Skip to content

[lwp] fix: reject user-supplied counts whose byte size wraps - #11954

Open
Yunlk wants to merge 2 commits into
RT-Thread:masterfrom
Yunlk:fix/lwp-count-overflow
Open

[lwp] fix: reject user-supplied counts whose byte size wraps#11954
Yunlk wants to merge 2 commits into
RT-Thread:masterfrom
Yunlk:fix/lwp-count-overflow

Conversation

@Yunlk

@Yunlk Yunlk commented Oct 30, 2026

Copy link
Copy Markdown
Contributor

拉取/合并请求描述：(PR description)

[

为什么提交这份PR (why to submit this PR)

修复 #11925（前半部分，见末尾说明）。

sys_poll() 用用户进程给的数量算内核缓冲区大小，乘法在 32 位下回绕，但随后仍用未回绕的原始数量遍历：

if (!lwp_user_accessable((void *)fds, nfds * sizeof *fds))   /* 回绕 */
    return -EFAULT;
kfds = (struct pollfd *)kmem_get(nfds * sizeof *kfds);       /* 回绕 */
ret = poll(kfds, nfds, timeout);                              /* 用完整 nfds */

nfds = 0x20000001、sizeof(struct pollfd) = 8 时乘积 0x1_00000008 截成 8，访问校验与分配都按 8 字节通过，而 poll() 会遍历全部 536,870,913 项，do_pollfd() 里的 pollfd->fd 读与 revents 写都落在块外。64 位构建不受影响（乘积提升到 64 位，超大分配直接 ENOMEM）。

sys_epoll_pwait() 是同一形状，且它的 cnt 是 int，负值也要一并拒绝。

你的解决方案是什么 (what is your solution)

在拿这些数量算任何大小之前，先拒绝无法表示的组合，写法与 sys_sendmsg/sys_recvmsg 里对 msg_iovlen 的校验保持一致：

/* sys_poll()，两个分支各一处 */
if (nfds > SIZE_MAX / sizeof(*fds))
{
    return -EINVAL;
}

/* sys_epoll_pwait() */
if (cnt < 0 || (size_t)cnt > SIZE_MAX / sizeof(struct epoll_event))
{
    return -EINVAL;
}

请提供验证的bsp和config (provide the config and bsp)

注意：本 PR 未能在本地完成 RT-Smart 编译验证，请勿在 CI 通过前合并。

原因：components/lwp/lwp.h:92 要求 RT_USING_MUSLLIBC，即必须用 arm-linux-musleabi 工具链；本机只有 arm-none-eabi，编到 board.o 就报：

lwp.h:99:2: error: #error "No compatible lwp set status provided for this libc"

尝试下载 musl 工具链但网络不可达（GitHub API 请求超时）。

已完成的验证：把守卫算术用 32 位 size_t 语义做了隔离测试（宿主 gcc），结果：

32-bit SIZE_MAX / sizeof(struct pollfd) = 536870911 (0x1FFFFFFF)
nfds 0x1FFFFFFF  -> 接受
nfds 0x20000000  -> 拒绝
nfds 0x20000001  -> 无守卫时乘积绕成 8，有守卫返回 -EINVAL
epoll cnt = -1、0x15555556 -> 拒绝；0、小值 -> 接受

这只证明了守卫逻辑与边界正确，不等于集成编译通过。合并前需要在 RT-Smart 配置上跑一次 CI（bsp/qemu-vexpress-a9 + .github/utest/configs/rtsmart/rtsmart.cfg）。

]

当前拉取/合并请求的状态 Intent for your PR

必须选择一项 Choose one (Mandatory):

  • 本拉取/合并请求是一个草稿版本 This PR is for a code-review and is intended to get feedback
  • 本拉取/合并请求是一个成熟版本 This PR is mature, and ready to be integrated into the repo

代码质量 Code Quality：

我在这个拉取/合并请求中已经考虑了 As part of this pull request, I've considered the following:

  • 已经仔细查看过代码改动的对比 Already check the difference between PR and old code
  • 代码风格正确，包括缩进空格，命名及其他风格 Style guide is adhered to, including spacing, naming and other styles
  • 没有垃圾代码，代码尽量精简，不包含#if 0代码，不包含已经被注释了的代码 All redundant code is removed and cleaned up
  • 所有变更均有原因及合理的，并且不会影响到其他软件组件代码或BSP All modifications are justified and not affect other components or BSP
  • 对难懂代码均提供对应的注释 I've commented appropriately where code is tricky
  • 代码是高质量的 Code in this PR is of high quality
  • 已经使用clang-format 源码格式化工具确保格式符合RT-Thread代码规范 This PR has been formatted with clang-format and complies with RT-Thread code specification
  • 如果是新增bsp, 已经添加ci检查到.github/ALL_BSP_COMPILE.json 详细请参考链接BSP自查

@Yunlk
[lwp] fix: reject user-supplied counts whose byte size wraps
0f115c9 
sys_poll() and sys_epoll_pwait() size a kernel buffer from a count that comes
straight from the user process:

    if (!lwp_user_accessable((void *)fds, nfds * sizeof *fds))     /* wraps */
    kfds = (struct pollfd *)kmem_get(nfds * sizeof *kfds);         /* wraps */
    ret = poll(kfds, nfds, timeout);                                /* full nfds */

On a 32-bit build nfds = 0x20000001 and sizeof(struct pollfd) = 8 make the
product 0x1_00000008, which wraps to 8. The access check and the allocation then
agree on an 8-byte block, but poll() walks all 536,870,913 entries: do_pollfd()
reads pollfd->fd and writes revents far outside that block. 64-bit builds are not
affected because the product is promoted to 64 bits and the oversized allocation
just fails.

sys_epoll_pwait() has the same shape, and its cnt is a signed int, so a negative
value has to be rejected as well.

Reject the counts that cannot be represented before anything is sized from them,
using the same SIZE_MAX / sizeof(...) form already used for msg_iovlen in
sys_sendmsg/sys_recvmsg.

The guard arithmetic was checked in isolation with 32-bit size_t semantics:

    32-bit SIZE_MAX / sizeof(struct pollfd)  = 536870911 (0x1FFFFFFF)
    nfds 0x1FFFFFFF -> accepted
    nfds 0x20000000 -> rejected
    nfds 0x20000001 -> wraps to 8 without the guard, rejected with it
    epoll cnt -1, 0x15555556 -> rejected, 0 and small values -> accepted

Note: the RT-Smart build itself was NOT compiled locally. lwp.h requires
RT_USING_MUSLLIBC, so an arm-linux-musleabi toolchain is needed and it was not
available here (the toolchain download could not be reached). A CI run on the
RT-Smart configuration is required before merging.

Refs RT-Thread#11925
@Yunlk
Yunlk requested a review from BernardXiong as a code owner October 30, 2026 03:59
@Yunlk Yunlk mentioned this pull request Oct 30, 2026
Open
@github-actions

github-actions Bot commented Oct 30, 2026

Copy link
Copy Markdown

📌 Code Review Assignment

🏷️ Tag: components

Reviewers: @Maihuanyi

Changed Files (Click to expand)
  • components/lwp/lwp_syscall.c

🏷️ Tag: components_lwp

Reviewers: @xu18838022837

Changed Files (Click to expand)
  • components/lwp/lwp_syscall.c

📊 Current Review Status (Last Updated: 2026-10-30 12:10 CST)

📝 Review Instructions

  1. 维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
    Maintainers can refresh the review status by clicking here: 🔄 Refresh Status

  2. 确认审核通过后评论 LGTM/lgtm
    Comment LGTM/lgtm after confirming approval

  3. PR合并前需至少一位维护者确认
    PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

@github-actions

github-actions Bot commented Oct 30, 2026

Copy link
Copy Markdown

👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).

🛠 操作步骤 | Steps

  1. 前往 Actions 页面 | Go to the Actions page
    点击进入工作流 → | Click to open workflow →

  2. 点击 Run workflow | Click Run workflow

  • Use workflow from 保持默认分支（通常为 master）
    Keep the default branch (usually master) in Use workflow from
  • 在 branch 输入框填写 PR 分支 fix/lwp-count-overflow
    Enter PR branch fix/lwp-count-overflow in the branch field
  • 设置需排除的文件/目录（目录请以"/"结尾）
    Set files/directories to exclude (directories should end with "/")
  1. 等待工作流完成 | Wait for the workflow to complete
    格式化后的代码将作为独立提交推送至你的分支。
    The formatting changes will be pushed to your branch as a separate commit.

完成后，提交将自动更新至 fix/lwp-count-overflow 分支，关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the fix/lwp-count-overflow branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们，再次感谢您的贡献！💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

@github-actions github-actions Bot added RT-Smart RT-Thread Smart related PR or issues component: lwp Component labels Oct 30, 2026
@BernardXiong

BernardXiong commented Nov 2, 2026

Copy link
Copy Markdown
Member

请基于拆分后的syscall进行提交PR，谢谢

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@BernardXiong BernardXiong Awaiting requested review from BernardXiong BernardXiong is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

component: lwp Component RT-Smart RT-Thread Smart related PR or issues

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Yunlk @BernardXiong