From 427d0d1e68b6cba68b1432c7d1d5aff1f5c12124 Mon Sep 17 00:00:00 2001 From: bernard Date: Sun, 1 Nov 2026 00:03:59 +0800 Subject: [PATCH] [components][lwp] validate signal number in sys_sigaction sys_sigaction() passed the user-controlled sig directly to lwp_signal_action(), which indexes the fixed-size sig_action[] and sig_action_mask[] arrays with signo - 1. Accept only [1, _LWP_NSIG] so a user program cannot trigger out-of-bounds kernel heap access through sigaction(). valid_signo_check() allows 0 for the kill(pid, 0) probe, so both sigaction paths reject 0 explicitly as well. Co-Authored-By: Claude Code --- components/lwp/lwp_signal.c | 10 ++++++++++ components/lwp/syscall/syscall_signal.c | 6 ++++++ 2 files changed, 16 insertions(+) diff --git a/components/lwp/lwp_signal.c b/components/lwp/lwp_signal.c index 8c88e68151ee..99c55c84b7df 100644 --- a/components/lwp/lwp_signal.c +++ b/components/lwp/lwp_signal.c @@ -1114,6 +1114,16 @@ rt_err_t lwp_signal_action(struct rt_lwp *lwp, int signo, rt_list_t *thread_list; rt_err_t ret = RT_EOK; + /* + * Signal numbers are 1-based. valid_signo_check() accepts 0 for the + * kill(pid, 0) probe, so reject it here as well before using signo - 1 + * to index sig_action[]. + */ + if (signo <= 0 || valid_signo_check(signo)) + { + return -RT_EINVAL; + } + if (lwp) { /** acquire READ access to lwp */ diff --git a/components/lwp/syscall/syscall_signal.c b/components/lwp/syscall/syscall_signal.c index e0fb7459c149..cf2686b7ce74 100644 --- a/components/lwp/syscall/syscall_signal.c +++ b/components/lwp/syscall/syscall_signal.c @@ -50,6 +50,12 @@ sysret_t sys_sigaction(int sig, const struct k_sigaction *act, struct lwp_sigaction kact, *pkact = RT_NULL; struct lwp_sigaction koact, *pkoact = RT_NULL; + /* Reject out-of-range signal numbers before indexing the action arrays. */ + if (sig <= 0 || (unsigned long)sig > _LWP_NSIG) + { + SET_ERRNO(EINVAL); + goto out; + } if (!sigsetsize) { SET_ERRNO(EINVAL);