[liangzhan5]

拉取/合并请求描述：(PR description)

[

为什么提交这份PR (why to submit this PR)

issue:#11952
RT_DEVICE_CTRL_BLK_PARTITION直接将用户态传入的裸指针作为 rt_memcpy 的目的地址，导致非特权进程可实现任意内核写。

rt_memcpy 执行完毕后未更新err，所以即使 ioctl 最终返回 -1，目标地址的内容已被更改。错误码与实际情况不符。

（RT_DEVICE_CTRL_BLK_GETGEOME等似乎也具有类似的问题）

你的解决方案是什么 (what is your solution)

在 RT_USING_LWP 条件下，通过 lwp_self() 判断当前是否为用户态上下文：

是用户态：先将分区数据拷贝到内核栈临时变量，再使用 lwp_put_to_user() 安全回拷至用户空间。若用户提供的指针非法，lwp_put_to_user 会返回 -EFAULT，且不会执行任何写入。

非用户态（内核内部调用）：沿用原有的 rt_memcpy 路径，修正原代码中遗漏赋值 err = RT_EOK 的问题

请提供验证的bsp和config (provide the config and bsp)

/rt-thread/bsp/qemu-vexpress-a9

]

当前拉取/合并请求的状态 Intent for your PR

必须选择一项 Choose one (Mandatory):

• 本拉取/合并请求是一个草稿版本 This PR is for a code-review and is intended to get feedback
• 本拉取/合并请求是一个成熟版本 This PR is mature, and ready to be integrated into the repo

代码质量 Code Quality：

我在这个拉取/合并请求中已经考虑了 As part of this pull request, I've considered the following:

• 已经仔细查看过代码改动的对比 Already check the difference between PR and old code
• 代码风格正确，包括缩进空格，命名及其他风格 Style guide is adhered to, including spacing, naming and other styles
• 没有垃圾代码，代码尽量精简，不包含#if 0代码，不包含已经被注释了的代码 All redundant code is removed and cleaned up
• 所有变更均有原因及合理的，并且不会影响到其他软件组件代码或BSP All modifications are justified and not affect other components or BSP
• 对难懂代码均提供对应的注释 I've commented appropriately where code is tricky
• 代码是高质量的 Code in this PR is of high quality
• 已经使用clang-format 源码格式化工具确保格式符合RT-Thread代码规范 This PR has been formatted with clang-format and complies with RT-Thread code specification
• 如果是新增bsp, 已经添加ci检查到.github/ALL_BSP_COMPILE.json 详细请参考链接BSP自查

[github-actions]

👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).

---

🛠 操作步骤 | Steps

1. 前往 Actions 页面 | Go to the Actions page
   点击进入工作流 → | Click to open workflow →

2. 点击 Run workflow | Click Run workflow

• Use workflow from 保持默认分支（通常为 master）
  Keep the default branch (usually master) in Use workflow from
• 在 branch 输入框填写 PR 分支 fix-blk-partition-arbitrary-write
  Enter PR branch fix-blk-partition-arbitrary-write in the branch field
• 设置需排除的文件/目录（目录请以"/"结尾）
  Set files/directories to exclude (directories should end with "/")

3. 等待工作流完成 | Wait for the workflow to complete
   格式化后的代码将作为独立提交推送至你的分支。
   The formatting changes will be pushed to your branch as a separate commit.

完成后，提交将自动更新至 fix-blk-partition-arbitrary-write 分支，关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the fix-blk-partition-arbitrary-write branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们，再次感谢您的贡献！💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

[github-actions]

📌 Code Review Assignment

🏷️ Tag: components

Reviewers: @Maihuanyi

Changed Files (Click to expand)

• components/drivers/block/blk_dev.c

---

📊 Current Review Status (Last Updated: 2026-11-03 15:51 CST)

• ⌛ @Maihuanyi Pending Review

---

📝 Review Instructions

1. 维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
   Maintainers can refresh the review status by clicking here: 🔄 Refresh Status

2. 确认审核通过后评论 LGTM/lgtm
   Comment LGTM/lgtm after confirming approval

3. PR合并前需至少一位维护者确认
   PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

[liangzhan5]

将lwp_self注释掉后在内核态测试（模拟用户态）

测试代码

#include <fcntl.h>
#include <sys/ioctl.h>
#include <unistd.h>
#include <stdio.h>
#include <errno.h>

#ifndef RT_DEVICE_CTRL_BLK_PARTITION
#define RT_DEVICE_CTRL_BLK_PARTITION 0x205
#endif

#ifndef RT_DEVICE_CTRL_BLK_GETGEOME
#define RT_DEVICE_CTRL_BLK_GETGEOME 0x201
#endif

#define KERNEL_TARGET 0xc00fa484UL

int main(void)
{   int fd;
    int retry = 50;
    int ret;
    while(retry--){
        fd = open("/dev/sd0", O_RDWR);
        rt_kprintf("trying\n");
        if (fd >= 0) break;
        rt_thread_mdelay(100);
}

    if (fd < 0){
        printf("open failed, errno=%d\n", errno);
        rt_kprintf("exp opened failed\n");
        return 1;
    }

    struct { unsigned long sc, bps, bs; } geo;
    ret = ioctl(fd, RT_DEVICE_CTRL_BLK_GETGEOME, &geo);
    rt_kprintf("getgeome done,ret = %d\n", ret);

    ret = ioctl(fd, RT_DEVICE_CTRL_BLK_PARTITION, KERNEL_TARGET);
    rt_kprintf("partition returned,ret = %d\n", ret);

    close(fd);
    rt_kprintf("exp done\n");
    return 0;
}

修复前

(gdb) watch *0xc00fa484
Hardware watchpoint 1: *0xc00fa484
(gdb) continue
Continuing.

Thread 1 hit Hardware watchpoint 1: *0xc00fa484

Old value = <unreadable>
New value = 0
rt_memcpy (dst=0xc00fa484 <__gnu_unwind_execute+136>, src=0xc0170710, count=24) at ...
(gdb) backtrace
#0  rt_memcpy (...)
#1  0xc008bd04 in blk_dev_control (dev=0xc01706b0, cmd=517, args=0xc00fa484 <__gnu_unwind_execute+136>)
#2  0xc0090c14 in rt_device_control (...)
#3  0xc00602a0 in dfs_devfs_ioctl (...)
#4  0xc007eab0 in dfs_file_ioctl (...)
#5  0xc00872c8 in fcntl (...)
#6  0xc0087410 in ioctl (...)
#7  0xc005e388 in main ()
(gdb) x/6wx 0xc00fa484
0xc00fa484 <__gnu_unwind_execute+136>:  0x00000000  0xe3a00009  0xe28dd014  0xe8bd83f0
0xc00fa494 <__gnu_unwind_execute+152>:  0xe35300c0  0x1a000041
(gdb) finish
Run till exit from #0  rt_memcpy ...
blk_dev_control (...) at ...:118
(gdb) x/6wx 0xc00fa484
0xc00fa484 <__gnu_unwind_execute+136>:  0x00000000  0x00000000  0x00000000  0x00000000
0xc00fa494 <__gnu_unwind_execute+152>:  0x00020000  0xc0170654

修复后

(gdb) watch *0xc00fa484
Hardware watchpoint 1: *0xc00fa484
(gdb) continue
Continuing.