Skip to content

dfs/posix: validate bounds and safely detach listener in signalfd_close - #11935

Open
adilalperenciftci wants to merge 1 commit into
RT-Thread:masterfrom
adilalperenciftci:fix/signalfd-lifecycle-bounds
Open

adilalperenciftci wants to merge 1 commit into
RT-Thread:masterfrom
adilalperenciftci:fix/signalfd-lifecycle-bounds

Conversation

@adilalperenciftci

Copy link
Copy Markdown

Summary

Enforce bounds checking on signalfd notification registrations and cleanly detach notification listeners during signalfd_close.

Technical Breakdown

  1. Replace unsafe global index counter with per-context slot lookup bounded by SIGNALFD_SHART_MAX.
  2. In signalfd_close, iterate registered lwps, detach matching notification nodes from signalfd_notify_head, and free allocated listener structures.
  3. Reset file context pointer and initialize table entries to prevent stale dereferencing.

Fixes: #11933

Validate array bounds on signalfd notification registration, remove unsafe global index counter, and cleanly detach and free registered notification listeners upon signalfd_close.

Fixes: RT-Thread#11933
Signed-off-by: Adil Alperen Çiftci <adilalperenciftci@users.noreply.github.com>
@CLAassistant

CLAassistant commented Oct 27, 2026 •

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@github-actions

Copy link
Copy Markdown

📌 Code Review Assignment

🏷️ Tag: components

Reviewers: @Maihuanyi

Changed Files (Click to expand)
  • components/libc/posix/io/signalfd/signalfd.c

🏷️ Tag: components_libc

Reviewers: @GorrayLi @mysterywolf

Changed Files (Click to expand)
  • components/libc/posix/io/signalfd/signalfd.c

📊 Current Review Status (Last Updated: 2026-10-27 08:34 CST)


📝 Review Instructions

  1. 维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
    Maintainers can refresh the review status by clicking here: 🔄 Refresh Status

  2. 确认审核通过后评论 LGTM/lgtm
    Comment LGTM/lgtm after confirming approval

  3. PR合并前需至少一位维护者确认
    PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

@github-actions

Copy link
Copy Markdown

👋 感谢您对 RT-Thread 的贡献!Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范,请在你的仓库中执行以下步骤运行代码格式化工作流(如果格式化CI运行失败)。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).


🛠 操作步骤 | Steps

  1. 前往 Actions 页面 | Go to the Actions page
    点击进入工作流 → | Click to open workflow →

  2. 点击 Run workflow | Click Run workflow

  • Use workflow from 保持默认分支(通常为 master)
    Keep the default branch (usually master) in Use workflow from
  • 在 branch 输入框填写 PR 分支 fix/signalfd-lifecycle-bounds
    Enter PR branch fix/signalfd-lifecycle-bounds in the branch field
  • 设置需排除的文件/目录(目录请以"/"结尾)
    Set files/directories to exclude (directories should end with "/")
  1. 等待工作流完成 | Wait for the workflow to complete
    格式化后的代码将作为独立提交推送至你的分支。
    The formatting changes will be pushed to your branch as a separate commit.

完成后,提交将自动更新至 fix/signalfd-lifecycle-bounds 分支,关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the fix/signalfd-lifecycle-bounds branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们,再次感谢您的贡献!💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

@adilalperenciftci
adilalperenciftci marked this pull request as ready for review October 27, 2026 01:49
Copilot AI balanced review requested due to automatic review settings October 27, 2026 01:49

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] signalfd: unbounded global index into per-fd array causes kernel heap out-of-bounds write from the 11th signalfd() call (RT-Smart)

3 participants