[HUST CSE][finsh] validate backtrace thread address#11343
[HUST CSE][finsh] validate backtrace thread address#11343Telecaster2147 wants to merge 1 commit intoRT-Thread:masterfrom
Conversation
|
👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread! 为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。 🛠 操作步骤 | Steps
完成后，提交将自动更新至 如有问题欢迎联系我们，再次感谢您的贡献！💐 |
📌 Code Review Assignment🏷️ Tag: kernelReviewers: @GorrayLi @ReviewSun @hamburger-os @lianux-mm @wdfk-prog @xu18838022837 Changed Files (Click to expand)
📊 Current Review Status (Last Updated: 2026-04-22 15:55 CST)
📝 Review Instructions
|
|
@Rbb666 您好，代码均已检查完毕，可以麻烦审核一下吗，感谢 |
There was a problem hiding this comment.
Pull request overview
This PR hardens the Finsh backtrace [thread_address] command path in src/kservice.c by treating the user-provided address as untrusted input: it parses the argument more strictly and only proceeds when the address matches a real, currently-registered thread object.
本 PR 针对 src/kservice.c 中 Finsh 的 backtrace [thread_address] 命令做了安全加固：将用户输入视为不可信数据，先做更严格的解析，再仅在地址与当前系统中真实存在的线程对象匹配时才继续 backtrace。
Changes / 变更：
- Add helper routines to parse
argv[1]and to locate the target thread by iterating the thread object list, instead of callingrt_object_get_type()on an arbitrary user pointer. - Refactor
cmd_backtrace()flow to bail out early on invalid input and to backtrace only a verifiedrt_thread_t. - Update output formatting/messages for invalid input / invalid pid cases.
| if ((arg == RT_NULL) || (pid == RT_NULL)) | ||
| { | ||
| return RT_FALSE; | ||
| } | ||
|
|
||
| value = (rt_uintptr_t)strtoul(arg, &end_ptr, 0); | ||
| if ((end_ptr == arg) || (*end_ptr != '\0') || (value == 0)) | ||
| { | ||
| return RT_FALSE; |
|
|
||
| value = (rt_uintptr_t)strtoul(arg, &end_ptr, 0); | ||
| if ((end_ptr == arg) || (*end_ptr != '\0') || (value == 0)) | ||
| { |
| rt_kprintf("backtrace %s(0x%lx), from %s\n", target->parent.name, (unsigned long)pid, argv[1]); | ||
| rt_backtrace_thread(target); | ||
| } | ||
| else | ||
| rt_kprintf("Invalid pid: %ld\n", pid); | ||
| { | ||
| rt_kprintf("Invalid pid: %lx\n", (unsigned long)pid); | ||
| } |
拉取/合并请求描述：(PR description)
[
为什么提交这份PR (why to submit this PR)
当前 finsh 的
backtrace [thread_address]命令直接把用户输入解析成地址后，再用该地址调用rt_object_get_type()判断对象类型。这个实现默认调用方传入的是一个真实有效的线程对象地址；一旦用户传入任意无效地址、悬空地址或者并非 RT-Thread 对象的地址，命令路径就可能在对象类型判断前后访问非法内存，导致异常行为甚至崩溃。这个问题出现在 shell 命令入口，属于运行时输入校验不足，不适合继续依赖“用户总是输入合法线程地址”来规避。更安全的做法是把用户输入当作不可信数据处理，只在当前线程对象表中确认该地址确实对应一个真实线程对象后，才继续执行 backtrace。
你的解决方案是什么 (what is your solution)
本 PR 在
src/kservice.c中对cmd_backtrace()做了针对性的输入校验和线程查找重构：新增
cmd_backtrace_parse_pid()：argv[1]的地址解析；0值做显式拒绝；end_ptr == argv[1]带来的宽松解析。新增
cmd_backtrace_find_thread()和cmd_backtrace_match_thread()：RT_Object_Class_Thread对象列表，只在输入地址与当前系统里真实存在的线程对象地址完全匹配时，才返回目标线程。调整
cmd_backtrace()主流程：Invalid input；Invalid pid；rt_backtrace_thread(target)。请提供验证的bsp和config (provide the config and bsp)
BSP:
bsp/qemu-vexpress-a9.config:
qemu-vexpress-a9当前主线配置作为验证基线；RT_USING_CONSOLE、RT_USING_FINSH和 backtrace 相关选项，可覆盖本次修复的命令路径；action: 暂无
补充说明：
bsp/qemu-vexpress-a9可成功生成rtthread.elf和rtthread.bin；msh />；backtrace 0x1时，修复后命令能够稳定返回Invalid pid: 1，未出现非法地址访问导致的异常；backtrace <有效线程地址>时，命令能够进入正常的线程 backtrace 路径。]
当前拉取/合并请求的状态 Intent for your PR
必须选择一项 Choose one (Mandatory):
代码质量 Code Quality：
我在这个拉取/合并请求中已经考虑了 As part of this pull request, I've considered the following:
#if 0代码，不包含已经被注释了的代码 All redundant code is removed and cleaned up