From 4af4c3e26e077d43ff2cf195616914a5b9f2d5a3 Mon Sep 17 00:00:00 2001
From: Matheus <matheusuky@gmail.com>
Date: Tue, 28 Apr 2026 18:52:49 -0300
Subject: [PATCH] pread/pwrite: fix vulnerability

---
 kernel-src/sys/syscalls/pread.c  | 5 +++++
 kernel-src/sys/syscalls/pwrite.c | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/kernel-src/sys/syscalls/pread.c b/kernel-src/sys/syscalls/pread.c
index 09964e8c..b48ec5e3 100644
--- a/kernel-src/sys/syscalls/pread.c
+++ b/kernel-src/sys/syscalls/pread.c
@@ -10,6 +10,11 @@ syscallret_t syscall_pread(context_t *context, int fd, void *buffer, size_t size
 		.ret = -1
 	};
 
+	if (!IS_USER_ADDRESS(buffer)) {
+		ret.errno = EFAULT;
+		return ret;
+	}
+
 	file_t *file = fd_get(fd);
 
 	if (file == NULL || (file->flags & FILE_READ) == 0) {
diff --git a/kernel-src/sys/syscalls/pwrite.c b/kernel-src/sys/syscalls/pwrite.c
index 6604ef3a..7c120f84 100644
--- a/kernel-src/sys/syscalls/pwrite.c
+++ b/kernel-src/sys/syscalls/pwrite.c
@@ -8,6 +8,11 @@ syscallret_t syscall_pwrite(context_t *context, int fd, void *buffer, size_t siz
 		.ret = -1
 	};
 
+	if (!IS_USER_ADDRESS(buffer)) {
+		ret.errno = EFAULT;
+		return ret;
+	}
+
 	file_t *file = fd_get(fd);
 
 	if (file == NULL || (file->flags & FILE_WRITE) == 0) {