[BUG] fs/vfs: missing POSIX iovcnt bounds and iov_len overflow validation in readv/writev

Abierto
  • ¿Algo no está bien?
#21,543 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@Swatantra-66 ya está trabajando en esto.

Desde el 7/11/2026.

  • #21544 de @Swatantra-66 — abierto

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
25/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Estancado
Stack tecnológico
c
Área
operating-systems

Línea de trabajo

Read fs/vfs/fs_read.c and fs/vfs/fs_write.c, especially file_readv_compat() and file_writev_compat(), then check the existing declarations and TODOs in include/sys/uio.h. The issue describes the invalid iovcnt and iov_len cases to review; done means both calls reject invalid requests upfront without transferring data and the header notes reflect the completed validation.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Arch: all Area: Posix OS: Linux Type: Bug
Description

POSIX.1-2017 (IEEE Std 1003.1-2017) and POSIX.1-2024 explicitly mandate for both readv() and writev():

"The readv() / writev() function shall fail if:
[EINVAL] The sum of the iov_len values in the iov array overflowed an ssize_t.
or
[EINVAL] The iovcnt argument was less than or equal to 0, or greater than {IOV_MAX}."

Currently, NuttX's VFS layer (fs/vfs/fs_read.c and fs/vfs/fs_write.c) does not enforce these boundaries, leading to non-compliant return values and partial I/O on overflow.

In fact, this omission is already noted in include/sys/uio.h (lines 107-108, 132-133, 149-150):

/* In include/sys/uio.h: */
 *    EINVAL.
 *      The sum of the iov_len values in the iov array overflowed an ssize_t
 *      or The 'iovcnt' argument was less than or equal to 0, or greater than
 *      IOV_MAX (Not implemented).
 *
 *   TODO: If the sum of the iov_len values is greater than SSIZE_MAX, the
 *   operation will fail and no data will be transferred.
Steps to Reproduce

  1. Call readv(fd, iov, 0) or writev(fd, iov, 0):

    • Expected (POSIX): Returns -1, errno = EINVAL.
    • Actual (NuttX): Returns 0 (indicates zero-byte success / EOF).

  2. Call readv(fd, iov, -1) or writev(fd, iov, -1):

    • Expected (POSIX): Returns -1, errno = EINVAL.
    • Actual (NuttX): Bypasses validation and returns 0.

  3. Call readv() or writev() with iovcnt > IOV_MAX:

    • Expected (POSIX): Returns -1, errno = EINVAL.
    • Actual (NuttX): Allowed and processed unchecked.

  4. Call readv() or writev() where iov[0].iov_len = 10 and iov[1].iov_len = SSIZE_MAX:

    • Expected (POSIX): Returns -1, errno = EINVAL upfront, with no data read or written.
    • Actual (NuttX): In file_readv_compat() and file_writev_compat(), transfers 10 bytes on iov[0], detects overflow on iov[1], executes break, and returns 10 (partial transfer) rather than rejecting the invalid request upfront.
Behavior Comparison
Scenario / Parameter POSIX IEEE Std 1003.1 Current NuttX VFS Proposed Fix
iovcnt == 0 Fail with [EINVAL] Returns 0 (Success) Fail with -EINVAL
iovcnt < 0 Fail with [EINVAL] Returns 0 (Success) Fail with -EINVAL
iovcnt > IOV_MAX Fail with [EINVAL] Unchecked / Allowed Fail with -EINVAL
Sum of iov_len > SSIZE_MAX (i == 0) Fail with [EINVAL] Fails with -EINVAL Fail upfront with -EINVAL
Sum of iov_len > SSIZE_MAX (i > 0) Fail with [EINVAL], no data transferred Returns partial bytes (ntotal) Fail upfront with -EINVAL, no data transferred
Proposed Solution
  1. In file_readv() and file_writev(), validate iovcnt upfront: 
    if (iovcnt <= 0 || iovcnt > IOV_MAX)
  {
    return -EINVAL;
  }
  2. Validate in an upfront pass that the accumulated sum of iov_len does not exceed SSIZE_MAX before initiating any file operations or acquiring locks, returning -EINVAL on overflow.
  3. Update the comments and TODO items in include/sys/uio.h to reflect the completed POSIX conformance.

I have a patch ready with 100% nxstyle and checkpatch compliance and would be glad to submit a PR if this is the desired approach.

On which OS does this issue occur?

[OS: Linux]

What is the version of your OS?

Ubuntu 22.04 LTS (all)

NuttX Version

master

Issue Architecture

[Arch: all]

Issue Area

[Area: Posix]

Host information

Host: Linux x86_64 / Ubuntu 22.04 (Architecture-independent VFS logic bug)
Target: All architectures (sim:nsh, arm, etc.)

Verification
  • I have verified before submitting the report.
Lenguaje dominante
C
Estrellas
4.1k
Forks
1.8k
Merge medio
1 d 4 h
PR fusionados (30 d)
843

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de apache/nuttx

Todos los issues de apache/nuttx

Issues similares

Más issues de C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.