CWE Rule 782

R2026b

Exposed IOCTL with Insufficient Access Control

Since R2026a

Description

The product implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL..

Polyspace Implementation

The rule checker checks for the issue Use of I/O control functions.

Examples

Use of I/O control functions

Issue

This issue occurs if you use handlers of low-level I/O control functions:

• Structures such as file_operations and block_operations that can hold I/O control handlers such as ioctl, unlocked_ioctl or compat_ioctl (Linux^®)

• DeviceIoControl() function (Windows^®)

Risk

If you assume that low-level I/O control functions are accessed only by trusted processes, you might not perform enough validation of the incoming data to these functions. The checker flags all handlers of I/O control functions so that you can review their usage.

Fix

Review the usage of I/O control handlers to make sure you have performed enough validation of the incoming data to these I/O control functions.

Example — Exposed IOCTL Handler

The function setup_device assigns my_ioctl_handler to the compat_ioctl field of a file_operations structure. This exposes an IOCTL handler that can be invoked by any process with access to the device file.

typedef void (*pioctl_handler)(int);

struct file_operations {
    pioctl_handler compat_ioctl;
};

extern void my_ioctl_handler(int cmd);

void setup_device(void) {
    struct file_operations fops;
    fops.compat_ioctl = my_ioctl_handler; //Noncompliant
}

Correction — Remove Direct IOCTL Handler Assignment

To fix this issue, avoid exposing I/O control handlers through structures such as file_operations or block_device_operations. Instead, use a higher-level interface that does not require direct IOCTL access.

typedef void (*pioctl_handler)(int);

struct file_operations {
    pioctl_handler compat_ioctl;
};

struct safe_operations {
    pioctl_handler handler;
};

extern void my_handler(int cmd);

void setup_device(void) {
    struct safe_operations sops;
    sops.handler = my_handler; //Compliant
}

Check Information

Category: Others

PQL Name: std.cwe_native.R780

Version History

Introduced in R2026a