Skip to content

[components][lwp] harden sys_getaddrinfo user pointer handling - #11977

Merged
Rbb666 merged 1 commit into
RT-Thread:masterfrom
BernardXiong:fix/sys-getaddrinfo-user-ptr
Nov 3, 2026
Merged

[components][lwp] harden sys_getaddrinfo user pointer handling#11977
Rbb666 merged 1 commit into
RT-Thread:masterfrom
BernardXiong:fix/sys-getaddrinfo-user-ptr

Conversation

@BernardXiong

@BernardXiong BernardXiong commented Nov 2, 2026

Copy link
Copy Markdown
Member

拉取/合并请求描述：(PR description)

为什么提交这份PR (why to submit this PR)

这是对 #11454 的重做（原 PR 已冲突且过时）。

sys_getaddrinfo() 只校验了用户传入的顶层 res 缓冲区，随后通过 res->ai_addr 这个用户可控的嵌套指针写入解析出的 socket 地址。在 Smart/MMU 构建下，用户程序可以借此把一次 getaddrinfo() 调用变成任意内核写。另外 hints 的字段在顶层校验后仍直接从用户内存读取，存在 TOCTOU 窗口。

你的解决方案是什么 (what is your solution)

基于最新 master 重新实现（sys_getaddrinfo() 已随 syscall 拆分迁移到 components/lwp/syscall/syscall_netdb.c）：

  • 用 lwp_get_from_user() 将 res、hints 一次性拷贝到内核临时结构体，后续所有嵌套指针都来自这份已校验的快照，消除 TOCTOU；
  • 嵌套 sockaddr 通过 lwp_put_to_user() 写回，目标地址范围由现有 helper 校验，内核不再解引用未检查的用户指针；
  • 外层 musl_addrinfo 同样通过 lwp_put_to_user() 写回；
  • 顺带修正 servname 拷贝的返回值判断（size_t 与 0 比较恒为假）、按 sizeof(*k_hints) 分配内核 addrinfo，并在新增的错误路径上释放 k_res。

改动只涉及一个文件，复用现有的 lwp_get_from_user() / lwp_put_to_user() / sockaddr_tomusl()，未引入新的 helper。

请提供验证的bsp和config (provide the config and bsp)

  • BSP: bsp/k230（RT-Smart）

  • .config: CONFIG_RT_USING_SMART=y, CONFIG_ARCH_MM_MMU=y, CONFIG_RT_USING_SAL=y, CONFIG_SAL_USING_POSIX=y

  • action: 已使用 K230 SDK riscv64-unknown-linux-musl 工具链本地编译通过（syscall_netdb.o，包含 ARCH_MM_MMU 路径）；完整构建由 CI 验证。

当前拉取/合并请求的状态 Intent for your PR

必须选择一项 Choose one (Mandatory):

  • 本拉取/合并请求是一个草稿版本 This PR is for a code-review and is intended to get feedback
  • 本拉取/合并请求是一个成熟版本 This PR is mature, and ready to be integrated into the repo

代码质量 Code Quality：

我在这个拉取/合并请求中已经考虑了 As part of this pull request, I've considered the following:

  • 已经仔细查看过代码改动的对比 Already check the difference between PR and old code
  • 代码风格正确，包括缩进空格，命名及其他风格 Style guide is adhered to, including spacing, naming and other styles
  • 没有垃圾代码，代码尽量精简，不包含#if 0代码，不包含已经被注释了的代码 All redundant code is removed and cleaned up
  • 所有变更均有原因及合理的，并且不会影响到其他软件组件代码或BSP All modifications are justified and not affect other components or BSP
  • 对难懂代码均提供对应的注释 I've commented appropriately where code is tricky
  • 代码是高质量的 Code in this PR is of high quality
  • 已经使用clang-format 源码格式化工具确保格式符合RT-Thread代码规范 This PR has been formatted with clang-format and complies with RT-Thread code specification
  • 如果是新增bsp, 已经添加ci检查到.github/ALL_BSP_COMPILE.json 详细请参考链接BSP自查

🤖 Generated with Claude Code

@BernardXiong BernardXiong mentioned this pull request Nov 2, 2026
Closed
@github-actions

github-actions Bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown

📌 Code Review Assignment

🏷️ Tag: components

Reviewers: @Maihuanyi

Changed Files (Click to expand)
  • components/lwp/syscall/syscall_netdb.c

🏷️ Tag: components_lwp

Reviewers: @xu18838022837

Changed Files (Click to expand)
  • components/lwp/syscall/syscall_netdb.c

📊 Current Review Status (Last Updated: 2026-11-03 00:58 CST)

📝 Review Instructions

  1. 维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
    Maintainers can refresh the review status by clicking here: 🔄 Refresh Status

  2. 确认审核通过后评论 LGTM/lgtm
    Comment LGTM/lgtm after confirming approval

  3. PR合并前需至少一位维护者确认
    PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown

👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).

🛠 操作步骤 | Steps

  1. 前往 Actions 页面 | Go to the Actions page
    点击进入工作流 → | Click to open workflow →

  2. 点击 Run workflow | Click Run workflow

  • Use workflow from 保持默认分支（通常为 master）
    Keep the default branch (usually master) in Use workflow from
  • 在 branch 输入框填写 PR 分支 fix/sys-getaddrinfo-user-ptr
    Enter PR branch fix/sys-getaddrinfo-user-ptr in the branch field
  • 设置需排除的文件/目录（目录请以"/"结尾）
    Set files/directories to exclude (directories should end with "/")
  1. 等待工作流完成 | Wait for the workflow to complete
    格式化后的代码将作为独立提交推送至你的分支。
    The formatting changes will be pushed to your branch as a separate commit.

完成后，提交将自动更新至 fix/sys-getaddrinfo-user-ptr 分支，关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the fix/sys-getaddrinfo-user-ptr branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们，再次感谢您的贡献！💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

@github-actions github-actions Bot added RT-Smart RT-Thread Smart related PR or issues component: lwp Component labels Nov 2, 2026
@github-actions

github-actions Bot commented Nov 2, 2026 •
edited
Loading

Copy link
Copy Markdown

MemBrowse Memory Report · Explore what changed →

No memory changes detected for:

Catch memory regressions in CI with MemBrowse. Free for open source.

@BernardXiong @claude
[components][lwp] harden sys_getaddrinfo user pointer handling
b732f6c 
sys_getaddrinfo() validated the top-level res buffer, then wrote the
resolved socket address through res->ai_addr, a user-controlled nested
pointer that was never checked. On Smart/MMU builds a user program could
therefore turn getaddrinfo() into an arbitrary kernel write. The hints
fields were also read directly from user memory after the access check,
leaving a TOCTOU window.

Copy res and hints into kernel temporaries with lwp_get_from_user() so
all nested pointers come from one validated snapshot. Write the nested
sockaddr and the outer addrinfo back with lwp_put_to_user(), which
validates the destination range and never dereferences an unchecked user
pointer in kernel context.

Also fix the servname copy check (a size_t result can never be < 0),
allocate the kernel addrinfo with sizeof(*k_hints), and release k_res on
the new error paths.

Co-Authored-By: Claude Code <noreply@anthropic.com>
@BernardXiong
BernardXiong force-pushed the fix/sys-getaddrinfo-user-ptr branch from bf71c44 to b732f6c Compare November 2, 2026 16:57
@Rbb666
Rbb666 merged commit 9e29e32 into RT-Thread:master Nov 3, 2026
110 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Rbb666 Rbb666 Rbb666 approved these changes

Assignees

No one assigned

Labels

component: lwp Component RT-Smart RT-Thread Smart related PR or issues

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@BernardXiong @Rbb666