Skip to content

[components][lwp] Validate signal number in sys_sigaction - #11899

Open
BernardXiong wants to merge 1 commit into
RT-Thread:masterfrom
BernardXiong:fix/lwp-sigaction-signo
Open

[components][lwp] Validate signal number in sys_sigaction#11899
BernardXiong wants to merge 1 commit into
RT-Thread:masterfrom
BernardXiong:fix/lwp-sigaction-signo

Conversation

@BernardXiong

@BernardXiong BernardXiong commented Oct 19, 2026

Copy link
Copy Markdown
Member

拉取/合并请求描述：(PR description)

为什么提交这份PR (why to submit this PR)

修复 #11882。

sys_sigaction() 将用户态传入的 sig 直接传给 lwp_signal_action()，两处均未做范围检查。lwp_signal_action() 使用 signo - 1 索引 struct rt_lwp 中固定大小的 sig_action[] / sig_action_mask[] 数组（_LWP_NSIG = 64），因此越界或负的信号编号会导致内核堆越界读写，普通用户态程序可通过一次系统调用触发：

  • 以用户可控的 handler 值进行任意偏移的 8 字节写；
  • 通过 oact 回拷路径泄露内核堆内容；
  • 远偏移时命中未映射地址导致内核崩溃。

你的解决方案是什么 (what is your solution)

  • 在 sys_sigaction() 入口校验信号编号，仅接受 [1, _LWP_NSIG]，否则设置 EINVAL 并返回；
  • 在 lwp_signal_action() 中增加相同的前置校验，保护后续新增的调用者。

valid_signo_check() 已存在于 lwp_signal.c，但它允许 sig == 0（符合 kill(pid, 0) 的语义），因此 sigaction 路径需要额外排除 0。

请提供验证的bsp和config (provide the config and bsp)

  • BSP: bsp/qemu-virt64-aarch64, bsp/qemu-virt64-riscv

  • .config: CONFIG_RT_USING_SMART=y CONFIG_RT_USING_LWP=y

  • action: 本地完成两平台编译与启动验证；RT-Smart 用户态 PoC 结果如下：

sig=10 act=1 oact=0 -> ret=0
sig=64 act=0 oact=1 -> ret=0
sig=0 act=1 oact=1 -> ret=-EINVAL
sig=-1 act=1 oact=1 -> ret=-EINVAL
sig=65 act=1 oact=0 -> ret=-EINVAL
sig=200 act=1 oact=1 -> ret=-EINVAL
sig=200 act=0 oact=1 -> ret=-EINVAL
sig=0x1000000 act=0 oact=1 -> ret=-EINVAL

修复前上述非法信号不会被拒绝（系统调用返回 0，并执行越界访问）。修复后 qemu-virt64-aarch64 与 qemu-virt64-riscv 均通过。

当前拉取/合并请求的状态 Intent for your PR

必须选择一项 Choose one (Mandatory):

  • 本拉取/合并请求是一个草稿版本 This PR is for a code-review and is intended to get feedback
  • 本拉取/合并请求是一个成熟版本 This PR is mature, and ready to be integrated into the repo

代码质量 Code Quality：

我在这个拉取/合并请求中已经考虑了 As part of this pull request, I've considered the following:

  • 已经仔细查看过代码改动的对比 Already check the difference between PR and old code
  • 代码风格正确，包括缩进空格，命名及其他风格 Style guide is adhered to, including spacing, naming and other styles
  • 没有垃圾代码，代码尽量精简，不包含#if 0代码，不包含已经被注释了的代码 All redundant code is removed and cleaned up
  • 所有变更均有原因及合理的，并且不会影响到其他软件组件代码或BSP All modifications are justified and not affect other components or BSP
  • 对难懂代码均提供对应的注释 I've commented appropriately where code is tricky
  • 代码是高质量的 Code in this PR is of high quality
  • 已经使用clang-format 源码格式化工具确保格式符合RT-Thread代码规范 This PR has been formatted with clang-format and complies with RT-Thread code specification
  • 如果是新增bsp, 已经添加ci检查到.github/ALL_BSP_COMPILE.json 详细请参考链接BSP自查

@BernardXiong DeepSeek 4.1 Flash
[components][lwp] Validate signal number in sys_sigaction
e782227 
sys_sigaction() forwarded the user-supplied signal number to
lwp_signal_action() without any range check. lwp_signal_action()
indexes the fixed-size sig_action[] and sig_action_mask[] arrays
(_LWP_NSIG = 64) with signo - 1, so an out-of-range or negative
signal caused out-of-bounds accesses in the kernel heap:

- arbitrary-offset 8-byte write with a user-controlled handler value
- kernel heap disclosure through the oact copy-out path
- kernel crash when a far offset hits an unmapped address

Reject signals outside [1, _LWP_NSIG] with EINVAL at the syscall
entry, and add the same guard to lwp_signal_action() so future
callers cannot reach the indexing code with an invalid signal.

Verified on qemu-virt64-aarch64 and qemu-virt64-riscv (RT-Smart)
with a user-space PoC: in-range signals still succeed, while 0, -1,
65, 200 and 0x1000000 now return -EINVAL without touching the arrays.

Co-authored-by: DeepSeek 4.1 Flash <noreply@deepseek.com>
@github-actions

github-actions Bot commented Oct 19, 2026

Copy link
Copy Markdown

📌 Code Review Assignment

🏷️ Tag: components

Reviewers: @Maihuanyi

Changed Files (Click to expand)
  • components/lwp/lwp_signal.c
  • components/lwp/lwp_syscall.c

🏷️ Tag: components_lwp

Reviewers: @xu18838022837

Changed Files (Click to expand)
  • components/lwp/lwp_signal.c
  • components/lwp/lwp_syscall.c

📊 Current Review Status (Last Updated: 2026-10-19 08:49 CST)

📝 Review Instructions

  1. 维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
    Maintainers can refresh the review status by clicking here: 🔄 Refresh Status

  2. 确认审核通过后评论 LGTM/lgtm
    Comment LGTM/lgtm after confirming approval

  3. PR合并前需至少一位维护者确认
    PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

@github-actions github-actions Bot added RT-Smart RT-Thread Smart related PR or issues component: lwp Component labels Oct 19, 2026
@github-actions

github-actions Bot commented Oct 19, 2026

Copy link
Copy Markdown

👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).

🛠 操作步骤 | Steps

  1. 前往 Actions 页面 | Go to the Actions page
    点击进入工作流 → | Click to open workflow →

  2. 点击 Run workflow | Click Run workflow

  • Use workflow from 保持默认分支（通常为 master）
    Keep the default branch (usually master) in Use workflow from
  • 在 branch 输入框填写 PR 分支 fix/lwp-sigaction-signo
    Enter PR branch fix/lwp-sigaction-signo in the branch field
  • 设置需排除的文件/目录（目录请以"/"结尾）
    Set files/directories to exclude (directories should end with "/")
  1. 等待工作流完成 | Wait for the workflow to complete
    格式化后的代码将作为独立提交推送至你的分支。
    The formatting changes will be pushed to your branch as a separate commit.

完成后，提交将自动更新至 fix/lwp-sigaction-signo 分支，关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the fix/lwp-sigaction-signo branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们，再次感谢您的贡献！💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

@github-actions

github-actions Bot commented Oct 19, 2026

Copy link
Copy Markdown

MemBrowse Memory Report · Explore what changed →

k230

  • SRAM: .eh_frame +8 B (+0.0%, 1,128,547 B / 268,300,288 B, total: 0% used)

No memory changes detected for:

Catch memory regressions in CI with MemBrowse. Free for open source.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

component: lwp Component RT-Smart RT-Thread Smart related PR or issues

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@BernardXiong