!1244 【Pick 4.1 Release】fs_epoll竞争漏洞修复

Merge pull request !1244 from hw_llm/cherry-pick-1729040743

OAT.xml

@@ -65,8 +65,6 @@
                 <!--filteritem type="filepath" name="projectroot/[a-zA-Z0-9]{20,}.sh" desc="Temp files"/-->
             </filefilter>
             <filefilter name="binaryFileTypePolicyFilter" desc="Filters for binary file policies">
-                <filteritem type="filepath" name="figures/architecture-of-the-openharmony-liteos-cortex-a-kernel.png" desc="architecture-of-the-openharmony-liteos-cortex-a-kernel"/>
-                <filteritem type="filepath" name="figures/OpenHarmony-LiteOS-A内核架构图.png" desc="LiteOS-A内核架构图"/>
                 <!--filteritem type="filename" name="*.uvwxyz" desc="Describe the reason for filtering scan results"/-->
                 <!--filteritem type="filepath" name="abcdefg/.*.uvwxyz" desc="Describe the reason for filtering scan results"/-->
                 <!--filteritem type="filepath" name="projectroot/[a-zA-Z0-9]{20,}.sh" desc="Temp files"/-->

drivers/char/mem/src/mem.c

@@ -61,7 +61,7 @@ static ssize_t MemMap(struct file *filep, LosVmMapRegion *region)
     VADDR_T vaddr = region->range.base;
     LosVmSpace *space = LOS_SpaceGet(vaddr);
 
-    if ((paddr >= SYS_MEM_BASE) && (paddr < SYS_MEM_END)) {
+    if (((paddr + size) >= SYS_MEM_BASE) && (paddr < SYS_MEM_END)) {
         return -EINVAL;
     }
 

fs/jffs2/jffs2.patch

@@ -6340,7 +6340,7 @@ diff -Nupr old/fs/jffs2/summary.h new/fs/jffs2/summary.h
 diff -Nupr old/fs/jffs2/super.c new/fs/jffs2/super.c
 --- old/fs/jffs2/super.c	2022-05-09 17:22:53.000000000 +0800
 +++ new/fs/jffs2/super.c	2022-05-09 20:09:32.170000000 +0800
-@@ -9,433 +9,188 @@
+@@ -9,434 +9,188 @@
   *
   */
  
@@ -6418,6 +6418,7 @@ diff -Nupr old/fs/jffs2/super.c new/fs/jffs2/super.c
 +	c->cleanmarker_size = sizeof(struct jffs2_unknown_node);
  
 -	mutex_init(&f->sem);
+-	f->target = NULL;
 -	inode_init_once(&f->vfs_inode);
 -}
 +	ret = jffs2_do_mount_fs(c);
@@ -8667,7 +8668,7 @@ diff -Nupr old/fs/jffs2/writev.c new/fs/jffs2/writev.c
 diff -Nupr old/fs/jffs2/xattr.c new/fs/jffs2/xattr.c
 --- old/fs/jffs2/xattr.c	2022-05-09 17:15:24.360000000 +0800
 +++ new/fs/jffs2/xattr.c	1970-01-01 08:00:00.000000000 +0800
-@@ -1,1352 +0,0 @@
+@@ -1,1347 +0,0 @@
 -/*
 - * JFFS2 -- Journalling Flash File System, Version 2.
 - *
@@ -9442,10 +9443,10 @@ diff -Nupr old/fs/jffs2/xattr.c new/fs/jffs2/xattr.c
 -}
 -
 -#define XREF_TMPHASH_SIZE	(128)
--int jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
+-void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
 -{
 -	struct jffs2_xattr_ref *ref, *_ref;
--	struct jffs2_xattr_ref **xref_tmphash;
+-	struct jffs2_xattr_ref *xref_tmphash[XREF_TMPHASH_SIZE];
 -	struct jffs2_xattr_datum *xd, *_xd;
 -	struct jffs2_inode_cache *ic;
 -	struct jffs2_raw_node_ref *raw;
@@ -9454,12 +9455,9 @@ diff -Nupr old/fs/jffs2/xattr.c new/fs/jffs2/xattr.c
 -
 -	BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
 -
--	xref_tmphash = kcalloc(XREF_TMPHASH_SIZE,
--			       sizeof(struct jffs2_xattr_ref *), GFP_KERNEL);
--	if (!xref_tmphash)
--		return -ENOMEM;
--
 -	/* Phase.1 : Merge same xref */
+-	for (i=0; i < XREF_TMPHASH_SIZE; i++)
+-		xref_tmphash[i] = NULL;
 -	for (ref=c->xref_temp; ref; ref=_ref) {
 -		struct jffs2_xattr_ref *tmp;
 -
@@ -9557,8 +9555,6 @@ diff -Nupr old/fs/jffs2/xattr.c new/fs/jffs2/xattr.c
 -		     "%u of xref (%u dead, %u orphan) found.\n",
 -		     xdatum_count, xdatum_unchecked_count, xdatum_orphan_count,
 -		     xref_count, xref_dead_count, xref_orphan_count);
--	kfree(xref_tmphash);
--	return 0;
 -}
 -
 -struct jffs2_xattr_datum *jffs2_setup_xattr_datum(struct jffs2_sb_info *c,

fs/vfs/epoll/fs_epoll.c

@@ -220,14 +220,18 @@ int epoll_close(int epfd)
 {
     struct epoll_head *epHead = NULL;
 
+    (VOID)pthread_mutex_lock(&g_epollMutex);
     epHead = EpollGetDataBuff(epfd);
     if (epHead == NULL) {
+        (VOID)pthread_mutex_unlock(&g_epollMutex);
         set_errno(EBADF);
         return -1;
     }
 
     DoEpollClose(epHead);
-    return EpollFreeSysFd(epfd);
+    int ret = EpollFreeSysFd(epfd);
+    (VOID)pthread_mutex_unlock(&g_epollMutex);
+    return ret;
 }
 
 int epoll_ctl(int epfd, int op, int fd, struct epoll_event *ev)
@@ -236,15 +240,16 @@ int epoll_ctl(int epfd, int op, int fd, struct epoll_event *ev)
     int i;
     int ret = -1;
 
+    (VOID)pthread_mutex_lock(&g_epollMutex);
     epHead = EpollGetDataBuff(epfd);
     if (epHead == NULL) {
         set_errno(EBADF);
-        return ret;
+        goto OUT_RELEASE;
     }
 
     if (ev == NULL) {
         set_errno(EINVAL);
-        return -1;
+        goto OUT_RELEASE;
     }
 
     switch (op) {
@@ -252,18 +257,19 @@ int epoll_ctl(int epfd, int op, int fd, struct epoll_event *ev)
             ret = CheckFdExist(epHead, fd);
             if (ret == -1) {
                 set_errno(EEXIST);
-                return -1;
+                goto OUT_RELEASE;
             }
 
             if (epHead->nodeCount == EPOLL_DEFAULT_SIZE) {
                 set_errno(ENOMEM);
-                return -1;
+                goto OUT_RELEASE;
             }
 
             epHead->evs[epHead->nodeCount].events = ev->events | POLLERR | POLLHUP;
             epHead->evs[epHead->nodeCount].data.fd = fd;
             epHead->nodeCount++;
-            return 0;
+            ret = 0;
+            break;
         case EPOLL_CTL_DEL:
             for (i = 0; i < epHead->nodeCount; i++) {
                 if (epHead->evs[i].data.fd != fd) {
@@ -275,23 +281,29 @@ int epoll_ctl(int epfd, int op, int fd, struct epoll_event *ev)
                               epHead->nodeCount - i);
                 }
                 epHead->nodeCount--;
-                return 0;
+                ret = 0;
+                goto OUT_RELEASE;
             }
             set_errno(ENOENT);
-            return -1;
+            break;
         case EPOLL_CTL_MOD:
             for (i = 0; i < epHead->nodeCount; i++) {
                 if (epHead->evs[i].data.fd == fd) {
                     epHead->evs[i].events = ev->events | POLLERR | POLLHUP;
-                    return 0;
+                    ret = 0;
+                    goto OUT_RELEASE;
                 }
             }
             set_errno(ENOENT);
-            return -1;
+            break;
         default:
             set_errno(EINVAL);
-            return -1;
+            break;
     }
+
+OUT_RELEASE:
+    (VOID)pthread_mutex_unlock(&g_epollMutex);
+    return ret;
 }
 
 int epoll_wait(int epfd, FAR struct epoll_event *evs, int maxevents, int timeout)
@@ -326,7 +338,7 @@ int epoll_wait(int epfd, FAR struct epoll_event *evs, int maxevents, int timeout
         return -1;
     }
 
-    for (i = 0; i < epHead->nodeCount; i++) {
+    for (i = 0; i < pollSize; i++) {
         pFd[i].fd = epHead->evs[i].data.fd;
         pFd[i].events = (short)epHead->evs[i].events;
     }

kernel/base/include/los_vm_map.h

@@ -157,7 +157,8 @@ typedef struct VmSpace {
 #define     VM_MAP_REGION_FLAG_SHM                  (1<<16)
 #define     VM_MAP_REGION_FLAG_FIXED                (1<<17)
 #define     VM_MAP_REGION_FLAG_FIXED_NOREPLACE      (1<<18)
-#define     VM_MAP_REGION_FLAG_INVALID              (1<<19) /* indicates that flags are not specified */
+#define     VM_MAP_REGION_FLAG_LITEIPC              (1<<19)
+#define     VM_MAP_REGION_FLAG_INVALID              (1<<20) /* indicates that flags are not specified */
 
 STATIC INLINE UINT32 OsCvtProtFlagsToRegionFlags(unsigned long prot, unsigned long flags)
 {

kernel/base/ipc/los_queue_debug.c

@@ -103,7 +103,7 @@ STATIC VOID SortQueueIndexArray(UINT32 *indexArray, UINT32 count)
     IpcSortParam queueSortParam;
     queueSortParam.buf = (CHAR *)g_queueDebugArray;
     queueSortParam.ipcDebugCBSize = sizeof(QueueDebugCB);
-    queueSortParam.ipcDebugCBCnt = LOSCFG_BASE_IPC_QUEUE_LIMIT;
+    queueSortParam.ipcDebugCBCnt = LOSCFG_BASE_IPC_SEM_LIMIT;
     queueSortParam.sortElemOff = LOS_OFF_SET_OF(QueueDebugCB, lastAccessTime);
 
     if (count > 0) {

kernel/base/misc/task_shellcmd.c

@@ -379,6 +379,7 @@ LITE_OS_SEC_TEXT_MINOR UINT32 OsShellCmdTskInfoGet(UINT32 processID, VOID *seqBu
     (VOID)memset_s(threadInfo, sizeof(ProcessThreadInfo), 0, sizeof(ProcessThreadInfo));
 
     if (OsGetProcessThreadInfo(processID, threadInfo) != LOS_OK) {
+        (VOID)LOS_MemFree(m_aucSysMem1, threadInfo);
         return LOS_NOK;
     }
 

kernel/base/vm/los_vm_dump.c

@@ -76,6 +76,8 @@ const CHAR *OsGetRegionNameOrFilePath(LosVmMapRegion *region)
         return "MMAP";
     } else if (region->regionFlags & VM_MAP_REGION_FLAG_SHM) {
         return "SHM";
+    } else if (region->regionFlags & VM_MAP_REGION_FLAG_LITEIPC) {
+        return "LITEIPC";
     } else {
         return "";
     }

kernel/base/vm/los_vm_syscall.c

@@ -273,6 +273,8 @@ STATIC UINT32 OsInheritOldRegionName(UINT32 oldRegionFlags)
         vmFlags |= VM_MAP_REGION_FLAG_MMAP;
     } else if (oldRegionFlags & VM_MAP_REGION_FLAG_SHM) {
         vmFlags |= VM_MAP_REGION_FLAG_SHM;
+    } else if (oldRegionFlags & VM_MAP_REGION_FLAG_LITEIPC) {
+        vmFlags |= VM_MAP_REGION_FLAG_LITEIPC;
     }
 
     return vmFlags;
@@ -298,7 +300,9 @@ INT32 LOS_DoMprotect(VADDR_T vaddr, size_t len, unsigned long prot)
         goto OUT_MPROTECT;
     }
 
-    if ((region->regionFlags & VM_MAP_REGION_FLAG_VDSO) || (region->regionFlags & VM_MAP_REGION_FLAG_HEAP)) {
+    if ((region->regionFlags & VM_MAP_REGION_FLAG_VDSO) ||
+        (region->regionFlags & VM_MAP_REGION_FLAG_HEAP) ||
+        (region->regionFlags & VM_MAP_REGION_FLAG_LITEIPC)) {
         ret = -EPERM;
         goto OUT_MPROTECT;
     }

kernel/base/vm/shm.c

@@ -689,6 +689,9 @@ INT32 ShmCtl(INT32 shmid, INT32 cmd, struct shmid_ds *buf)
                                     (shm_perm.mode & ACCESSPERMS);
             seg->ds.shm_ctime = time(NULL);
 #ifdef LOSCFG_SHELL
+            if (OsProcessIDUserCheckInvalid(shm_perm.uid)) {
+                break;
+            }
             (VOID)memcpy_s(seg->ownerName, OS_PCB_NAME_LEN, OS_PCB_FROM_PID(shm_perm.uid)->processName,
                            OS_PCB_NAME_LEN);
 #endif

kernel/common/console.c

@@ -687,7 +687,7 @@ STATIC ssize_t ConsoleRead(struct file *filep, CHAR *buffer, size_t bufLen)
     }
 
     if (userBuf) {
-        if (LOS_ArchCopyToUser(buffer, sbuffer, bufLen) != 0) {
+        if (LOS_ArchCopyToUser(buffer, sbuffer, ret) != 0) {
             ret = -EFAULT;
             goto ERROUT;
         }

kernel/extended/hidumper/los_hidumper.c

@@ -278,7 +278,6 @@ static void DumpFaultLog(void)
 
 static void DumpMemData(struct MemDumpParam *param)
 {
-    PRINTK("\nDumpType: %d\n", param->type);
     PRINTK("Unsupported now!\n");
 }
 

kernel/extended/liteipc/hm_liteipc.c

@@ -239,6 +239,7 @@ LITE_OS_SEC_TEXT STATIC int LiteIpcMmap(struct file *filep, LosVmMapRegion *regi
         goto ERROR_MAP_OUT;
     }
     ipcInfo->pool.poolSize = region->range.size;
+    region->regionFlags |= VM_MAP_REGION_FLAG_LITEIPC;
     return 0;
 ERROR_MAP_OUT:
     LOS_VFree(ipcInfo->pool.kvaddr);
@@ -757,7 +758,10 @@ LITE_OS_SEC_TEXT STATIC UINT32 HandlePtr(LosProcessCB *pcb, SpecialObj *obj, BOO
         obj->content.ptr.buff = (VOID *)GetIpcUserAddr(pcb, (INTPTR)buf);
         EnableIpcNodeFreeByUser(pcb, (VOID *)buf);
     } else {
-        (VOID)LiteIpcNodeFree(pcb, (VOID *)GetIpcKernelAddr(pcb, (INTPTR)obj->content.ptr.buff));
+        buf = (VOID *)GetIpcKernelAddr(pcb, (INTPTR)obj->content.ptr.buff);
+        if (IsIpcNode(pcb, buf) == TRUE) {
+            (VOID)LiteIpcNodeFree(pcb, buf);
+        }
     }
     return LOS_OK;
 }

kernel/extended/plimit/los_devicelimit.c

@@ -488,7 +488,7 @@ UINT32 OsDevLimitWriteDeny(ProcLimitSet *plimit, const CHAR *buf, UINT32 size)
 STATIC VOID DevLimitItemSetAccess(CHAR *accArray, INT16 access)
 {
     INT32 index = 0;
-    (VOID)memset_s(acc, ACCLEN, 0, ACCLEN);
+    (VOID)memset_s(accArray, ACCLEN, 0, ACCLEN);
     if (access & DEVLIMIT_ACC_READ) {
         accArray[index] = 'r';
         index++;

shell/full/src/base/shell_lk.c

@@ -154,7 +154,6 @@ INT32 CmdLog(INT32 argc, const CHAR **argv)
             PRINTK("not support yet\n");
         }
     } else if (!strncmp(argv[0], "path", strlen(argv[0]) + 1)) {
-        OsLkLogFileSet(argv[1]);
         PRINTK("not support yet\n");
     } else {
         PRINTK("Usage: log level <num>\n");

tools/build/mk/los_config.mk

@@ -124,6 +124,11 @@ LITEOS_BASELIB += -lcommon
 LIB_SUBDIRS       += kernel/common
 LITEOS_KERNEL_INCLUDE   += -I $(LITEOSTOPDIR)/kernel/common
 
+ifeq ($(LOSCFG_KERNEL_CONTAINER), y)
+    LITEOS_BASELIB    += -lcontainer
+    LIB_SUBDIRS       += kernel/extended/container
+endif
+
 ifeq ($(LOSCFG_KERNEL_CPPSUPPORT), y)
     LITEOS_BASELIB += -lcppsupport
     LIB_SUBDIRS       += kernel/extended/cppsupport