From e94b759160693f8735becb1b0297a9a7a6b90012 Mon Sep 17 00:00:00 2001 From: Shell Date: Wed, 25 Oct 2023 14:45:54 +0800 Subject: [PATCH] [quality] fixup: vulnerability in kernel including out-of-bound access in dfs, and use-after-free in aspace_traversal Signed-off-by: Shell --- components/dfs/dfs_v1/src/dfs.c | 2 +- components/dfs/dfs_v2/src/dfs.c | 2 +- components/mm/mm_aspace.c | 10 ++++++---- 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/components/dfs/dfs_v1/src/dfs.c b/components/dfs/dfs_v1/src/dfs.c index 51040ca0b5..94bd8385cd 100644 --- a/components/dfs/dfs_v1/src/dfs.c +++ b/components/dfs/dfs_v1/src/dfs.c @@ -759,7 +759,7 @@ up_one: /* remove '/' in the end of path if exist */ dst--; - if ((dst != fullpath) && (*dst == '/')) + if (dst >= fullpath && (dst != fullpath) && (*dst == '/')) *dst = '\0'; /* final check fullpath is not empty, for the special path of lwext "/.." */ diff --git a/components/dfs/dfs_v2/src/dfs.c b/components/dfs/dfs_v2/src/dfs.c index bcea75e219..62e5805d7a 100644 --- a/components/dfs/dfs_v2/src/dfs.c +++ b/components/dfs/dfs_v2/src/dfs.c @@ -668,7 +668,7 @@ char *dfs_normalize_path(const char *directory, const char *filename) /* remove '/' in the end of path if exist */ dst--; - if ((dst != fullpath) && (*dst == '/')) + if (dst >= fullpath && (dst != fullpath) && (*dst == '/')) *dst = '\0'; /* final check fullpath is not empty, for the special path of lwext "/.." */ diff --git a/components/mm/mm_aspace.c b/components/mm/mm_aspace.c index 76a50a67b1..df30b5460c 100644 --- a/components/mm/mm_aspace.c +++ b/components/mm/mm_aspace.c @@ -345,10 +345,10 @@ rt_inline rt_err_t _migrate_and_release_varea(rt_aspace_t aspace, rt_varea_t to, { /* uninstall operand & release the varea */ _aspace_bst_remove(aspace, from); - if (!(from->flag & MMF_STATIC_ALLOC)) - rt_free(from); - to->size += from->size; + + if (VAREA_NOT_STATIC(from)) + rt_free(from); } return error; } @@ -1377,12 +1377,14 @@ int rt_aspace_traversal(rt_aspace_t aspace, int (*fn)(rt_varea_t varea, void *arg), void *arg) { rt_varea_t varea; + rt_varea_t next; WR_LOCK(aspace); varea = ASPACE_VAREA_FIRST(aspace); while (varea) { + next = ASPACE_VAREA_NEXT(varea); fn(varea, arg); - varea = ASPACE_VAREA_NEXT(varea); + varea = next; } WR_UNLOCK(aspace);