Skip to content

[components][lwp] Validate signal number in sys_sigaction - #11899

Open
BernardXiong wants to merge 1 commit into
RT-Thread:masterfrom
BernardXiong:fix/lwp-sigaction-signo
Open

[components][lwp] Validate signal number in sys_sigaction#11899
BernardXiong wants to merge 1 commit into
RT-Thread:masterfrom
BernardXiong:fix/lwp-sigaction-signo

Conversation

@BernardXiong

@BernardXiong BernardXiong commented Oct 19, 2026

Copy link
Copy Markdown
Member

拉取/合并请求描述：(PR description)

为什么提交这份PR (why to submit this PR)

修复 #11882。

sys_sigaction() 将用户态传入的 sig 直接传给 lwp_signal_action()，两处均未做范围检查。lwp_signal_action() 使用 signo - 1 索引 struct rt_lwp 中固定大小的 sig_action[] / sig_action_mask[] 数组（_LWP_NSIG = 64），因此越界或负的信号编号会导致内核堆越界读写，普通用户态程序可通过一次系统调用触发：

  • 以用户可控的 handler 值进行任意偏移的 8 字节写；
  • 通过 oact 回拷路径泄露内核堆内容；
  • 远偏移时命中未映射地址导致内核崩溃。

你的解决方案是什么 (what is your solution)

  • 在 sys_sigaction() 入口校验信号编号，仅接受 [1, _LWP_NSIG]，否则设置 EINVAL 并返回；
  • 在 lwp_signal_action() 中增加相同的前置校验，保护后续新增的调用者。

valid_signo_check() 已存在于 lwp_signal.c，但它允许 sig == 0（符合 kill(pid, 0) 的语义），因此 sigaction 路径需要额外排除 0。

请提供验证的bsp和config (provide the config and bsp)

  • BSP: bsp/qemu-virt64-aarch64, bsp/qemu-virt64-riscv

  • .config: CONFIG_RT_USING_SMART=y CONFIG_RT_USING_LWP=y

  • action: 本地完成两平台编译与启动验证；RT-Smart 用户态 PoC 结果如下：

sig=10 act=1 oact=0 -> ret=0
sig=64 act=0 oact=1 -> ret=0
sig=0 act=1 oact=1 -> ret=-EINVAL
sig=-1 act=1 oact=1 -> ret=-EINVAL
sig=65 act=1 oact=0 -> ret=-EINVAL
sig=200 act=1 oact=1 -> ret=-EINVAL
sig=200 act=0 oact=1 -> ret=-EINVAL
sig=0x1000000 act=0 oact=1 -> ret=-EINVAL

修复前上述非法信号不会被拒绝（系统调用返回 0，并执行越界访问）。修复后 qemu-virt64-aarch64 与 qemu-virt64-riscv 均通过。

当前拉取/合并请求的状态 Intent for your PR

必须选择一项 Choose one (Mandatory):

  • 本拉取/合并请求是一个草稿版本 This PR is for a code-review and is intended to get feedback
  • 本拉取/合并请求是一个成熟版本 This PR is mature, and ready to be integrated into the repo

代码质量 Code Quality：

我在这个拉取/合并请求中已经考虑了 As part of this pull request, I've considered the following:

  • 已经仔细查看过代码改动的对比 Already check the difference between PR and old code
  • 代码风格正确，包括缩进空格，命名及其他风格 Style guide is adhered to, including spacing, naming and other styles
  • 没有垃圾代码，代码尽量精简，不包含#if 0代码，不包含已经被注释了的代码 All redundant code is removed and cleaned up
  • 所有变更均有原因及合理的，并且不会影响到其他软件组件代码或BSP All modifications are justified and not affect other components or BSP
  • 对难懂代码均提供对应的注释 I've commented appropriately where code is tricky
  • 代码是高质量的 Code in this PR is of high quality
  • 已经使用clang-format 源码格式化工具确保格式符合RT-Thread代码规范 This PR has been formatted with clang-format and complies with RT-Thread code specification
  • 如果是新增bsp, 已经添加ci检查到.github/ALL_BSP_COMPILE.json 详细请参考链接BSP自查

@github-actions

github-actions Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

📌 Code Review Assignment

🏷️ Tag: components

Reviewers: @Maihuanyi

Changed Files (Click to expand)
  • components/lwp/lwp_signal.c
  • components/lwp/syscall/syscall_signal.c

🏷️ Tag: components_lwp

Reviewers: @xu18838022837

Changed Files (Click to expand)
  • components/lwp/lwp_signal.c
  • components/lwp/syscall/syscall_signal.c

📊 Current Review Status (Last Updated: 2026-11-01 02:21 CST)

📝 Review Instructions

  1. 维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
    Maintainers can refresh the review status by clicking here: 🔄 Refresh Status

  2. 确认审核通过后评论 LGTM/lgtm
    Comment LGTM/lgtm after confirming approval

  3. PR合并前需至少一位维护者确认
    PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

@github-actions github-actions Bot added RT-Smart RT-Thread Smart related PR or issues component: lwp Component labels Oct 19, 2026
@github-actions

github-actions Bot commented Oct 19, 2026

Copy link
Copy Markdown

👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).

🛠 操作步骤 | Steps

  1. 前往 Actions 页面 | Go to the Actions page
    点击进入工作流 → | Click to open workflow →

  2. 点击 Run workflow | Click Run workflow

  • Use workflow from 保持默认分支（通常为 master）
    Keep the default branch (usually master) in Use workflow from
  • 在 branch 输入框填写 PR 分支 fix/lwp-sigaction-signo
    Enter PR branch fix/lwp-sigaction-signo in the branch field
  • 设置需排除的文件/目录（目录请以"/"结尾）
    Set files/directories to exclude (directories should end with "/")
  1. 等待工作流完成 | Wait for the workflow to complete
    格式化后的代码将作为独立提交推送至你的分支。
    The formatting changes will be pushed to your branch as a separate commit.

完成后，提交将自动更新至 fix/lwp-sigaction-signo 分支，关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the fix/lwp-sigaction-signo branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们，再次感谢您的贡献！💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

@github-actions

github-actions Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

MemBrowse Memory Report · Explore what changed →

k230

  • SRAM: .eh_frame +8 B (+0.0%, 1,209,180 B / 268,300,288 B, total: 0% used)

No memory changes detected for:

Catch memory regressions in CI with MemBrowse. Free for open source.

@cms19859230182-lang cms19859230182-lang mentioned this pull request Oct 24, 2026
Merged
1 of 10 tasks
rcitach
rcitach reviewed Oct 28, 2026
View reviewed changes

@rcitach rcitach left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@BernardXiong @claude
[components][lwp] validate signal number in sys_sigaction
427d0d1 
sys_sigaction() passed the user-controlled sig directly to
lwp_signal_action(), which indexes the fixed-size sig_action[] and
sig_action_mask[] arrays with signo - 1. Accept only [1, _LWP_NSIG] so a
user program cannot trigger out-of-bounds kernel heap access through
sigaction().

valid_signo_check() allows 0 for the kill(pid, 0) probe, so both sigaction
paths reject 0 explicitly as well.

Co-Authored-By: Claude Code <noreply@anthropic.com>
@BernardXiong
BernardXiong force-pushed the fix/lwp-sigaction-signo branch from e782227 to 427d0d1 Compare October 31, 2026 16:04
@BernardXiong

BernardXiong commented Oct 31, 2026

Copy link
Copy Markdown
Member Author

已 rebase 到最新 master 并解决冲突。master 上 lwp_syscall.c 已拆分为 components/lwp/syscall/*，因此 sys_sigaction() 的信号编号校验重新应用到了 components/lwp/syscall/syscall_signal.c；lwp_signal_action() 的校验保留在 lwp_signal.c。CI 已重新触发，请复核。

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@rcitach rcitach rcitach left review comments
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

component: lwp Component RT-Smart RT-Thread Smart related PR or issues

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@BernardXiong @rcitach