[BUG] fs/vfs: missing POSIX iovcnt bounds and iov_len overflow validation in readv/writev

Aperta
  • Qualcosa non va?
#21,543 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@Swatantra-66 ci sta già lavorando.

Dal 7/11/2026.

  • #21544 di @Swatantra-66 — aperta

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
25/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Ferma
Stack tecnologico
c
Ambito
operating-systems

Direzione di ricerca

Read fs/vfs/fs_read.c and fs/vfs/fs_write.c, especially file_readv_compat() and file_writev_compat(), then check the existing declarations and TODOs in include/sys/uio.h. The issue describes the invalid iovcnt and iov_len cases to review; done means both calls reject invalid requests upfront without transferring data and the header notes reflect the completed validation.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Arch: all Area: Posix OS: Linux Type: Bug
Description

POSIX.1-2017 (IEEE Std 1003.1-2017) and POSIX.1-2024 explicitly mandate for both readv() and writev():

"The readv() / writev() function shall fail if:
[EINVAL] The sum of the iov_len values in the iov array overflowed an ssize_t.
or
[EINVAL] The iovcnt argument was less than or equal to 0, or greater than {IOV_MAX}."

Currently, NuttX's VFS layer (fs/vfs/fs_read.c and fs/vfs/fs_write.c) does not enforce these boundaries, leading to non-compliant return values and partial I/O on overflow.

In fact, this omission is already noted in include/sys/uio.h (lines 107-108, 132-133, 149-150):

/* In include/sys/uio.h: */
 *    EINVAL.
 *      The sum of the iov_len values in the iov array overflowed an ssize_t
 *      or The 'iovcnt' argument was less than or equal to 0, or greater than
 *      IOV_MAX (Not implemented).
 *
 *   TODO: If the sum of the iov_len values is greater than SSIZE_MAX, the
 *   operation will fail and no data will be transferred.
Steps to Reproduce

  1. Call readv(fd, iov, 0) or writev(fd, iov, 0):

    • Expected (POSIX): Returns -1, errno = EINVAL.
    • Actual (NuttX): Returns 0 (indicates zero-byte success / EOF).

  2. Call readv(fd, iov, -1) or writev(fd, iov, -1):

    • Expected (POSIX): Returns -1, errno = EINVAL.
    • Actual (NuttX): Bypasses validation and returns 0.

  3. Call readv() or writev() with iovcnt > IOV_MAX:

    • Expected (POSIX): Returns -1, errno = EINVAL.
    • Actual (NuttX): Allowed and processed unchecked.

  4. Call readv() or writev() where iov[0].iov_len = 10 and iov[1].iov_len = SSIZE_MAX:

    • Expected (POSIX): Returns -1, errno = EINVAL upfront, with no data read or written.
    • Actual (NuttX): In file_readv_compat() and file_writev_compat(), transfers 10 bytes on iov[0], detects overflow on iov[1], executes break, and returns 10 (partial transfer) rather than rejecting the invalid request upfront.
Behavior Comparison
Scenario / Parameter POSIX IEEE Std 1003.1 Current NuttX VFS Proposed Fix
iovcnt == 0 Fail with [EINVAL] Returns 0 (Success) Fail with -EINVAL
iovcnt < 0 Fail with [EINVAL] Returns 0 (Success) Fail with -EINVAL
iovcnt > IOV_MAX Fail with [EINVAL] Unchecked / Allowed Fail with -EINVAL
Sum of iov_len > SSIZE_MAX (i == 0) Fail with [EINVAL] Fails with -EINVAL Fail upfront with -EINVAL
Sum of iov_len > SSIZE_MAX (i > 0) Fail with [EINVAL], no data transferred Returns partial bytes (ntotal) Fail upfront with -EINVAL, no data transferred
Proposed Solution
  1. In file_readv() and file_writev(), validate iovcnt upfront: 
    if (iovcnt <= 0 || iovcnt > IOV_MAX)
  {
    return -EINVAL;
  }
  2. Validate in an upfront pass that the accumulated sum of iov_len does not exceed SSIZE_MAX before initiating any file operations or acquiring locks, returning -EINVAL on overflow.
  3. Update the comments and TODO items in include/sys/uio.h to reflect the completed POSIX conformance.

I have a patch ready with 100% nxstyle and checkpatch compliance and would be glad to submit a PR if this is the desired approach.

On which OS does this issue occur?

[OS: Linux]

What is the version of your OS?

Ubuntu 22.04 LTS (all)

NuttX Version

master

Issue Architecture

[Arch: all]

Issue Area

[Area: Posix]

Host information

Host: Linux x86_64 / Ubuntu 22.04 (Architecture-independent VFS logic bug)
Target: All architectures (sim:nsh, arm, etc.)

Verification
  • I have verified before submitting the report.
Lingua principale
C
Stelle
4.1k
Fork
1.8k
Merge medio
1g 4h
PR unite (30g)
843

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di apache/nuttx

Tutte le issue di apache/nuttx

Issue simili

Altre issue su C

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.