!1209 liteos_a 内核shell 漏洞修复

Merge pull request !1209 from hw_llm/master

OAT.xml

@@ -65,6 +65,8 @@
                 <!--filteritem type="filepath" name="projectroot/[a-zA-Z0-9]{20,}.sh" desc="Temp files"/-->
             </filefilter>
             <filefilter name="binaryFileTypePolicyFilter" desc="Filters for binary file policies">
+                <filteritem type="filepath" name="figures/architecture-of-the-openharmony-liteos-cortex-a-kernel.png" desc="architecture-of-the-openharmony-liteos-cortex-a-kernel"/>
+                <filteritem type="filepath" name="figures/OpenHarmony-LiteOS-A内核架构图.png" desc="LiteOS-A内核架构图"/>
                 <!--filteritem type="filename" name="*.uvwxyz" desc="Describe the reason for filtering scan results"/-->
                 <!--filteritem type="filepath" name="abcdefg/.*.uvwxyz" desc="Describe the reason for filtering scan results"/-->
                 <!--filteritem type="filepath" name="projectroot/[a-zA-Z0-9]{20,}.sh" desc="Temp files"/-->

compat/posix/src/mqueue.c

@@ -270,6 +270,7 @@ STATIC INT32 DoMqueueClose(struct mqpersonal *privateMqPersonal)
 {
     struct mqarray *mqueueCB = NULL;
     struct mqpersonal *tmp = NULL;
+    INT32 ret;
 
     mqueueCB = privateMqPersonal->mq_posixdes;
     if (mqueueCB == NULL || mqueueCB->mq_personal == NULL) {
@@ -277,6 +278,12 @@ STATIC INT32 DoMqueueClose(struct mqpersonal *privateMqPersonal)
         return LOS_NOK;
     }
 
+    if ((mqueueCB->unlinkflag == TRUE) && (privateMqPersonal->mq_next == NULL)) {
+        ret = DoMqueueDelete(mqueueCB);
+        if (ret < 0) {
+            return ret;
+        }
+    }
     /* find the personal and remove */
     if (mqueueCB->mq_personal == privateMqPersonal) {
         mqueueCB->mq_personal = privateMqPersonal->mq_next;
@@ -298,9 +305,6 @@ STATIC INT32 DoMqueueClose(struct mqpersonal *privateMqPersonal)
     /* free the personal */
     (VOID)LOS_MemFree(OS_SYS_MEM_ADDR, privateMqPersonal);
 
-    if ((mqueueCB->unlinkflag == TRUE) && (mqueueCB->mq_personal == NULL)) {
-        return DoMqueueDelete(mqueueCB);
-    }
     return LOS_OK;
 }
 
@@ -604,17 +608,19 @@ int OsMqGetAttr(mqd_t personal, struct mq_attr *mqAttr)
     struct mqarray *mqueueCB = NULL;
     struct mqpersonal *privateMqPersonal = NULL;
 
+    (VOID)pthread_mutex_lock(&IPC_QUEUE_MUTEX);
     privateMqPersonal = MqGetPrivDataBuff(personal);
     if (privateMqPersonal == NULL) {
+        (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);
         return -1;
     }
 
     if (mqAttr == NULL) {
         errno = EINVAL;
+        (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);
         return -1;
     }
 
-    (VOID)pthread_mutex_lock(&IPC_QUEUE_MUTEX);
     if (privateMqPersonal->mq_status != MQ_USE_MAGIC) {
         errno = EBADF;
         (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);
@@ -634,17 +640,19 @@ int OsMqSetAttr(mqd_t personal, const struct mq_attr *mqSetAttr, struct mq_attr
 {
     struct mqpersonal *privateMqPersonal = NULL;
 
+    (VOID)pthread_mutex_lock(&IPC_QUEUE_MUTEX);
     privateMqPersonal = MqGetPrivDataBuff(personal);
     if (privateMqPersonal == NULL) {
+        (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);
         return -1;
     }
 
     if (mqSetAttr == NULL) {
         errno = EINVAL;
+        (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);
         return -1;
     }
 
-    (VOID)pthread_mutex_lock(&IPC_QUEUE_MUTEX);
     if (privateMqPersonal->mq_status != MQ_USE_MAGIC) {
         errno = EBADF;
         (VOID)pthread_mutex_unlock(&IPC_QUEUE_MUTEX);

fs/jffs2/jffs2.patch

@@ -6340,7 +6340,7 @@ diff -Nupr old/fs/jffs2/summary.h new/fs/jffs2/summary.h
 diff -Nupr old/fs/jffs2/super.c new/fs/jffs2/super.c
 --- old/fs/jffs2/super.c	2022-05-09 17:22:53.000000000 +0800
 +++ new/fs/jffs2/super.c	2022-05-09 20:09:32.170000000 +0800
-@@ -9,433 +9,188 @@
+@@ -9,434 +9,188 @@
   *
   */
  
@@ -6418,6 +6418,7 @@ diff -Nupr old/fs/jffs2/super.c new/fs/jffs2/super.c
 +	c->cleanmarker_size = sizeof(struct jffs2_unknown_node);
  
 -	mutex_init(&f->sem);
+-	f->target = NULL;
 -	inode_init_once(&f->vfs_inode);
 -}
 +	ret = jffs2_do_mount_fs(c);
@@ -8667,7 +8668,7 @@ diff -Nupr old/fs/jffs2/writev.c new/fs/jffs2/writev.c
 diff -Nupr old/fs/jffs2/xattr.c new/fs/jffs2/xattr.c
 --- old/fs/jffs2/xattr.c	2022-05-09 17:15:24.360000000 +0800
 +++ new/fs/jffs2/xattr.c	1970-01-01 08:00:00.000000000 +0800
-@@ -1,1347 +0,0 @@
+@@ -1,1352 +0,0 @@
 -/*
 - * JFFS2 -- Journalling Flash File System, Version 2.
 - *
@@ -9442,10 +9443,10 @@ diff -Nupr old/fs/jffs2/xattr.c new/fs/jffs2/xattr.c
 -}
 -
 -#define XREF_TMPHASH_SIZE	(128)
--void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
+-int jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
 -{
 -	struct jffs2_xattr_ref *ref, *_ref;
--	struct jffs2_xattr_ref *xref_tmphash[XREF_TMPHASH_SIZE];
+-	struct jffs2_xattr_ref **xref_tmphash;
 -	struct jffs2_xattr_datum *xd, *_xd;
 -	struct jffs2_inode_cache *ic;
 -	struct jffs2_raw_node_ref *raw;
@@ -9454,9 +9455,12 @@ diff -Nupr old/fs/jffs2/xattr.c new/fs/jffs2/xattr.c
 -
 -	BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
 -
+-	xref_tmphash = kcalloc(XREF_TMPHASH_SIZE,
+-			       sizeof(struct jffs2_xattr_ref *), GFP_KERNEL);
+-	if (!xref_tmphash)
+-		return -ENOMEM;
+-
 -	/* Phase.1 : Merge same xref */
--	for (i=0; i < XREF_TMPHASH_SIZE; i++)
--		xref_tmphash[i] = NULL;
 -	for (ref=c->xref_temp; ref; ref=_ref) {
 -		struct jffs2_xattr_ref *tmp;
 -
@@ -9554,6 +9558,8 @@ diff -Nupr old/fs/jffs2/xattr.c new/fs/jffs2/xattr.c
 -		     "%u of xref (%u dead, %u orphan) found.\n",
 -		     xdatum_count, xdatum_unchecked_count, xdatum_orphan_count,
 -		     xref_count, xref_dead_count, xref_orphan_count);
+-	kfree(xref_tmphash);
+-	return 0;
 -}
 -
 -struct jffs2_xattr_datum *jffs2_setup_xattr_datum(struct jffs2_sb_info *c,

kernel/base/ipc/los_queue_debug.c

@@ -103,7 +103,7 @@ STATIC VOID SortQueueIndexArray(UINT32 *indexArray, UINT32 count)
     IpcSortParam queueSortParam;
     queueSortParam.buf = (CHAR *)g_queueDebugArray;
     queueSortParam.ipcDebugCBSize = sizeof(QueueDebugCB);
-    queueSortParam.ipcDebugCBCnt = LOSCFG_BASE_IPC_SEM_LIMIT;
+    queueSortParam.ipcDebugCBCnt = LOSCFG_BASE_IPC_QUEUE_LIMIT;
     queueSortParam.sortElemOff = LOS_OFF_SET_OF(QueueDebugCB, lastAccessTime);
 
     if (count > 0) {

kernel/extended/plimit/los_devicelimit.c

@@ -488,7 +488,7 @@ UINT32 OsDevLimitWriteDeny(ProcLimitSet *plimit, const CHAR *buf, UINT32 size)
 STATIC VOID DevLimitItemSetAccess(CHAR *accArray, INT16 access)
 {
     INT32 index = 0;
-    (VOID)memset_s(acc, ACCLEN, 0, ACCLEN);
+    (VOID)memset_s(accArray, ACCLEN, 0, ACCLEN);
     if (access & DEVLIMIT_ACC_READ) {
         accArray[index] = 'r';
         index++;

shell/full/src/base/shell_lk.c

@@ -154,7 +154,6 @@ INT32 CmdLog(INT32 argc, const CHAR **argv)
             PRINTK("not support yet\n");
         }
     } else if (!strncmp(argv[0], "path", strlen(argv[0]) + 1)) {
-        OsLkLogFileSet(argv[1]);
         PRINTK("not support yet\n");
     } else {
         PRINTK("Usage: log level <num>\n");

syscall/net_syscall.c

@@ -401,7 +401,7 @@ ssize_t SysSendMsg(int s, const struct msghdr *message, int flags)
     CHECK_ASPACE(message, sizeof(struct msghdr));
     CPY_FROM_CONST_USER(struct msghdr, message);
 
-    if (message && message->msg_iovlen > IOV_MAX) {
+    if (message && (size_t)message->msg_iovlen > IOV_MAX) {
         set_errno(EMSGSIZE);
         return -get_errno();
     }
@@ -449,7 +449,7 @@ ssize_t SysRecvMsg(int s, struct msghdr *message, int flags)
     CHECK_ASPACE(message, sizeof(struct msghdr));
     CPY_FROM_NONCONST_USER(message);
 
-    if (message && message->msg_iovlen > IOV_MAX) {
+    if (message && (size_t)message->msg_iovlen > IOV_MAX) {
         set_errno(EMSGSIZE);
         return -get_errno();
     }

tools/build/mk/los_config.mk

@@ -124,6 +124,11 @@ LITEOS_BASELIB += -lcommon
 LIB_SUBDIRS       += kernel/common
 LITEOS_KERNEL_INCLUDE   += -I $(LITEOSTOPDIR)/kernel/common
 
+ifeq ($(LOSCFG_KERNEL_CONTAINER), y)
+    LITEOS_BASELIB    += -lcontainer
+    LIB_SUBDIRS       += kernel/extended/container
+endif
+
 ifeq ($(LOSCFG_KERNEL_CPPSUPPORT), y)
     LITEOS_BASELIB += -lcppsupport
     LIB_SUBDIRS       += kernel/extended/cppsupport