Skip to content

Commit f649167

Browse files
committed
[components][serial] Address review findings for ioctl hardening
1 parent 224bc47 commit f649167

2 files changed

Lines changed: 26 additions & 9 deletions

File tree

components/drivers/serial/dev_serial.c

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -154,13 +154,15 @@ static int serial_fops_ioctl(struct dfs_file *fd, int cmd, void *args)
154154
struct termio termio;
155155
#endif
156156
rt_uint16_t oflag;
157-
rt_size_t unread_bytes;
157+
int unread_bytes;
158158
} karg;
159159
size_t arg_size = 0;
160160
void *kptr = args;
161161
rt_bool_t copy_in = RT_FALSE;
162162
rt_bool_t copy_out = RT_FALSE;
163163

164+
rt_memset(&karg, 0, sizeof(karg));
165+
164166
switch ((rt_ubase_t)cmd)
165167
{
166168
case RT_DEVICE_CTRL_CONFIG:
@@ -1236,7 +1238,7 @@ static rt_err_t rt_serial_control(struct rt_device *dev,
12361238
case TCGETA:
12371239
case TCGETS:
12381240
{
1239-
struct termios *tio, tmp;
1241+
struct termios *tio, tmp = {0};
12401242

12411243
if (cmd == TCGETS)
12421244
{
@@ -1337,7 +1339,12 @@ static rt_err_t rt_serial_control(struct rt_device *dev,
13371339
}
13381340
else config.parity = PARITY_NONE;
13391341

1340-
serial->ops->configure(serial, &config);
1342+
ret = serial->ops->configure(serial, &config);
1343+
if (ret != RT_EOK)
1344+
{
1345+
return ret;
1346+
}
1347+
serial->config = config;
13411348
}
13421349
break;
13431350
#ifndef RT_USING_TTY
@@ -1446,14 +1453,14 @@ static rt_err_t rt_serial_control(struct rt_device *dev,
14461453
break;
14471454
case FIONREAD:
14481455
{
1449-
rt_size_t recved = 0;
1456+
rt_ssize_t recved = 0;
14501457
rt_base_t level;
14511458

14521459
level = rt_spin_lock_irqsave(&(serial->spinlock));
14531460
recved = _serial_fifo_calc_recved_len(serial);
14541461
rt_spin_unlock_irqrestore(&(serial->spinlock), level);
14551462

1456-
*(rt_size_t *)args = recved;
1463+
*(int *)args = (int)recved;
14571464
}
14581465
break;
14591466
#endif /* RT_USING_POSIX_STDIO */

components/drivers/serial/dev_serial_v2.c

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ static int serial_fops_ioctl(struct dfs_file *fd, int cmd, void *args)
162162
struct termios termios;
163163
#endif
164164
rt_uint16_t oflag;
165-
rt_size_t unread_bytes;
165+
int unread_bytes;
166166
rt_ssize_t unread_count;
167167
rt_int32_t timeout;
168168
} karg;
@@ -171,6 +171,8 @@ static int serial_fops_ioctl(struct dfs_file *fd, int cmd, void *args)
171171
rt_bool_t copy_in = RT_FALSE;
172172
rt_bool_t copy_out = RT_FALSE;
173173

174+
rt_memset(&karg, 0, sizeof(karg));
175+
174176
switch ((rt_ubase_t)cmd)
175177
{
176178
case RT_DEVICE_CTRL_CONFIG:
@@ -1746,6 +1748,7 @@ static rt_err_t rt_serial_control(struct rt_device *dev,
17461748
#ifdef RT_USING_POSIX_STDIO
17471749
#ifdef RT_USING_POSIX_TERMIOS
17481750
case TCGETA:
1751+
case TCGETS:
17491752
{
17501753
struct termios *tio = (struct termios *)args;
17511754
if (tio == RT_NULL)
@@ -1788,6 +1791,9 @@ static rt_err_t rt_serial_control(struct rt_device *dev,
17881791
case TCSETAW:
17891792
case TCSETAF:
17901793
case TCSETA:
1794+
case TCSETSW:
1795+
case TCSETSF:
1796+
case TCSETS:
17911797
{
17921798
int baudrate;
17931799
struct serial_configure config;
@@ -1837,9 +1843,13 @@ static rt_err_t rt_serial_control(struct rt_device *dev,
18371843
else
18381844
config.flowcontrol = RT_SERIAL_FLOWCONTROL_NONE;
18391845

1846+
ret = serial->ops->configure(serial, &config);
1847+
if (ret != RT_EOK)
1848+
{
1849+
break;
1850+
}
18401851
/* set serial configure */
18411852
serial->config = config;
1842-
serial->ops->configure(serial, &config);
18431853
}
18441854
break;
18451855
case TCFLSH:
@@ -1954,9 +1964,9 @@ static rt_err_t rt_serial_control(struct rt_device *dev,
19541964
rt_ssize_t unread_bytes = 0;
19551965
ret = _serial_get_unread_bytes_count(serial, &unread_bytes);
19561966
if (ret == RT_EOK)
1957-
*(rt_size_t *)args = (rt_size_t)unread_bytes;
1967+
*(int *)args = (int)unread_bytes;
19581968
else
1959-
*(rt_size_t *)args = 0;
1969+
*(int *)args = 0;
19601970
}
19611971
break;
19621972
#endif /* RT_USING_POSIX_STDIO */

0 commit comments

Comments
 (0)