Skip to content

[libc][posix] fix: validate fd type in timerfd_settime/gettime - #11996

Merged
Rbb666 merged 1 commit into
RT-Thread:masterfrom
BernardXiong:fix/timerfd-validate-fops
Nov 8, 2026
Merged

[libc][posix] fix: validate fd type in timerfd_settime/gettime#11996
Rbb666 merged 1 commit into
RT-Thread:masterfrom
BernardXiong:fix/timerfd-validate-fops

Conversation

@BernardXiong

@BernardXiong BernardXiong commented Nov 6, 2026

Copy link
Copy Markdown
Member

Summary

timerfd_settime() / timerfd_gettime() accepted any file descriptor and treated vnode->data as struct rt_timerfd. This validates the descriptor's file operations before touching the private data, matching the check Linux performs in fs/timerfd.c.

Fixes #11984.

Change

In timerfd_do_settime() and timerfd_do_gettime():

  • reject a missing file or vnode;
  • reject descriptors whose fops are not timerfd_fops (df->fops under DFS v2, vnode->fops under DFS v1);
  • return -EINVAL / set errno consistently.

Validation

  • Built bsp/simulator (host gcc, DFS v1, RT_USING_POSIX_TIMERFD=y); timerfd.o compiles cleanly.
  • Runtime RT-Smart QEMU test was not run locally because no cross toolchain is installed in this environment; the DFS v2 path is left to CI.

Scope

Only the two descriptor-based entry points are changed. close/read/poll are reached through fops dispatch and do not need an extra type check.

@BernardXiong
[libc][posix] fix: validate fd type in timerfd_settime/gettime
7181b8c 
timerfd_do_settime() and timerfd_do_gettime() used vnode->data from any
file descriptor as struct rt_timerfd. Validate that the descriptor's file
operations are timerfd_fops before dereferencing the private data, using
df->fops under DFS v2 and vnode->fops under DFS v1.
@github-actions

github-actions Bot commented Nov 6, 2026

Copy link
Copy Markdown

👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).

🛠 操作步骤 | Steps

  1. 前往 Actions 页面 | Go to the Actions page
    点击进入工作流 → | Click to open workflow →

  2. 点击 Run workflow | Click Run workflow

  • Use workflow from 保持默认分支（通常为 master）
    Keep the default branch (usually master) in Use workflow from
  • 在 branch 输入框填写 PR 分支 fix/timerfd-validate-fops
    Enter PR branch fix/timerfd-validate-fops in the branch field
  • 设置需排除的文件/目录（目录请以"/"结尾）
    Set files/directories to exclude (directories should end with "/")
  1. 等待工作流完成 | Wait for the workflow to complete
    格式化后的代码将作为独立提交推送至你的分支。
    The formatting changes will be pushed to your branch as a separate commit.

完成后，提交将自动更新至 fix/timerfd-validate-fops 分支，关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the fix/timerfd-validate-fops branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们，再次感谢您的贡献！💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

@github-actions

github-actions Bot commented Nov 6, 2026

Copy link
Copy Markdown

📌 Code Review Assignment

🏷️ Tag: components

Reviewers: @Maihuanyi

Changed Files (Click to expand)
  • components/libc/posix/io/timerfd/timerfd.c

🏷️ Tag: components_libc

Reviewers: @GorrayLi @mysterywolf

Changed Files (Click to expand)
  • components/libc/posix/io/timerfd/timerfd.c

📊 Current Review Status (Last Updated: 2026-11-07 03:04 CST)

📝 Review Instructions

  1. 维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
    Maintainers can refresh the review status by clicking here: 🔄 Refresh Status

  2. 确认审核通过后评论 LGTM/lgtm
    Comment LGTM/lgtm after confirming approval

  3. PR合并前需至少一位维护者确认
    PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

@BernardXiong BernardXiong mentioned this pull request Nov 6, 2026
Closed
@github-actions

github-actions Bot commented Nov 6, 2026

Copy link
Copy Markdown

MemBrowse Memory Report · Explore what changed →

No memory changes detected for:

Catch memory regressions in CI with MemBrowse. Free for open source.

@Rbb666
Rbb666 merged commit 2b0b104 into RT-Thread:master Nov 8, 2026
112 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Rbb666 Rbb666 Rbb666 approved these changes
@mysterywolf mysterywolf Awaiting requested review from mysterywolf mysterywolf is a code owner

Assignees

No one assigned

Labels

Component

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug] timerfd: timerfd_settime()/timerfd_gettime() accept any fd -> type confusion -> kernel PC control from an unprivileged user process

2 participants

@BernardXiong @Rbb666