Skip to content

allocator.calloc 未对required_size做溢出校验,会导致崩溃 #313

@cyberhorse208

Description

@cyberhorse208

问题:

pub fn calloc(count: usize, size: usize) -> *mut u8 {
// 对required_size 未做校验,异常时后面layout代码会崩溃
    let required_size = count * size;
    const ALIGN: usize = core::mem::size_of::<usize>();
    let layout = Layout::from_size_align(required_size, ALIGN).unwrap();
    if let Some(alloc_ptr) = HEAP.alloc(layout) {
        unsafe { ptr::write_bytes(alloc_ptr.as_ptr(), 0, required_size) };
        alloc_ptr.as_ptr()
    } else {
        ptr::null_mut()
    }
}

虽然calloc未暴露给应用层,但是其风险存在,可通过增加相关系统调用calloc暴露给应用层进行演示:

> calloc 1024 8
Allocating zero-initialized memory for 1024 elements of 8 bytes each...
Total size: 8192 bytes
Allocation successful!
  Address: 0x2102e428
  Count: 1024
  Size per element: 8
  Total bytes: 8192
  [VERIFIED] First 64 bytes are zero-initialized
> calloc 1024 800000000
Allocating zero-initialized memory for 1024 elements of 800000000 bytes each...
Total size: 3156213760 bytes
thread 'shell' panicked at ../../kernel/kernel/src/allocator/mod.rs:135:64:
called `Result::unwrap()` on an `Err` value: LayoutError
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
thread 'shell' panicked at ../../kernel/kernel/src/arch/arm/hardfault.rs:220:5:

        ==== HARD FAULT ====
        FRAME: IsrContext {r0: 0x2102b9c0 r1: 0x95e1c r2: 0x3 r3: 0x2 r12: 0x21017200 lr: 0x6bf0d pc: 0x465ac xpsr: 0x21000000 }
        FAULT REGS: 
HFSR: 0x40000000
  - Forced Hard Fault
CFSR: 0x00010000
Fault Status:
  Usage Fault:
    - Undefined instruction
AFSR: 0x00000000

        XPSR: XPSR: 0x20000003
  Exception Number: 3
  - Invalid state
  - Branch target identification active
  IT/ICI/ECI flag: false
  IT/ICI/ECI value: 0
  Condition flags:
    N=0 Z=0 C=1 V=0 Q=0

        
stack backtrace:
panicked at ../../librs/src/lib.rs:98:5:
not yet implemented
thread panicked while processing panic. aborting.
qemu: fatal: Lockup: can't escalate 3 to HardFault (current priority -1)

R00=00000004 R01=00000011 R02=00000002 R03=00000001
R04=21fffc68 R05=00095e00 R06=00000001 R07=21fffbe8
R08=00000001 R09=21fffe1c R10=21fffdfc R11=21fffd70
R12=21017200 R13=21fffbe8 R14=00066e0d R15=000465ac
XPSR=21000003 --C- T handler
FPSCR: 00000000
已中止 (核心已转储)

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingenhancementNew feature or requestpriority: mediumMedium priority issue

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions