Skip to content

[dfs][tmpfs] fix use-after-free when truncating a file to zero length - #11910

Open
remukisama wants to merge 3 commits into
RT-Thread:masterfrom
remukisama:fix/tmpfs-truncate-zero
Open

[dfs][tmpfs] fix use-after-free when truncating a file to zero length#11910
remukisama wants to merge 3 commits into
RT-Thread:masterfrom
remukisama:fix/tmpfs-truncate-zero

Conversation

@remukisama

@remukisama remukisama commented Oct 21, 2026 •
edited
Loading

Copy link
Copy Markdown

拉取/合并请求描述：(PR description)

[

Fixes #11902

为什么提交这份PR (why to submit this PR)

对非空 tmpfs 文件执行 ftruncate(fd, 0) 时，rt_realloc() 会释放原缓冲区并返回空指针。原代码在这里直接返回成功，没有清空数据指针和更新文件长度，后续读写会访问已释放的内存，删除文件时也可能触发内存断言。另外，非零大小分配失败时也错误地返回了成功。

你的解决方案是什么 (what is your solution)

在 dfs_tmpfs_truncate() 中单独处理 offset == 0：释放缓冲区、清空指针，再执行后面的长度更新。非零大小仍走原来的重分配流程，失败时改为返回 -ENOMEM。

在现有 tmpfs utest 目录增加截断用例，检查重复清空、截断后的读写与删除、非零缩放，以及内存不足时错误返回和原文件内容是否保留。

请提供验证的bsp和config (provide the config and bsp)

  • BSP: bsp/qemu-vexpress-a9（标准版、small_mem）；bsp/qemu-virt64-aarch64（标准版和 RT-Smart，memheap）。
  • .config: 开启 RT_USING_DFS_V2、RT_USING_DFS_TMPFS、RT_USING_POSIX_FS、RT_USING_UTESTCASES、RT_UTEST_TMPFS_TRUNCATE。RT-Smart 测试开启 RT_USING_SMART 和 RT_USING_PAGECACHE。
  • action: 编译及 QEMU 测试、仓库格式化工作流 均通过。

运行命令：utest_run components.dfs.tmpfs_truncate。

标准版和 RT-Smart 的回归用例均通过。RT-Smart 还用独立用户进程经系统调用完成写入、截断为 0、从头读取、重新写入、关闭和删除，结果正常。

同一用例在未修复版本上仍能读到旧数据，并触发内存分配器断言，已保存对照日志。

分配失败测试申请整个堆大小的缓冲区，确认 ftruncate() 返回 -1、errno 为 -ENOMEM，且原文件长度和内容保留。

验证分支中的四个修复及测试文件与本 PR 一致。主仓 CI 目前为 action_required，尚未执行，需维护者批准运行。

]

当前拉取/合并请求的状态 Intent for your PR

必须选择一项 Choose one (Mandatory):

  • 本拉取/合并请求是一个草稿版本 This PR is for a code-review and is intended to get feedback
  • 本拉取/合并请求是一个成熟版本 This PR is mature, and ready to be integrated into the repo

代码质量 Code Quality：

我在这个拉取/合并请求中已经考虑了 As part of this pull request, I've considered the following:

  • 已经仔细查看过代码改动的对比 Already check the difference between PR and old code
  • 代码风格正确，包括缩进空格，命名及其他风格 Style guide is adhered to, including spacing, naming and other styles
  • 没有垃圾代码，代码尽量精简，不包含#if 0代码，不包含已经被注释了的代码 All redundant code is removed and cleaned up
  • 所有变更均有原因及合理的，并且不会影响到其他软件组件代码或BSP All modifications are justified and not affect other components or BSP
  • 对难懂代码均提供对应的注释 I've commented appropriately where code is tricky
  • 代码是高质量的 Code in this PR is of high quality
  • 已经使用clang-format 源码格式化工具确保格式符合RT-Thread代码规范 This PR has been formatted with clang-format and complies with RT-Thread code specification
  • 如果是新增bsp, 已经添加ci检查到.github/ALL_BSP_COMPILE.json 详细请参考链接BSP自查

@remukisama
[dfs][tmpfs] fix use-after-free when truncating a file to zero length
4e7530e 
rt_realloc(ptr, 0) is implemented as free(ptr) + return RT_NULL on both heap
backends (src/mem.c:429, src/memheap.c:830), so the NULL return cannot be
told apart from an allocation failure. dfs_tmpfs_truncate() treated it as
-ENOMEM and returned 0 without updating d_file->data or the file size, which
left a dangling buffer behind a successful ftruncate(fd, 0).

Handle offset == 0 explicitly before calling rt_realloc(): free the buffer,
clear the pointer, and fall through so that d_file->size and
file->vnode->size are reset to 0. Return -ENOMEM when the allocation really
fails, so the error reaches ftruncate() through dfs_file_ftruncate().

Verified on bsp/qemu-vexpress-a9 (small_mem): read() after ftruncate(fd, 0)
returns 0 instead of the stale length, and unlink() no longer trips the
MEM_ISUSED assertion in rt_smem_free().

Fixes RT-Thread#11902

Signed-off-by: Leng Mengqi <312309080229@home.hpu.edu.cn>
@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown

👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).

🛠 操作步骤 | Steps

  1. 前往 Actions 页面 | Go to the Actions page
    点击进入工作流 → | Click to open workflow →

  2. 点击 Run workflow | Click Run workflow

  • Use workflow from 保持默认分支（通常为 master）
    Keep the default branch (usually master) in Use workflow from
  • 在 branch 输入框填写 PR 分支 fix/tmpfs-truncate-zero
    Enter PR branch fix/tmpfs-truncate-zero in the branch field
  • 设置需排除的文件/目录（目录请以"/"结尾）
    Set files/directories to exclude (directories should end with "/")
  1. 等待工作流完成 | Wait for the workflow to complete
    格式化后的代码将作为独立提交推送至你的分支。
    The formatting changes will be pushed to your branch as a separate commit.

完成后，提交将自动更新至 fix/tmpfs-truncate-zero 分支，关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the fix/tmpfs-truncate-zero branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们，再次感谢您的贡献！💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

@github-actions

github-actions Bot commented Oct 21, 2026 •
edited
Loading

Copy link
Copy Markdown

📌 Code Review Assignment

🏷️ Tag: components

Reviewers: @Maihuanyi

Changed Files (Click to expand)
  • components/dfs/dfs_v2/filesystems/tmpfs/dfs_tmpfs.c
  • components/dfs/dfs_v2/filesystems/tmpfs/utest/Kconfig
  • components/dfs/dfs_v2/filesystems/tmpfs/utest/SConscript
  • components/dfs/dfs_v2/filesystems/tmpfs/utest/tc_truncate.c

📊 Current Review Status (Last Updated: 2026-10-21 11:23 CST)

📝 Review Instructions

  1. 维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
    Maintainers can refresh the review status by clicking here: 🔄 Refresh Status

  2. 确认审核通过后评论 LGTM/lgtm
    Comment LGTM/lgtm after confirming approval

  3. PR合并前需至少一位维护者确认
    PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

@remukisama
[dfs][tmpfs] add truncate regression tests
9a806f7 
Cover zero and repeated truncation, subsequent I/O, non-zero resize, and allocation failure without losing the original file contents.

Signed-off-by: Leng Mengqi <312309080229@home.hpu.edu.cn>
@CLAassistant

CLAassistant commented Oct 21, 2026 •
edited
Loading

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@remukisama
[dfs][tmpfs] retain assertion failures across truncate checks
abbee53 
Signed-off-by: Leng Mengqi <312309080229@home.hpu.edu.cn>
@remukisama
remukisama marked this pull request as ready for review October 21, 2026 03:27
Copilot AI balanced review requested due to automatic review settings October 21, 2026 03:27
Copilot AI reviewed Oct 21, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@Yunlk

Yunlk commented Oct 22, 2026

Copy link
Copy Markdown
Contributor

替这个 PR 跑了一遍 utest，通过，并另做了一次"只留用例、回退修复"的对照，确认用例确实能抓到这个 bug。

环境

  • BSP: bsp/qemu-vexpress-a9
  • 分支/提交：remukisama:fix/tmpfs-truncate-zero @ abbee538c
  • QEMU 11.0.0，xpack arm-none-eabi-gcc 15.2.1
  • .config 追加：
    CONFIG_RT_USING_DFS_V2=y CONFIG_RT_USING_DFS_TMPFS=y CONFIG_RT_USING_POSIX_FS=y CONFIG_RT_USING_UTEST=y CONFIG_RT_USING_UTESTCASES=y CONFIG_RT_USING_CI_ACTION=y CONFIG_RT_UTEST_TMPFS_TRUNCATE=y CONFIG_UTEST_THR_STACK_SIZE=8192
  • 运行方式：CI_ACTION 自动跑全部已注册用例（等价于 utest_run components.dfs.tmpfs_truncate）

本 PR（含修复）——通过

[I/utest] [----------] [ testcase ] (components.dfs.tmpfs_truncate) started
[I/utest] [==========] utest unit name: (test_truncate)
[I/utest] [  PASSED  ] [ result   ] testcase (components.dfs.tmpfs_truncate)
[I/utest] [----------] [ testcase ] (components.dfs.tmpfs_truncate) finished
[I/utest] [  PASSED  ] [ result   ] 1 tests.

对照：只保留用例、把 dfs_tmpfs.c 回退到 master——失败

[I/utest] [----------] [ testcase ] (components.dfs.tmpfs_truncate) started
[E/utest] [  ASSERT  ] [ unit     ] at (tc_truncate.c); func: (test_zero_length:51); msg: ((st.st_size) not == (0))
[E/utest] [  ASSERT  ] [ unit     ] at (tc_truncate.c); func: (test_zero_length:53); msg: ((read(fd, buffer, sizeof(buffer))) not == (0))
(MEM_ISUSED(mem)) assertion failed at function:rt_smem_free, line number:517

这三条失败与 issue #11902 里描述的现象一一对应：

  1. st.st_size 没被清零（因为 rt_realloc(ptr, 0) 返回 NULL 时提前 return 0，跳过了 size 赋值）
  2. 截断后仍能 read 到数据（缓冲区已被释放但 d_file->data 仍指向它）
  3. 随后 rt_smem_free 的 MEM_ISUSED 断言失败——就是我之前在 [Bug] dfs_v2 tmpfs: ftruncate(fd, 0) frees the file buffer but reports success — use-after-free read/write and double free from a legal POSIX call #11902 里用独立 PoC 复现到的那个二次释放

所以这个用例的断言点选得准，修复前后行为区分明确。

关于第 4 步"帮忙批准主仓 CI"

我这边做不到：批准 workflow 需要仓库写权限，我会拿到 403 Must have admin rights to Repository.（之前重跑 MemBrowse 时已实测）。这一步只能由维护者点。

CI 目前状态（abbee538c）：

待批准 : utest_auto_run 等 7 个 workflow
已通过 : PR Format Notification / Pull Request Labeler / Auto Review Assistant

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@BernardXiong BernardXiong Awaiting requested review from BernardXiong BernardXiong is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

Component

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug] dfs_v2 tmpfs: ftruncate(fd, 0) frees the file buffer but reports success — use-after-free read/write and double free from a legal POSIX call

4 participants

@remukisama @CLAassistant @Yunlk