[components][serial] Address review findings for ioctl hardening

2 files changed, 26 insertions, 9 deletions

diff --git a/components/drivers/serial/dev_serial.c b/components/drivers/serial/dev_serial.c
index 40c6fd333e..464e587710 100644
--- a/components/drivers/serial/dev_serial.c
+++ b/components/drivers/serial/dev_serial.c
@@ -154,13 +154,15 @@ static int serial_fops_ioctl(struct dfs_file *fd, int cmd, void *args)
             struct termio termio;
 #endif
             rt_uint16_t oflag;
-            rt_size_t unread_bytes;
+            int unread_bytes;
         } karg;
         size_t arg_size = 0;
         void *kptr = args;
         rt_bool_t copy_in = RT_FALSE;
         rt_bool_t copy_out = RT_FALSE;
 
+        rt_memset(&karg, 0, sizeof(karg));
+
         switch ((rt_ubase_t)cmd)
         {
         case RT_DEVICE_CTRL_CONFIG:
@@ -1236,7 +1238,7 @@ static rt_err_t rt_serial_control(struct rt_device *dev,
         case TCGETA:
         case TCGETS:
             {
-                struct termios *tio, tmp;
+                struct termios *tio, tmp = {0};
 
                 if (cmd == TCGETS)
                 {
@@ -1337,7 +1339,12 @@ static rt_err_t rt_serial_control(struct rt_device *dev,
                 }
                 else config.parity = PARITY_NONE;
 
-                serial->ops->configure(serial, &config);
+                ret = serial->ops->configure(serial, &config);
+                if (ret != RT_EOK)
+                {
+                    return ret;
+                }
+                serial->config = config;
             }
             break;
 #ifndef RT_USING_TTY
@@ -1446,14 +1453,14 @@ static rt_err_t rt_serial_control(struct rt_device *dev,
             break;
         case FIONREAD:
             {
-                rt_size_t recved = 0;
+                rt_ssize_t recved = 0;
                 rt_base_t level;
 
                 level = rt_spin_lock_irqsave(&(serial->spinlock));
                 recved = _serial_fifo_calc_recved_len(serial);
                 rt_spin_unlock_irqrestore(&(serial->spinlock), level);
 
-                *(rt_size_t *)args = recved;
+                *(int *)args = (int)recved;
             }
             break;
 #endif /* RT_USING_POSIX_STDIO */
diff --git a/components/drivers/serial/dev_serial_v2.c b/components/drivers/serial/dev_serial_v2.c
index 409ffef5c3..fa5a686373 100644
--- a/components/drivers/serial/dev_serial_v2.c
+++ b/components/drivers/serial/dev_serial_v2.c
@@ -162,7 +162,7 @@ static int serial_fops_ioctl(struct dfs_file *fd, int cmd, void *args)
             struct termios termios;
 #endif
             rt_uint16_t oflag;
-            rt_size_t unread_bytes;
+            int unread_bytes;
             rt_ssize_t unread_count;
             rt_int32_t timeout;
         } karg;
@@ -171,6 +171,8 @@ static int serial_fops_ioctl(struct dfs_file *fd, int cmd, void *args)
         rt_bool_t copy_in = RT_FALSE;
         rt_bool_t copy_out = RT_FALSE;
 
+        rt_memset(&karg, 0, sizeof(karg));
+
         switch ((rt_ubase_t)cmd)
         {
         case RT_DEVICE_CTRL_CONFIG:
@@ -1746,6 +1748,7 @@ static rt_err_t rt_serial_control(struct rt_device *dev,
 #ifdef RT_USING_POSIX_STDIO
 #ifdef RT_USING_POSIX_TERMIOS
     case TCGETA:
+    case TCGETS:
     {
         struct termios *tio = (struct termios *)args;
         if (tio == RT_NULL)
@@ -1788,6 +1791,9 @@ static rt_err_t rt_serial_control(struct rt_device *dev,
     case TCSETAW:
     case TCSETAF:
     case TCSETA:
+    case TCSETSW:
+    case TCSETSF:
+    case TCSETS:
     {
         int baudrate;
         struct serial_configure config;
@@ -1837,9 +1843,13 @@ static rt_err_t rt_serial_control(struct rt_device *dev,
         else
             config.flowcontrol = RT_SERIAL_FLOWCONTROL_NONE;
 
+        ret = serial->ops->configure(serial, &config);
+        if (ret != RT_EOK)
+        {
+            break;
+        }
         /* set serial configure */
         serial->config = config;
-        serial->ops->configure(serial, &config);
     }
     break;
     case TCFLSH:
@@ -1954,9 +1964,9 @@ static rt_err_t rt_serial_control(struct rt_device *dev,
             rt_ssize_t unread_bytes = 0;
             ret = _serial_get_unread_bytes_count(serial, &unread_bytes);
             if (ret == RT_EOK)
-                *(rt_size_t *)args = (rt_size_t)unread_bytes;
+                *(int *)args = (int)unread_bytes;
             else
-                *(rt_size_t *)args = 0;
+                *(int *)args = 0;
         }
         break;
 #endif /* RT_USING_POSIX_STDIO */