Perform pseudo-filesystem permission checks inside inode_reserve() and
inode_remove() while the inode tree lock is held, and hold that lock across
pseudorename mutations so symlink swaps cannot bypass directory checks.
Hold a read lock around pseudo-fs open permission checks.
On setuid/setgid exec, update saved set-IDs, mark the task group secure,
sanitize dangerous environment variables, clear debug/dumpable flags, and
add issetugid(), secure_getenv(), and PR_SET/GET_DUMPABLE support.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Use inode_checkopenperm() for message queues, named semaphores, and
shm, and reallocate mqueue state when reopening after the last close.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Set i_owner and i_group from the caller's effective credentials in
inode_reserve(), covering IPC objects, FIFOs, and pseudo-files.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Align the NuttX open(2) flag constants with the Linux asm-generic
values so that the FUSE wire protocol and other cross-platform
interfaces work without conversion.
All code that used '(flags & O_RDONLY)' as a bitmask check (always 0
now that O_RDONLY=0) has been updated to use '(flags & O_ACCMODE)'
comparisons.
The NUTTX_O_* constants in include/nuttx/fs/hostfs.h are updated to
match, and the sim hostfs open flag mapping is fixed.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
O_RDOK and O_WROK are non-standard aliases for O_RDONLY and O_WRONLY
respectively. Having two names for the same flag creates confusion,
especially when aligning the flag values with Linux. Remove the
aliases and replace all uses with the standard O_RDONLY/O_WRONLY.
No functional change — O_RDOK was defined as O_RDONLY and O_WROK as
O_WRONLY, so the replacement is a pure text substitution.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Check open access against file mode and owner via fs_checkmode(), verify
parent directory permissions on create, and assign creator uid/gid to
newly created files.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Add fs_checkmode() and fs_checkopenperm() for reuse across filesystems.
Enforce pseudoFS mode bits in inode_checkperm() and allow world-readable
open of passwd/group entries so getpwnam() works after seteuid().
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Add pseudoFS permission enforcement for unlink(), mkdir(), and rename() VFS mutation operations.
This change validates parent-directory permissions before modifying pseudoFS inode topology and returns -EACCES for unauthorized operations.
The implementation preserves mountpoint filesystem behavior and fixes multiple inode lifetime/search-state issues in the rename path.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Add inode_checkperm() and integrate it into file_vopen()
to enforce UNIX-style read/write permission checks for
pseudoFS inodes using effective uid/gid credentials.
Skip permission enforcement for mountpoint inodes and
allow kernel threads to bypass checks.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
When CONFIG_FS_BACKTRACE is enabled, collecting a stack trace for every
new file descriptor adds overhead to fast path operations like open(),
dup(), and socket().
This patch adds a new configuration option CONFIG_FS_BACKTRACE_DEFAULT.
When enabled (default behavior), the GROUP_FLAG_FD_BACKTRACE flag is
automatically set during group allocation, causing backtrace to be
captured for all tasks globally, preserving the original diagnostic
capability.
When disabled, backtrace capture is zero-cost by default and must be
explicitly enabled per task group using GROUP_FLAG_FD_BACKTRACE.
Signed-off-by: zhanxiaoqi <zhanxiaoqi@bytedance.com>
debug.h is a NuttX-specific, non-POSIX header. Placing it in the
top-level include/ directory creates naming conflicts with external
projects that define their own debug.h.
This commit moves the canonical header to include/nuttx/debug.h,
following the NuttX convention for non-POSIX/non-standard headers,
and updates all in-tree references.
A backward-compatibility shim is left at include/debug.h that
emits a deprecation #warning and re-includes <nuttx/debug.h>,
allowing out-of-tree code to continue building while migrating.
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
issue description:
task A: NSH:
1.open-> reboot->sync->task_fsfsync
2.nx_vopen-> context switch
3.fdlist_allocate: ----> 4.fsync->file_sync->assert(inode or priv is empty)
(new fd with empty filep)
5.file_vopen:
(init empty filep)
6.return fd
Task A allocates a new fd with an empty filep in fdlist_allocate. Before
it can fully initialize the filep in file_vopen, the NSH task triggers a
file - system sync operation. The sync operation encounters the empty
filep associated with the newly allocated fd, causing the assertion to
fail and the system to crash.
To resolve this race condition, we should modify the fd allocation
process. Instead of allocating a new fd with an empty filep first and
then initializing it later, we should use the file_allocate_from_inode
function. This function allows us to initialize the file structure first
and then bind it to the new filep when allocating the fd. By doing so,
we ensure that the filep is always properly initialized before it is
used in any file - system operations, thus preventing the assertion
failure and the subsequent system crash.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
When a child process inherits file descriptors from its parent via
fdlist_copy(), the fd tags (fd_tag_fdsan and fd_tag_fdcheck) were not
being copied. This caused assertion failures when the child process
closed inherited file descriptors, because the fdcheck/fdsan subsystems
expected the tags to match.
Root Cause:
----------
The fdlist_install() function was not preserving the fd tags during
fd duplication. When copying fds from parent to child in fdlist_copy(),
the tags were lost, resulting in:
- fd_tag_fdsan: Used for file descriptor ownership tracking (FDSAN)
- fd_tag_fdcheck: Used for fd validity checking (FDCHECK)
Both tags being reset to 0/NULL instead of copied from parent.
Symptom:
--------
Child processes would crash with assertion failure in fdcheck_restore()
when closing inherited file descriptors:
fdcheck_restore+0x69/0xa0
fdlist_get2+0x11/0x48
fdlist_close+0xd/0x94
close+0x15/0x30
This occurred because fdcheck_restore() validates that the fd_tag_fdcheck
matches the expected value, and the mismatch triggered an assertion.
Solution:
---------
1. Add a 'copy' parameter to fdlist_install() to distinguish between:
- New fd allocation (copy=false): Initialize fresh tags
- Fd duplication (copy=true): Preserve tags from source fd
2. Add fdp parameter to fdlist_install() to access source fd tags
3. In fdlist_copy(), pass copy=true to preserve parent's fd tags
4. In fdlist_dup3(), pass copy=false since dup operations should
create independent fd tracking (not copy parent tags)
Changes:
--------
- fdlist_install(): Added 'fdp' and 'copy' parameters
- When copy=true, preserve fd_tag_fdsan and fd_tag_fdcheck from source
- fdlist_copy(): Pass copy=true to preserve parent tags
- fdlist_dup3(): Pass copy=false for normal dup behavior
Impact:
-------
This fix ensures that file descriptor ownership tracking and validity
checking work correctly across fork/clone operations, preventing
crashes when child processes close inherited file descriptors.
Without this fix, any program using fork() with inherited fds would
crash if CONFIG_FDSAN or CONFIG_FDCHECK were enabled.
Issue backtrace:
backtrace_unwind+0x105/0x108
sched_backtrace+0x6f/0x80
sched_dumpstack+0x33/0x80
_assert+0x229/0x510
arm_syscall+0x81/0x98
up_assert+0xd/0x18
__assert+0x1d/0x24
fdcheck_restore+0x69/0xa0
fdlist_get2+0x11/0x48
fdlist_close+0xd/0x94
close+0x15/0x30
closefd+0x5/0x30
notify_parent_process+0x2b/0x40
run_helper_tcp4_echo_server+0x75/0x114
run_test_part+0x5f/0x68
uv_run_tests_main+0x35/0x60
run_test_part+0x5f/0x68
uv_run_tests_main+0x35/0x60
nxtask_startup+0x13/0x2c
nxtask_start+0x4d/0x64
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
Before this fix, the check for OPEN_MAX was performed using orig_rows
instead of the new row count after extension. This caused the check to
pass even when the allocation would exceed OPEN_MAX limit.
For example:
- OPEN_MAX = 256
- CONFIG_NFILE_DESCRIPTORS_PER_BLOCK = 32
- orig_rows = 8 (8 * 32 = 256, at the limit)
The old code checked: 32 * 8 > 256 (false, allows extension)
The new code checks: 32 * (8 + 1) > 256 (true, correctly blocks)
Without this fix, the system could allocate more file descriptors than
OPEN_MAX allows, potentially causing memory corruption or exceeding
system limits.
This fix ensures the check evaluates the new total count (orig_rows + 1)
before allowing the extension to proceed.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
This patch is a rework of the NuttX file descriptor implementation. The
goal is two-fold:
1. Improve POSIX compliance. The old implementation tied file description
to inode only, not the file struct. POSIX however dictates otherwise.
2. Fix a bug with descriptor duplication (dup2() and dup3()). There is
an existing race condition with this POSIX API that currently results
in a kernel side crash.
The crash occurs when a partially open / closed file descriptor is
duplicated. The reason for the crash is that even if the descriptor is
closed, the file might still be in use by the kernel (due to e.g. ongoing
write to file). The open file data is changed by file_dup3() and this
causes a crash in the device / drivers themselves as they lose access to
the inode and private data.
The fix is done by separating struct file into file and file descriptor
structs. The file struct can live on even if the descriptor is closed,
fixing the crash. This also fixes the POSIX issue, as two descriptors
can now point to the same file.
Signed-off-by: Ville Juven <ville.juven@unikie.com>
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
1. The call to file_close_without_clear in file_dup3 does not clear
the tag information, so there is no need to back it up.
2. file_dup3 don't need to copy tag information, tag is only valid for fd.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
Previously, this config was added to ensure that the size of the struct
file remained unchanged, thereby preventing the Flash memory of
resource-constrained MCUs from being unnecessarily increased.
However, we have now refactored the relationship between struct fd and struct file,
reducing their memory footprint in both Flash and RAM.
Consequently, this config can be removed.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
Currently the code is dumped into one massive file; fs_files. Move the
different logical parts into their own files.
Signed-off-by: Ville Juven <ville.juven@unikie.com>
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
This modification ensures that inoderemove will error instead of
trying to remove an inode without parent.
This fix was implement by Richard Jiayang Liu.
Signed-off-by: Richard Jiayang Liu <rjliu3@illinois.edu>
after below change merge to kernel, spin_lock() will turn off preemption by default,
but this change is not applicable to all scenarios. The locations in the kernel that
use spin_lock() extensively only require short critical sections and do not trigger
scheduling, which leads to serious performance degradation of NuttX in AMP mode.
In this PR, I try to expose similar problems and hope that each subsystem will carefully check the code coverage
https://github.com/apache/nuttx/pull/14578
|commit b69111d16a
|Author: hujun5 <hujun5@xiaomi.com>
|Date: Thu Jan 23 16:14:18 2025 +0800
|
| spinlock: add sched_lock to spin_lock_irqsave
|
| reason:
| We aim to replace big locks with smaller ones. So we will use spin_lock_irqsave extensively to
| replace enter_critical_section in the subsequent process. We imitate the implementation of Linux
| by adding sched_lock to spin_lock_irqsave in order to address scenarios where sem_post occurs
| within spin_lock_irqsave, which can lead to spinlock failures and deadlocks.
|
| Signed-off-by: hujun5 <hujun5@xiaomi.com>
Signed-off-by: chao an <anchao.archer@bytedance.com>
reason:
The list->fl_files may be modified by files_extend.
If it is being modified, there will be a race condition for fl_files[l1][l2].
Signed-off-by: hujun5 <hujun5@xiaomi.com>
After tcb is destroyed, it is very dangerous to back reference tcb through file.
This commit will perform file operations while ensuring the validity of tcb during
fsync, with will avoid tcb check in each subsystem.
Signed-off-by: chao an <anchao@lixiang.com>
Modify the kernel to use only atomic_xx and atomic64_xx interfaces,
avoiding the use of sizeof or typeof to determine the type of
atomic operations, thereby simplifying the kernel's atomic
interface operations.
Signed-off-by: zhangyuan29 <zhangyuan29@xiaomi.com>
Most tools used for compliance and SBOM generation use SPDX identifiers
This change brings us a step closer to an easy SBOM generation.
Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
In ./fs/inode directory, the variable name FAR struct inode *node is named inconsistently, with some using node and others using inode. To facilitate understanding, we will standardize the naming to FAR struct inode *inode.
Signed-off-by: cuiziwei <cuiziwei@xiaomi.com>
/home/neo/projects/vela/nuttx/fs/vfs/fs_dup2.c: In function 'file_dup3':
/home/neo/projects/vela/nuttx/fs/inode/inode.h:73:35: error: implicit declaration of function '_SCHED_GETTID' [-Werror=implicit-function-declaration]
73 | int n = sched_backtrace(_SCHED_GETTID(), \
| ^~~~~~~~~~~~~
/home/neo/projects/vela/nuttx/fs/vfs/fs_dup2.c:177:3: note: in expansion of macro 'FS_ADD_BACKTRACE'
177 | FS_ADD_BACKTRACE(filep2);
Signed-off-by: xuxingliang <xuxingliang@xiaomi.com>
Summary:
When the device reboot through reboot_notify to notify the task fsync time, if there is a task in the exit process, there may be priority robbed off the phenomenon, and at this time the group->tg_filelist crefs has been 0, resulting in the ASSERT
Signed-off-by: chenrun1 <chenrun1@xiaomi.com>
Example:
When executing "df -h" on Core A to view mount information, this
process will traverse inode nodes, thereby holding the inode_lock.
Since the inode type of the mount point may be rpmsgfs, it will fetch statfs
information from another Core B.
Meanwhile, rcS on Core B needs to obtain file information from Core A,
which will be achieved by fetching stat information through rpmsgfs.
When this message arrives at Core A, a deadlock can occur between Core A's
rptun ap and nsh task.
However, both of these places involve read operations only, thus a reader-writer lock
can be utilized to prevent such a deadlock.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
Summary:
1.Add configuration to allocate memory from the specified section
2.Replace all memory operations (kmm_) in the vfs with
fs_heap_. When FS_HEAPSIZE > 0, memory is requested for the file system by specifying a configured heap location. By default (i.e. FS_HEAPSIZE=0) fs_heap_ is equivalent to kmm_
Signed-off-by: chenrun1 <chenrun1@xiaomi.com>
Summary:
1.Modified the i_crefs from int16_t to atomic_int
2.Modified the i_crefs add, delete, read, and initialize interfaces to atomic operations
The purpose of this change is to avoid deadlock in cross-core scenarios, where A Core blocks B Core’s request for a write operation to A Core when A Core requests a read operation to B Core.
Signed-off-by: chenrun1 <chenrun1@xiaomi.com>
Summary:
1.Added msync callback in struct mm_map_entry_s
2.Added msync API in fs_msync.c
3.Added static msync_rammap for rammap.
Signed-off-by: chenrun1 <chenrun1@xiaomi.com>
