NULL)
+  /* Allocate temporary buffer for realpath */
+
+  tmpbuffer = lib_get_tempbuffer(PATH_MAX);
+  if (tmpbuffer == NULL)
     {
       file_put(filep);
+      set_errno(ENOMEM);
       return ERROR;
     }
 
+  abspath = lib_realpath(pathname, tmpbuffer, mask & IN_DONT_FOLLOW);
+  if (abspath == NULL)
+    {
+      ret = -get_errno();
+      goto out_free;
+    }
+
   ret = nx_stat(abspath, &buf, 1);
   if (ret < 0)
     {
@@ -1213,7 +1224,7 @@ out:
 
 out_free:
   file_put(filep);
-  fs_heap_free(abspath);
+  lib_put_tempbuffer(tmpbuffer);
   if (ret < 0)
     {
       set_errno(-ret);