!1197 整数溢出漏洞修复

Merge pull request !1197 from hw_llm/master

OAT.xml

@@ -65,6 +65,8 @@
                 <!--filteritem type="filepath" name="projectroot/[a-zA-Z0-9]{20,}.sh" desc="Temp files"/-->
             </filefilter>
             <filefilter name="binaryFileTypePolicyFilter" desc="Filters for binary file policies">
+                <filteritem type="filepath" name="figures/architecture-of-the-openharmony-liteos-cortex-a-kernel.png" desc="architecture-of-the-openharmony-liteos-cortex-a-kernel"/>
+                <filteritem type="filepath" name="figures/OpenHarmony-LiteOS-A内核架构图.png" desc="LiteOS-A内核架构图"/>
                 <!--filteritem type="filename" name="*.uvwxyz" desc="Describe the reason for filtering scan results"/-->
                 <!--filteritem type="filepath" name="abcdefg/.*.uvwxyz" desc="Describe the reason for filtering scan results"/-->
                 <!--filteritem type="filepath" name="projectroot/[a-zA-Z0-9]{20,}.sh" desc="Temp files"/-->

bundle.json

@@ -27,9 +27,6 @@
     "component": {
         "name": "liteos_a",
         "subsystem": "kernel",
-        "syscap": [
-            "SystemCapability.Kernel.Liteos-A"
-        ],
         "features": [],
         "adapted_system_type": [
             "small"

compat/posix/src/mqueue.c

@@ -270,6 +270,7 @@ STATIC INT32 DoMqueueClose(struct mqpersonal *privateMqPersonal)
 {
     struct mqarray *mqueueCB = NULL;
     struct mqpersonal *tmp = NULL;
+    INT32 ret;
 
     mqueueCB = privateMqPersonal->mq_posixdes;
     if (mqueueCB == NULL || mqueueCB->mq_personal == NULL) {
@@ -277,6 +278,12 @@ STATIC INT32 DoMqueueClose(struct mqpersonal *privateMqPersonal)
         return LOS_NOK;
     }
 
+    if ((mqueueCB->unlinkflag == TRUE) && (privateMqPersonal->mq_next == NULL)) {
+        ret = DoMqueueDelete(mqueueCB);
+        if (ret < 0) {
+            return ret;
+        }
+    }
     /* find the personal and remove */
     if (mqueueCB->mq_personal == privateMqPersonal) {
         mqueueCB->mq_personal = privateMqPersonal->mq_next;
@@ -298,9 +305,6 @@ STATIC INT32 DoMqueueClose(struct mqpersonal *privateMqPersonal)
     /* free the personal */
     (VOID)LOS_MemFree(OS_SYS_MEM_ADDR, privateMqPersonal);
 
-    if ((mqueueCB->unlinkflag == TRUE) && (mqueueCB->mq_personal == NULL)) {
-        return DoMqueueDelete(mqueueCB);
-    }
     return LOS_OK;
 }
 
@@ -604,17 +608,19 @@ int OsMqGetAttr(mqd_t personal, struct mq_attr *mqAttr)
     struct mqarray *mqueueCB = NULL;
     struct mqpersonal *privateMqPersonal = NULL;
 
+    (VOID)pthread_mutex_lock(&IPC_QUEUE_MUTEX);
     privateMqPersonal = MqGetPrivDataBuff(personal);
     if (privateMqPersonal == NULL) {
+        (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);
         return -1;
     }
 
     if (mqAttr == NULL) {
         errno = EINVAL;
+        (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);
         return -1;
     }
 
-    (VOID)pthread_mutex_lock(&IPC_QUEUE_MUTEX);
     if (privateMqPersonal->mq_status != MQ_USE_MAGIC) {
         errno = EBADF;
         (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);
@@ -634,17 +640,19 @@ int OsMqSetAttr(mqd_t personal, const struct mq_attr *mqSetAttr, struct mq_attr
 {
     struct mqpersonal *privateMqPersonal = NULL;
 
+    (VOID)pthread_mutex_lock(&IPC_QUEUE_MUTEX);
     privateMqPersonal = MqGetPrivDataBuff(personal);
     if (privateMqPersonal == NULL) {
+        (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);
         return -1;
     }
 
     if (mqSetAttr == NULL) {
         errno = EINVAL;
+        (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);
         return -1;
     }
 
-    (VOID)pthread_mutex_lock(&IPC_QUEUE_MUTEX);
     if (privateMqPersonal->mq_status != MQ_USE_MAGIC) {
         errno = EBADF;
         (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);

fs/jffs2/jffs2.patch

@@ -2311,7 +2311,7 @@ diff -Nupr old/fs/jffs2/erase.c new/fs/jffs2/erase.c
 diff -Nupr old/fs/jffs2/file.c new/fs/jffs2/file.c
 --- old/fs/jffs2/file.c	2022-05-09 17:22:53.000000000 +0800
 +++ new/fs/jffs2/file.c	2022-05-10 09:43:14.250000000 +0800
-@@ -9,335 +9,30 @@
+@@ -9,334 +9,31 @@
   * For licensing information, see the file 'LICENCE' in this directory.
   *
   */
@@ -2348,7 +2348,7 @@ diff -Nupr old/fs/jffs2/file.c new/fs/jffs2/file.c
 -	struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
 +	/* FIXME: This works only with one file system mounted at a time */
  	int ret;
--
+ 
 -	ret = file_write_and_wait_range(filp, start, end);
 +	ret = jffs2_read_inode_range(c, f, gc_buffer,
 +			 offset & ~(PAGE_SIZE-1), PAGE_SIZE);
@@ -2361,8 +2361,10 @@ diff -Nupr old/fs/jffs2/file.c new/fs/jffs2/file.c
 -	inode_unlock(inode);
 -
 -	return 0;
--}
--
++		return ERR_PTR(ret);
++	return gc_buffer;
+ }
+ 
 -const struct file_operations jffs2_file_operations =
 -{
 -	.llseek =	generic_file_llseek,
@@ -2387,7 +2389,10 @@ diff -Nupr old/fs/jffs2/file.c new/fs/jffs2/file.c
 -};
 -
 -const struct address_space_operations jffs2_file_address_operations =
--{
++void jffs2_gc_release_page(struct jffs2_sb_info *c,
++			   unsigned char *ptr,
++			   unsigned long *priv)
+ {
 -	.readpage =	jffs2_readpage,
 -	.write_begin =	jffs2_write_begin,
 -	.write_end =	jffs2_write_end,
@@ -2443,35 +2448,29 @@ diff -Nupr old/fs/jffs2/file.c new/fs/jffs2/file.c
 -	ret = jffs2_do_readpage_unlock(pg->mapping->host, pg);
 -	mutex_unlock(&f->sem);
 -	return ret;
-+		return ERR_PTR(ret);
-+	return gc_buffer;
- }
- 
+-}
+-
 -static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
 -			loff_t pos, unsigned len, unsigned flags,
 -			struct page **pagep, void **fsdata)
-+void jffs2_gc_release_page(struct jffs2_sb_info *c,
-+			   unsigned char *ptr,
-+			   unsigned long *priv)
- {
+-{
 -	struct page *pg;
 -	struct inode *inode = mapping->host;
 -	struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
 -	struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
 -	pgoff_t index = pos >> PAGE_SHIFT;
--	uint32_t pageofs = index << PAGE_SHIFT;
 -	int ret = 0;
 -
 -	jffs2_dbg(1, "%s()\n", __func__);
 -
--	if (pageofs > inode->i_size) {
--		/* Make new hole frag from old EOF to new page */
+-	if (pos > inode->i_size) {
+-		/* Make new hole frag from old EOF to new position */
 -		struct jffs2_raw_inode ri;
 -		struct jffs2_full_dnode *fn;
 -		uint32_t alloc_len;
 -
--		jffs2_dbg(1, "Writing new hole frag 0x%x-0x%x between current EOF and new page\n",
--			  (unsigned int)inode->i_size, pageofs);
+-		jffs2_dbg(1, "Writing new hole frag 0x%x-0x%x between current EOF and new position\n",
+-			  (unsigned int)inode->i_size, (uint32_t)pos);
 -
 -		ret = jffs2_reserve_space(c, sizeof(ri), &alloc_len,
 -					  ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
@@ -2491,10 +2490,10 @@ diff -Nupr old/fs/jffs2/file.c new/fs/jffs2/file.c
 -		ri.mode = cpu_to_jemode(inode->i_mode);
 -		ri.uid = cpu_to_je16(i_uid_read(inode));
 -		ri.gid = cpu_to_je16(i_gid_read(inode));
--		ri.isize = cpu_to_je32(max((uint32_t)inode->i_size, pageofs));
+-		ri.isize = cpu_to_je32((uint32_t)pos);
 -		ri.atime = ri.ctime = ri.mtime = cpu_to_je32(JFFS2_NOW());
 -		ri.offset = cpu_to_je32(inode->i_size);
--		ri.dsize = cpu_to_je32(pageofs - inode->i_size);
+-		ri.dsize = cpu_to_je32((uint32_t)pos - inode->i_size);
 -		ri.csize = cpu_to_je32(0);
 -		ri.compr = JFFS2_COMPR_ZERO;
 -		ri.node_crc = cpu_to_je32(crc32(0, &ri, sizeof(ri)-8));
@@ -2524,7 +2523,7 @@ diff -Nupr old/fs/jffs2/file.c new/fs/jffs2/file.c
 -			goto out_err;
 -		}
 -		jffs2_complete_reservation(c);
--		inode->i_size = pageofs;
+-		inode->i_size = pos;
 -		mutex_unlock(&f->sem);
 -	}
 -
@@ -8668,7 +8667,7 @@ diff -Nupr old/fs/jffs2/writev.c new/fs/jffs2/writev.c
 diff -Nupr old/fs/jffs2/xattr.c new/fs/jffs2/xattr.c
 --- old/fs/jffs2/xattr.c	2022-05-09 17:15:24.360000000 +0800
 +++ new/fs/jffs2/xattr.c	1970-01-01 08:00:00.000000000 +0800
-@@ -1,1347 +0,0 @@
+@@ -1,1352 +0,0 @@
 -/*
 - * JFFS2 -- Journalling Flash File System, Version 2.
 - *
@@ -9443,10 +9442,10 @@ diff -Nupr old/fs/jffs2/xattr.c new/fs/jffs2/xattr.c
 -}
 -
 -#define XREF_TMPHASH_SIZE	(128)
--void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
+-int jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
 -{
 -	struct jffs2_xattr_ref *ref, *_ref;
--	struct jffs2_xattr_ref *xref_tmphash[XREF_TMPHASH_SIZE];
+-	struct jffs2_xattr_ref **xref_tmphash;
 -	struct jffs2_xattr_datum *xd, *_xd;
 -	struct jffs2_inode_cache *ic;
 -	struct jffs2_raw_node_ref *raw;
@@ -9455,9 +9454,12 @@ diff -Nupr old/fs/jffs2/xattr.c new/fs/jffs2/xattr.c
 -
 -	BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
 -
+-	xref_tmphash = kcalloc(XREF_TMPHASH_SIZE,
+-			       sizeof(struct jffs2_xattr_ref *), GFP_KERNEL);
+-	if (!xref_tmphash)
+-		return -ENOMEM;
+-
 -	/* Phase.1 : Merge same xref */
--	for (i=0; i < XREF_TMPHASH_SIZE; i++)
--		xref_tmphash[i] = NULL;
 -	for (ref=c->xref_temp; ref; ref=_ref) {
 -		struct jffs2_xattr_ref *tmp;
 -
@@ -9555,6 +9557,8 @@ diff -Nupr old/fs/jffs2/xattr.c new/fs/jffs2/xattr.c
 -		     "%u of xref (%u dead, %u orphan) found.\n",
 -		     xdatum_count, xdatum_unchecked_count, xdatum_orphan_count,
 -		     xref_count, xref_dead_count, xref_orphan_count);
+-	kfree(xref_tmphash);
+-	return 0;
 -}
 -
 -struct jffs2_xattr_datum *jffs2_setup_xattr_datum(struct jffs2_sb_info *c,

kernel/base/ipc/los_queue_debug.c

@@ -103,7 +103,7 @@ STATIC VOID SortQueueIndexArray(UINT32 *indexArray, UINT32 count)
     IpcSortParam queueSortParam;
     queueSortParam.buf = (CHAR *)g_queueDebugArray;
     queueSortParam.ipcDebugCBSize = sizeof(QueueDebugCB);
-    queueSortParam.ipcDebugCBCnt = LOSCFG_BASE_IPC_SEM_LIMIT;
+    queueSortParam.ipcDebugCBCnt = LOSCFG_BASE_IPC_QUEUE_LIMIT;
     queueSortParam.sortElemOff = LOS_OFF_SET_OF(QueueDebugCB, lastAccessTime);
 
     if (count > 0) {

syscall/net_syscall.c

@@ -401,7 +401,7 @@ ssize_t SysSendMsg(int s, const struct msghdr *message, int flags)
     CHECK_ASPACE(message, sizeof(struct msghdr));
     CPY_FROM_CONST_USER(struct msghdr, message);
 
-    if (message && message->msg_iovlen > IOV_MAX) {
+    if (message && (size_t)message->msg_iovlen > IOV_MAX) {
         set_errno(EMSGSIZE);
         return -get_errno();
     }
@@ -449,7 +449,7 @@ ssize_t SysRecvMsg(int s, struct msghdr *message, int flags)
     CHECK_ASPACE(message, sizeof(struct msghdr));
     CPY_FROM_NONCONST_USER(message);
 
-    if (message && message->msg_iovlen > IOV_MAX) {
+    if (message && (size_t)message->msg_iovlen > IOV_MAX) {
         set_errno(EMSGSIZE);
         return -get_errno();
     }