提交 3cddcb9f 编写于 作者: O openharmony_ci 提交者: Gitee

!355 SIOCGIFCONF iotcl,用户态到内核态申请内存大小错误

Merge pull request !355 from 刘建东/master
......@@ -1468,6 +1468,51 @@ static err_t lwip_do_ioctl_impl(struct tcpip_api_call_data *call)
#include "los_vm_map.h"
#include "user_copy.h"
static int do_ioctl_SIOCGIFCONF(int sockfd, long cmd, void *argp)
{
int nbytes;
struct ifconf ifc;
char *buf_bak = NULL;
int ret;
if (LOS_ArchCopyFromUser(&ifc, argp, sizeof(struct ifconf)) != 0) {
set_errno(EFAULT);
return -1;
}
nbytes = ifc.ifc_len;
if (nbytes < 0) {
set_errno(EINVAL);
return -1;
}
buf_bak = ifc.ifc_buf;
if (!LOS_IsUserAddress((VADDR_T)(uintptr_t)buf_bak)) {
set_errno(EFAULT);
return -1;
}
ifc.ifc_buf = malloc(nbytes);
if (ifc.ifc_buf == NULL) {
set_errno(ENOMEM);
return -1;
}
(void)memset_s(ifc.ifc_buf, nbytes, 0, nbytes);
ret = lwip_ioctl(sockfd, cmd, &ifc);
if (ret == 0) {
if (LOS_ArchCopyToUser(buf_bak, ifc.ifc_buf, nbytes) != 0) {
set_errno(EFAULT);
ret = -1;
}
}
free(ifc.ifc_buf);
ifc.ifc_buf = buf_bak;
if (LOS_ArchCopyToUser(argp, &ifc, sizeof(struct ifconf)) != 0) {
set_errno(EFAULT);
ret = -1;
}
return ret;
}
int socks_ioctl(int sockfd, long cmd, void *argp)
{
void *argpbak = argp;
......@@ -1483,11 +1528,12 @@ int socks_ioctl(int sockfd, long cmd, void *argp)
case SIOCADDRT:
nbytes = sizeof(struct rtentry);
break;
case SIOCGIFCONF:
return do_ioctl_SIOCGIFCONF(sockfd, cmd, argp);
case SIOCSIPV6DAD:
case SIOCGIPV6DAD:
case SIOCSIPV6DPCTD:
case SIOCGIPV6DPCTD:
case SIOCGIFCONF:
case SIOCGIFADDR:
case SIOCSIFADDR:
case SIOCDIFADDR:
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册