From 3510d5d2e44c48c8c527a0b0393c823c8f338baf Mon Sep 17 00:00:00 2001 From: Zhian Liang Date: Tue, 3 Nov 2026 15:25:33 +0800 Subject: [PATCH 1/3] [drivers][block] prevent arbitrary kernel write via BLK_PARTITION ioctl on RT-Smart Signed-off-by: Zhian Liang --- components/drivers/block/blk_dev.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/components/drivers/block/blk_dev.c b/components/drivers/block/blk_dev.c index 5c45aa5ecc3c..884a6ecddd0b 100644 --- a/components/drivers/block/blk_dev.c +++ b/components/drivers/block/blk_dev.c @@ -19,6 +19,10 @@ #include #endif +#ifdef RT_USING_LWP +#include +#endif + static rt_err_t blk_dev_open(rt_device_t dev, rt_uint16_t oflag) { struct rt_blk_device *blk = to_blk(dev); @@ -106,15 +110,25 @@ static rt_err_t blk_dev_control(rt_device_t dev, int cmd, void *args) break; case RT_DEVICE_CTRL_BLK_PARTITION: - if (args) + if (!args) { - rt_memcpy(args, &blk->partition, sizeof(blk->partition)); + err = -RT_EINVAL; + break; } - else +#ifdef RT_USING_LWP + if (lwp_self() != RT_NULL) { - err = -RT_EINVAL; + struct dfs_partition kpart; + rt_memcpy(&kpart, &blk->partition, sizeof(kpart)); + if (lwp_put_to_user(args, &kpart, sizeof(kpart)) != sizeof(kpart)) + err = -RT_EFAULT; + else + err = RT_EOK; + break; } - +#endif + rt_memcpy(args, &blk->partition, sizeof(blk->partition)); + err = RT_EOK; break; case RT_DEVICE_CTRL_BLK_SSIZEGET: From 2d002f4fb96993d2b3758df45ec4f1ee0b8d6e52 Mon Sep 17 00:00:00 2001 From: Zhian Liang Date: Thu, 5 Nov 2026 01:28:11 +0800 Subject: [PATCH 2/3] [drivers][block] complete security fix for all ioctl paths and refactor dfs internal calls Signed-off-by: Zhian Liang --- components/drivers/block/blk_dev.c | 111 +++++++++++++++++++++++------ components/drivers/block/blk_dfs.c | 18 ++++- 2 files changed, 104 insertions(+), 25 deletions(-) diff --git a/components/drivers/block/blk_dev.c b/components/drivers/block/blk_dev.c index 884a6ecddd0b..34913179391c 100644 --- a/components/drivers/block/blk_dev.c +++ b/components/drivers/block/blk_dev.c @@ -21,6 +21,27 @@ #ifdef RT_USING_LWP #include + +static rt_err_t blk_copy_to_user(void *dst, const void *src, size_t n) +{ + /* if (lwp_self() == RT_NULL) + { + rt_memcpy(dst, src, n); + return RT_EOK; + }*/ + + if (!lwp_user_accessable(dst, n)) + { + return -RT_EFAULT; + } + + if (lwp_put_to_user(dst,(void *)src, n) == 0) + { + return -RT_EFAULT; + } + + return RT_EOK; +} #endif static rt_err_t blk_dev_open(rt_device_t dev, rt_uint16_t oflag) @@ -72,25 +93,35 @@ static rt_err_t blk_dev_control(rt_device_t dev, int cmd, void *args) rt_err_t err = -RT_EINVAL; struct rt_blk_device *blk = to_blk(dev); struct rt_blk_disk *disk = blk->disk; - struct rt_device_blk_geometry disk_geometry, *geometry; + struct rt_device_blk_geometry disk_geometry; switch (cmd) { case RT_DEVICE_CTRL_BLK_GETGEOME: - if ((geometry = args)) + if(!args) { - if (!(err = disk->ops->getgeome(disk, &disk_geometry))) - { - geometry->bytes_per_sector = disk_geometry.bytes_per_sector; - geometry->block_size = disk_geometry.block_size; - geometry->sector_count = blk->sector_count; - } + err = -RT_EINVAL; + break; } - else + + if((err = disk->ops->getgeome(disk, &disk_geometry)) != RT_EOK) { - err = -RT_EINVAL; + break; } + { + struct rt_device_blk_geometry kgeo; + kgeo.bytes_per_sector = disk_geometry.bytes_per_sector; + kgeo.block_size = disk_geometry.block_size; + kgeo.sector_count = blk->sector_count; + +#ifdef RT_USING_LWP + err = blk_copy_to_user(args, &kgeo, sizeof(kgeo)); +#else + rt_memcpy(args, &kgeo, sizeof(kgeo)); + err = RT_EOK; +#endif + } break; case RT_DEVICE_CTRL_BLK_SYNC: @@ -116,29 +147,63 @@ static rt_err_t blk_dev_control(rt_device_t dev, int cmd, void *args) break; } #ifdef RT_USING_LWP - if (lwp_self() != RT_NULL) - { + { struct dfs_partition kpart; rt_memcpy(&kpart, &blk->partition, sizeof(kpart)); - if (lwp_put_to_user(args, &kpart, sizeof(kpart)) != sizeof(kpart)) - err = -RT_EFAULT; - else - err = RT_EOK; - break; - } -#endif + kpart.lock = RT_NULL; + err = blk_copy_to_user(args, &kpart, sizeof(kpart)); + } +#else rt_memcpy(args, &blk->partition, sizeof(blk->partition)); err = RT_EOK; +#endif break; case RT_DEVICE_CTRL_BLK_SSIZEGET: - device_get_blk_ssize(dev, args); - err = RT_EOK; + if(!args) + { + err = -RT_EINVAL; + break; + } + + if((err = disk->ops->getgeome(disk, &disk_geometry)) != RT_EOK) + { + break; + } + + { + rt_uint32_t ksize = disk_geometry.bytes_per_sector; +#ifdef RT_USING_LWP + err = blk_copy_to_user(args, &ksize, sizeof(ksize)); +#else + rt_memcpy(args, &ksize, sizeof(ksize)); + err = RT_EOK; +#endif + } break; case RT_DEVICE_CTRL_ALL_BLK_SSIZEGET: - device_get_all_blk_ssize(dev, args); - err = RT_EOK; + if(!args) + { + err = -RT_EINVAL; + break; + } + + if((err = disk->ops->getgeome(disk, &disk_geometry)) != RT_EOK) + { + break; + } + + { + rt_uint64_t ktotal = (rt_uint64_t)disk_geometry.bytes_per_sector + * disk_geometry.sector_count; +#ifdef RT_USING_LWP + err = blk_copy_to_user(args, &ktotal, sizeof(ktotal)); +#else + rt_memcpy(args, &ktotal, sizeof(ktotal)); + err = RT_EOK; +#endif + } break; default: diff --git a/components/drivers/block/blk_dfs.c b/components/drivers/block/blk_dfs.c index ce637b687c35..230b3886f01b 100644 --- a/components/drivers/block/blk_dfs.c +++ b/components/drivers/block/blk_dfs.c @@ -10,6 +10,7 @@ #include +#include "blk_dev.h" #include "blk_dfs.h" #include @@ -33,9 +34,22 @@ static int blk_fops_open(struct dfs_file *file) } dev->user_data = data; - rt_device_control(dev, RT_DEVICE_CTRL_BLK_GETGEOME, &data->geometry); - rt_device_control(dev, RT_DEVICE_CTRL_ALL_BLK_SSIZEGET, &file->vnode->size); + struct rt_blk_device *blk = to_blk(dev); + struct rt_blk_disk *disk = blk->disk; + struct rt_device_blk_geometry disk_geometry; + rt_err_t err = disk->ops->getgeome(disk, &disk_geometry); + if (err != RT_EOK) + { + rt_free(data); + return (int)err; + } + + data->geometry.bytes_per_sector = disk_geometry.bytes_per_sector; + data->geometry.block_size = disk_geometry.block_size; + data->geometry.sector_count = blk->sector_count; + + file->vnode->size = (off_t)disk_geometry.sector_count * disk_geometry.bytes_per_sector; return 0; } From 095e3d237009cd840d041e926a1a2ee1c3727ef4 Mon Sep 17 00:00:00 2001 From: liangzhan5 Date: Thu, 5 Nov 2026 02:02:38 +0800 Subject: [PATCH 3/3] Update blk_dev.c --- components/drivers/block/blk_dev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/components/drivers/block/blk_dev.c b/components/drivers/block/blk_dev.c index 34913179391c..2e70c633ae49 100644 --- a/components/drivers/block/blk_dev.c +++ b/components/drivers/block/blk_dev.c @@ -24,11 +24,11 @@ static rt_err_t blk_copy_to_user(void *dst, const void *src, size_t n) { - /* if (lwp_self() == RT_NULL) + if (lwp_self() == RT_NULL) { rt_memcpy(dst, src, n); return RT_EOK; - }*/ + } if (!lwp_user_accessable(dst, n)) {