Addresses an issue of multiple invalid loops in the rpmsgfs_mkpath function#17270
Open
sszllxos wants to merge 1 commit intoapache:masterfrom
Open
Addresses an issue of multiple invalid loops in the rpmsgfs_mkpath function#17270sszllxos wants to merge 1 commit intoapache:masterfrom
sszllxos wants to merge 1 commit intoapache:masterfrom
Conversation
This commit addresses an issue of multiple invalid loops in the rpmsgfs_mkpath function under specific cross-system mount scenarios.
Problem Description:
When performing directory access restriction on the Linux side, users execute the mount command in the NuttX shell:mount -t rpmsgfs -o cpu=server,fs=/root/demo/fold /nuttx_foldThe Linux side restricts NuttX from accessing directories outside /root/demo/fold and returns a permission deny error (or other negative return codes). However, the existing code in rpmsgfs_mkpath only handles the case where rpmsgfs_client_stat returns ret = 0, and lacks processing logic for negative return values. This omission causes the while loop in rpmsgfs_mkpath to run indefinitely.
Solution Implemented:
Added error handling for negative return values of rpmsgfs_client_stat in rpmsgfs_mkpath.
When rpmsgfs_client_stat returns a value < 0, the function will break out of the while loop.
Signed-off-by: Lijing lijing.ly@bytedance.com
github-actions
bot
added
Area: File System
xiaoxiang781216
requested changes
Nov 1, 2025
|
|
||
| ret = rpmsgfs_client_stat(fs->handle, fs->fs_root, &buf); | ||
| if (ret == 0) | ||
| if (ret <= 0) |
Contributor
There was a problem hiding this comment.
but we need consider the case that the server mayn't be ready yet.
Contributor
|
Note: I re-formatted your PR description so that it displays with wrapped lines on GitHub. Otherwise it was very difficult to read because text required scrolling to the right quite far. |
Contributor
|
@sszllxos nice finding. Could you please tell me which link interface are you using to connect Linux and NuttX? @xiaoxiang781216 did you submit the RPMsg SPI driver to Linux mainline? |
Contributor
not yet. |
Author
|
@acassis RPMsg SPI driver |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This commit addresses an issue of multiple invalid loops in the rpmsgfs_mkpath function under specific cross-system mount scenarios.
Problem Description:
The mount command in the NuttX shell is as follows:
Running “ls nuttx_fold“ correctly lists the contents of the /root/demo/fold directory on the Linux side. However, if NuttX is compromised by a hacker, the hacker could modify the input parameters of the ls command. Without directory access restrictions implemented on the Linux side, this would allow the hacker to arbitrarily access any directory on the Linux system.
When directory access restrictions are implemented on the Linux side—such as modifying the rpmsgfs driver on the Linux side to return "permission deny" upon detecting unauthorized access—the rpmsgfs_client_stat function in rpmsgfs_mkpath (on the NuttX side) fails to handle this error and continues waiting in the while loop.
Impact
Only modifies the error handling branch in rpmsgfs_mkpath, with no impact on other functions of the rpmsgfs module.
Testing
In the Linux shell, create the directory /root/demo/fold, and restrict NuttX from accessing the fold directory itself by configuring the rpmsg_fs driver.
In Nuttx shell:
Nuttx shell output:
Signed-off-by: Lijing lijing.ly@bytedance.com