Compare commits

...

6 Commits

Author SHA1 Message Date
openharmony_ci
c2cb0435b2 !1182 LTS 5.10 补丁升级适配
Merge pull request !1182 from Ywenrui44091/master
2023-11-20 04:43:43 +00:00
yaowenrui
4fbb41b7d5 LTS 5.10 补丁升级适配
Signed-off-by: yaowenrui <yaowenrui2@huawei.com>
2023-11-16 10:46:44 +08:00
openharmony_ci
04f971084b !1178 fix: /dev/mem 及 /proc/fs_cache 权限漏洞修复
Merge pull request !1178 from yinjiaming/fix
2023-10-16 09:38:00 +00:00
yinjiaming
6daecc8d26 fix: /dev/mem 及 /proc/fs_cache 权限漏洞修复
/dev/mem 和 /proc/fs_cache 存在多余的读写权限,
有被低权限者利用进行攻击的风险,现予以修复。

Signed-off-by: yinjiaming <yinjiaming@huawei.com>
Change-Id: Ie6b537e8cb1de7353dfc357411eba4920a539b4f
2023-10-12 09:52:18 +08:00
openharmony_ci
173cdeb077 !1166 fix: 修复告警
Merge pull request !1166 from Zhaotianyu/20230526fix_codecheck
2023-09-05 13:36:55 +00:00
arvinzzz
145ff76ab6 refactor: fix codecheck
Signed-off-by: arvinzzz <zhaotianyu9@huawei.com>
Change-Id: Ib35ca40dc837d78a4c9dc03e44d117088865a5a6
2023-05-26 15:44:47 +08:00
5 changed files with 42 additions and 37 deletions

View File

@@ -97,5 +97,5 @@ static const struct file_operations_vfs g_memDevOps = {
int DevMemRegister(void)
{
return register_driver("/dev/mem", &g_memDevOps, 0666, 0); /* 0666: file mode */
return register_driver("/dev/mem", &g_memDevOps, 0644, 0); /* 0644: file mode */
}

View File

@@ -2311,7 +2311,7 @@ diff -Nupr old/fs/jffs2/erase.c new/fs/jffs2/erase.c
diff -Nupr old/fs/jffs2/file.c new/fs/jffs2/file.c
--- old/fs/jffs2/file.c 2022-05-09 17:22:53.000000000 +0800
+++ new/fs/jffs2/file.c 2022-05-10 09:43:14.250000000 +0800
@@ -9,335 +9,30 @@
@@ -9,334 +9,31 @@
* For licensing information, see the file 'LICENCE' in this directory.
*
*/
@@ -2348,7 +2348,7 @@ diff -Nupr old/fs/jffs2/file.c new/fs/jffs2/file.c
- struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
+ /* FIXME: This works only with one file system mounted at a time */
int ret;
-
- ret = file_write_and_wait_range(filp, start, end);
+ ret = jffs2_read_inode_range(c, f, gc_buffer,
+ offset & ~(PAGE_SIZE-1), PAGE_SIZE);
@@ -2361,8 +2361,10 @@ diff -Nupr old/fs/jffs2/file.c new/fs/jffs2/file.c
- inode_unlock(inode);
-
- return 0;
-}
-
+ return ERR_PTR(ret);
+ return gc_buffer;
}
-const struct file_operations jffs2_file_operations =
-{
- .llseek = generic_file_llseek,
@@ -2387,7 +2389,10 @@ diff -Nupr old/fs/jffs2/file.c new/fs/jffs2/file.c
-};
-
-const struct address_space_operations jffs2_file_address_operations =
-{
+void jffs2_gc_release_page(struct jffs2_sb_info *c,
+ unsigned char *ptr,
+ unsigned long *priv)
{
- .readpage = jffs2_readpage,
- .write_begin = jffs2_write_begin,
- .write_end = jffs2_write_end,
@@ -2443,35 +2448,29 @@ diff -Nupr old/fs/jffs2/file.c new/fs/jffs2/file.c
- ret = jffs2_do_readpage_unlock(pg->mapping->host, pg);
- mutex_unlock(&f->sem);
- return ret;
+ return ERR_PTR(ret);
+ return gc_buffer;
}
-}
-
-static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
- loff_t pos, unsigned len, unsigned flags,
- struct page **pagep, void **fsdata)
+void jffs2_gc_release_page(struct jffs2_sb_info *c,
+ unsigned char *ptr,
+ unsigned long *priv)
{
-{
- struct page *pg;
- struct inode *inode = mapping->host;
- struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
- struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
- pgoff_t index = pos >> PAGE_SHIFT;
- uint32_t pageofs = index << PAGE_SHIFT;
- int ret = 0;
-
- jffs2_dbg(1, "%s()\n", __func__);
-
- if (pageofs > inode->i_size) {
- /* Make new hole frag from old EOF to new page */
- if (pos > inode->i_size) {
- /* Make new hole frag from old EOF to new position */
- struct jffs2_raw_inode ri;
- struct jffs2_full_dnode *fn;
- uint32_t alloc_len;
-
- jffs2_dbg(1, "Writing new hole frag 0x%x-0x%x between current EOF and new page\n",
- (unsigned int)inode->i_size, pageofs);
- jffs2_dbg(1, "Writing new hole frag 0x%x-0x%x between current EOF and new position\n",
- (unsigned int)inode->i_size, (uint32_t)pos);
-
- ret = jffs2_reserve_space(c, sizeof(ri), &alloc_len,
- ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
@@ -2491,10 +2490,10 @@ diff -Nupr old/fs/jffs2/file.c new/fs/jffs2/file.c
- ri.mode = cpu_to_jemode(inode->i_mode);
- ri.uid = cpu_to_je16(i_uid_read(inode));
- ri.gid = cpu_to_je16(i_gid_read(inode));
- ri.isize = cpu_to_je32(max((uint32_t)inode->i_size, pageofs));
- ri.isize = cpu_to_je32((uint32_t)pos);
- ri.atime = ri.ctime = ri.mtime = cpu_to_je32(JFFS2_NOW());
- ri.offset = cpu_to_je32(inode->i_size);
- ri.dsize = cpu_to_je32(pageofs - inode->i_size);
- ri.dsize = cpu_to_je32((uint32_t)pos - inode->i_size);
- ri.csize = cpu_to_je32(0);
- ri.compr = JFFS2_COMPR_ZERO;
- ri.node_crc = cpu_to_je32(crc32(0, &ri, sizeof(ri)-8));
@@ -2524,7 +2523,7 @@ diff -Nupr old/fs/jffs2/file.c new/fs/jffs2/file.c
- goto out_err;
- }
- jffs2_complete_reservation(c);
- inode->i_size = pageofs;
- inode->i_size = pos;
- mutex_unlock(&f->sem);
- }
-

View File

@@ -490,14 +490,14 @@ off_t VfsJffs2Seek(struct file *filep, off_t offset, int whence)
filePos = filep->f_pos;
switch (whence) {
case SEEK_SET:
filePos = offset;
break;
case SEEK_CUR:
filePos += offset;
break;
case SEEK_SET:
filePos = offset;
break;
case SEEK_END:
filePos = node->i_size + offset;
break;

View File

@@ -207,7 +207,7 @@ static const struct ProcFileOperations FS_CACHE_PROC_FOPS = {
void ProcFsCacheInit(void)
{
struct ProcDirEntry *pde = CreateProcEntry("fs_cache", 0, NULL);
struct ProcDirEntry *pde = CreateProcEntry("fs_cache", 0400, NULL);
if (pde == NULL) {
PRINT_ERR("create fs_cache error!\n");
return;

View File

@@ -485,29 +485,35 @@ UINT32 OsDevLimitWriteDeny(ProcLimitSet *plimit, const CHAR *buf, UINT32 size)
return DevLimitUpdateAccess(plimit, buf, DEVLIMIT_DENY);
}
STATIC VOID DevLimitItemSetAccess(CHAR *acc, INT16 access)
STATIC VOID DevLimitItemSetAccess(CHAR *accArray, INT16 access)
{
INT32 index = 0;
(VOID)memset_s(acc, ACCLEN, 0, ACCLEN);
if (access & DEVLIMIT_ACC_READ) {
acc[index++] = 'r';
accArray[index] = 'r';
index++;
}
if (access & DEVLIMIT_ACC_WRITE) {
acc[index++] = 'w';
accArray[index] = 'w';
index++;
}
if (access & DEVLIMIT_ACC_MKNOD) {
acc[index++] = 'm';
accArray[index] = 'm';
index++;
}
}
STATIC CHAR DevLimitItemTypeToChar(INT16 type)
{
if (type == DEVLIMIT_DEV_ALL) {
return 'a';
} else if (type == DEVLIMIT_DEV_CHAR) {
return 'c';
} else if (type == DEVLIMIT_DEV_BLOCK) {
return 'b';
switch (type) {
case DEVLIMIT_DEV_ALL:
return 'a';
case DEVLIMIT_DEV_CHAR:
return 'c';
case DEVLIMIT_DEV_BLOCK:
return 'b';
default:
break;
}
return 'X';
}