!1242 fs_epoll竞争漏洞修复

Merge pull request !1242 from 石子怡/master

drivers/char/mem/src/mem.c

@@ -61,7 +61,7 @@ static ssize_t MemMap(struct file *filep, LosVmMapRegion *region)
     VADDR_T vaddr = region->range.base;
     LosVmSpace *space = LOS_SpaceGet(vaddr);
 
-    if ((paddr >= SYS_MEM_BASE) && (paddr < SYS_MEM_END)) {
+    if (((paddr + size) >= SYS_MEM_BASE) && (paddr < SYS_MEM_END)) {
         return -EINVAL;
     }
 

fs/vfs/epoll/fs_epoll.c

@@ -220,14 +220,18 @@ int epoll_close(int epfd)
 {
     struct epoll_head *epHead = NULL;
 
+    (VOID)pthread_mutex_lock(&g_epollMutex);
     epHead = EpollGetDataBuff(epfd);
     if (epHead == NULL) {
+        (VOID)pthread_mutex_unlock(&g_epollMutex);
         set_errno(EBADF);
         return -1;
     }
 
     DoEpollClose(epHead);
-    return EpollFreeSysFd(epfd);
+    int ret = EpollFreeSysFd(epfd);
+    (VOID)pthread_mutex_unlock(&g_epollMutex);
+    return ret;
 }
 
 int epoll_ctl(int epfd, int op, int fd, struct epoll_event *ev)
@@ -236,15 +240,16 @@ int epoll_ctl(int epfd, int op, int fd, struct epoll_event *ev)
     int i;
     int ret = -1;
 
+    (VOID)pthread_mutex_lock(&g_epollMutex);
     epHead = EpollGetDataBuff(epfd);
     if (epHead == NULL) {
         set_errno(EBADF);
-        return ret;
+        goto OUT_RELEASE;
     }
 
     if (ev == NULL) {
         set_errno(EINVAL);
-        return -1;
+        goto OUT_RELEASE;
     }
 
     switch (op) {
@@ -252,18 +257,19 @@ int epoll_ctl(int epfd, int op, int fd, struct epoll_event *ev)
             ret = CheckFdExist(epHead, fd);
             if (ret == -1) {
                 set_errno(EEXIST);
-                return -1;
+                goto OUT_RELEASE;
             }
 
             if (epHead->nodeCount == EPOLL_DEFAULT_SIZE) {
                 set_errno(ENOMEM);
-                return -1;
+                goto OUT_RELEASE;
             }
 
             epHead->evs[epHead->nodeCount].events = ev->events | POLLERR | POLLHUP;
             epHead->evs[epHead->nodeCount].data.fd = fd;
             epHead->nodeCount++;
-            return 0;
+            ret = 0;
+            break;
         case EPOLL_CTL_DEL:
             for (i = 0; i < epHead->nodeCount; i++) {
                 if (epHead->evs[i].data.fd != fd) {
@@ -275,23 +281,29 @@ int epoll_ctl(int epfd, int op, int fd, struct epoll_event *ev)
                               epHead->nodeCount - i);
                 }
                 epHead->nodeCount--;
-                return 0;
+                ret = 0;
+                goto OUT_RELEASE;
             }
             set_errno(ENOENT);
-            return -1;
+            break;
         case EPOLL_CTL_MOD:
             for (i = 0; i < epHead->nodeCount; i++) {
                 if (epHead->evs[i].data.fd == fd) {
                     epHead->evs[i].events = ev->events | POLLERR | POLLHUP;
-                    return 0;
+                    ret = 0;
+                    goto OUT_RELEASE;
                 }
             }
             set_errno(ENOENT);
-            return -1;
+            break;
         default:
             set_errno(EINVAL);
-            return -1;
+            break;
     }
+
+OUT_RELEASE:
+    (VOID)pthread_mutex_unlock(&g_epollMutex);
+    return ret;
 }
 
 int epoll_wait(int epfd, FAR struct epoll_event *evs, int maxevents, int timeout)

kernel/base/vm/shm.c

@@ -689,6 +689,9 @@ INT32 ShmCtl(INT32 shmid, INT32 cmd, struct shmid_ds *buf)
                                     (shm_perm.mode & ACCESSPERMS);
             seg->ds.shm_ctime = time(NULL);
 #ifdef LOSCFG_SHELL
+            if (OsProcessIDUserCheckInvalid(shm_perm.uid)) {
+                break;
+            }
             (VOID)memcpy_s(seg->ownerName, OS_PCB_NAME_LEN, OS_PCB_FROM_PID(shm_perm.uid)->processName,
                            OS_PCB_NAME_LEN);
 #endif

kernel/extended/hidumper/los_hidumper.c

@@ -278,7 +278,6 @@ static void DumpFaultLog(void)
 
 static void DumpMemData(struct MemDumpParam *param)
 {
-    PRINTK("\nDumpType: %d\n", param->type);
     PRINTK("Unsupported now!\n");
 }