From 7c5b50913b28b7c456210176ca340c0dfa0b3819 Mon Sep 17 00:00:00 2001
From: Tulio A M Mendes <tadryanom@hotmail.com>
Date: Wed, 10 Jun 2026 21:44:47 -0300
Subject: [PATCH] security: complete AIO validation (H1)

- Add fd mode validation in syscall_aio_rw_impl:
  - Reject aio_read on O_WRONLY fd (except char devices)
  - Reject aio_write on O_RDONLY fd (except char devices)
  - Reject aio_write on MS_RDONLY mount
- Reuse same policy as read/write/pread/pwrite syscalls
- Fix fulltest AIO test to use O_RDWR instead of O_WRONLY
  (test was incorrectly trying to read from write-only fd)

Validation:
- make -j12: PASS
- make test-host: PASS (111/111)
- make test SMOKE_SMP=4: PASS (127/127)
- make test-battery: PASS (153/153)
- make analyzer: PASS

Addresses H1 from docs/URGENT_SECURITY_STATUS_2026-06-09.md
---
 src/kernel/syscall.c          | 24 ++++++++++++++++++++++++
 user/cmds/fulltest/fulltest.c |  2 +-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/src/kernel/syscall.c b/src/kernel/syscall.c
index e23a3772..20271877 100644
--- a/src/kernel/syscall.c
+++ b/src/kernel/syscall.c
@@ -1614,6 +1614,30 @@ static int syscall_aio_rw_impl(void* user_cb, int is_write) {
         return 0;
     }
 
+    /* H1: reject aio_read on O_WRONLY fd (except char devices) */
+    if (!is_write && (f->flags & 3U) == 1U && f->node->flags != FS_CHARDEVICE) {
+        cb.aio_error = EBADF;
+        cb.aio_return = -EBADF;
+        (void)copy_to_user(user_cb, &cb, sizeof(cb));
+        return 0;
+    }
+
+    /* H1: reject aio_write on O_RDONLY fd (except char devices) */
+    if (is_write && (f->flags & 3U) == 0U && f->node->flags != FS_CHARDEVICE) {
+        cb.aio_error = EBADF;
+        cb.aio_return = -EBADF;
+        (void)copy_to_user(user_cb, &cb, sizeof(cb));
+        return 0;
+    }
+
+    /* H1: reject aio_write on MS_RDONLY mount */
+    if (is_write && f->mount_root && (vfs_node_mount_flags(f->mount_root) & MS_RDONLY)) {
+        cb.aio_error = EROFS;
+        cb.aio_return = -EROFS;
+        (void)copy_to_user(user_cb, &cb, sizeof(cb));
+        return 0;
+    }
+
     if (!cb.aio_buf || cb.aio_nbytes == 0) {
         cb.aio_error = 0;
         cb.aio_return = 0;
diff --git a/user/cmds/fulltest/fulltest.c b/user/cmds/fulltest/fulltest.c
index ee539588..a0dfe2db 100644
--- a/user/cmds/fulltest/fulltest.c
+++ b/user/cmds/fulltest/fulltest.c
@@ -3558,7 +3558,7 @@ void _start(void) {
 
     // C24: aio_read/aio_write smoke
     {
-        int fd = sys_open("/tmp/aiotest", O_CREAT | O_TRUNC | 1);
+        int fd = sys_open("/tmp/aiotest", O_CREAT | O_TRUNC | 2);
         if (fd < 0) {
             sys_write(1, "[test] aio open failed\n", (uint32_t)(sizeof("[test] aio open failed\n") - 1));
             sys_exit(1);
-- 
2.43.0