[cms19859230182-lang]

摘要

修复 #11958：pipe_fops_ioctl 对 FIONREAD／FIONWRITE 在内核态直接写用户裸指针的问题。

改动

• 先把 ringbuffer 长度算到局部 int，再经 lwp_put_to_user 拷出（ARCH_MM_MMU）
• 非 MMU 仍直接写用户指针（单一地址空间无害）
• 补 pipe／pipe->fifo 判空
• #include <lwp_user_mm.h> 用 ARCH_MM_MMU 包住

为何不在 sys_ioctl 统一拦

ioctl 语义因驱动而异（有的是标量 arg，有的是结构体指针），全局校验易误伤；驱动侧按 cmd 自守更合适。

English

Harden pipe_fops_ioctl for FIONREAD/FIONWRITE: compute into a stack int, then lwp_put_to_user under ARCH_MM_MMU; keep direct write on non-MMU. Also null-check pipe/fifo. Fixes #11958.

[github-actions]

📌 Code Review Assignment

🏷️ Tag: components

Reviewers: @Maihuanyi

Changed Files (Click to expand)

• components/drivers/ipc/pipe.c

---

📊 Current Review Status (Last Updated: 2026-11-02 15:37 CST)

• ⌛ @Maihuanyi Pending Review

---

📝 Review Instructions

1. 维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
   Maintainers can refresh the review status by clicking here: 🔄 Refresh Status

2. 确认审核通过后评论 LGTM/lgtm
   Comment LGTM/lgtm after confirming approval

3. PR合并前需至少一位维护者确认
   PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

[github-actions]

👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).

---

🛠 操作步骤 | Steps

1. 前往 Actions 页面 | Go to the Actions page
   点击进入工作流 → | Click to open workflow →

2. 点击 Run workflow | Click Run workflow

• Use workflow from 保持默认分支（通常为 master）
  Keep the default branch (usually master) in Use workflow from
• 在 branch 输入框填写 PR 分支 fix/11958-pipe-ioctl
  Enter PR branch fix/11958-pipe-ioctl in the branch field
• 设置需排除的文件/目录（目录请以"/"结尾）
  Set files/directories to exclude (directories should end with "/")

3. 等待工作流完成 | Wait for the workflow to complete
   格式化后的代码将作为独立提交推送至你的分支。
   The formatting changes will be pushed to your branch as a separate commit.

完成后，提交将自动更新至 fix/11958-pipe-ioctl 分支，关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the fix/11958-pipe-ioctl branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们，再次感谢您的贡献！💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

[github-actions]

MemBrowse Memory Report · Explore what changed →

No memory changes detected for:

• at32f415-start
• esp32-c3
• gd32105r-start
• hc32f334
• hpmicro-hpm5100evk
• hpmicro-hpm5301evklite
• infineon-psoc6
• k230
• loongson-ls1cdev
• nordic-nrf51822
• nuvoton-m487
• nxp-lpc1114
• qemu-virt64-aarch64
• raspberry-pico-rp2040
• renesas-ra2l1
• simulator
• stm32f407-rt-spark
• stm32l475-atk-pandora-llvm
• wch-ch32v208w-r0
• x86
• xuantie-e901plus

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}