Junbo-Zheng opened a new pull request, #21002:
URL: https://github.com/apache/nuttx/pull/21002
## Summary
A write that starts past EOF grows the file storage with realloc(),
which leaves the gap below the write offset filled with whatever the
heap previously held instead of zeros. A reader of the file can
therefore observe kernel heap residue: in simulator testing, freed
allocator metadata (including heap pointers) leaked into the file.
tmpfs_truncate() already zeroes the region it grows; this makes the
write path do the same for the gap below the write offset, matching
what fs/fat/fs_fat32.c (fat_zero_cluster) and Linux ext4/tmpfs
already guarantee for such holes.
## Impact
- **Users**: bug fix -- a hole created by seeking past EOF and
writing now reads back as zeros instead of stale heap contents.
- **Build**: None.
- **Hardware**: None -- fs/tmpfs is platform-independent; verified
on the sim host build.
- **Documentation**: None.
- **Security & Compatibility**: no API change.
## Testing
Built and ran sim:nsh with tmpfs enabled on x86_64 Ubuntu:
```
cmake -B build -DBOARD_CONFIG=sim:nsh
(set CONFIG_FS_TMPFS=y and its guard/blocksize sub-options in
build/.config)
cmake --build build -j
printf 'hello\npoweroff\n' | ./build/nuttx
```
Test vehicle (applied to apps/examples/hello/hello_main.c):
```diff
--- a/apps/examples/hello/hello_main.c
+++ b/apps/examples/hello/hello_main.c
@@ -23,7 +23,11 @@
****************************************************************************/
#include <nuttx/config.h>
+
+#include <fcntl.h>
#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
/****************************************************************************
* Public Functions
@@ -35,6 +39,32 @@
int main(int argc, FAR char *argv[])
{
- printf("Hello, World!!\n");
+ unsigned char buf[256];
+ ssize_t n;
+ int fd;
+ int dirty;
+ int i;
+
+ fd = open("/tmp/f1", O_CREAT | O_WRONLY | O_TRUNC, 0644);
+ lseek(fd, 100, SEEK_SET);
+ write(fd, "X", 1);
+ close(fd);
+
+ fd = open("/tmp/f1", O_RDONLY);
+ memset(buf, 0, sizeof(buf));
+ n = read(fd, buf, sizeof(buf));
+ close(fd);
+
+ dirty = 0;
+ for (i = 0; i < 100; i++)
+ {
+ if (buf[i] != 0)
+ {
+ dirty++;
+ }
+ }
+
+ printf("sparse write: size=%zd dirty-gap-bytes=%d (expect 0)\n",
+ n, dirty);
return 0;
}
```
Observed before the fix (stale heap bytes leak into the file; the
exact count varies with heap state, 10-12 across runs):
```
sparse write: size=101 dirty-gap-bytes=12
```
and after the fix (deterministic, the gap is zeroed):
```
sparse write: size=101 dirty-gap-bytes=0
```
For reference, the same test compiled natively on the same host
returns 0 on both ext4 and tmpfs (/dev/shm), which is the behavior
this change aligns tmpfs with.
Signed-off-by: Junbo Zheng <[email protected]>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
