casaroli opened a new pull request, #20838: URL: https://github.com/apache/nuttx/pull/20838
## Summary ROMFS takes the offsets of file headers, hard link targets and names from the image, and `romfs_devcacheread()` did not check them. In XIP mode the offset is added to the image address, so a damaged image gives a bad pointer and the kernel stops with a load exception during the mount. Example: an `/etc` image with no entries (32 bytes, only the volume header). The root directory offset is then the end of the volume, the mount reads the rodata after `romfs_img`, takes it as a hard link and follows a garbage offset. On an ESP32-S3 the boot stops in `AppBringUp` with `EXCCAUSE=001c` in `romfs_devread32()` <- `romfs_followhardlinks()`. `romfs_devcacheread()` now returns `-EIO` if the 16-byte chunk at the offset is not fully in the volume (`rm_volsize`). The mount or the lookup fails and the system continues. `romfs_datastart()` already does the same check. A valid image is not affected: genromfs sets the volume size to the end of the last file data, so every header and name chunk is inside it. The first commit fixes an older nxstyle error in the same file (no code change). ## Impact - A damaged ROMFS image no longer crashes the kernel. The mount fails with `-EIO`, or `open()` fails if `CONFIG_FS_ROMFS_CACHE_NODE` is off. - No change for valid images. One compare per header or name read. - No documentation change. ## Testing ESP32-S3 WROOM-2 N32R8V board (octal flash), `esp32s3-devkit:nsh`, `/etc` ROMFS on. The two images in each row have the same `.config`. | `/etc` image | master | this PR | |---|---|---| | empty, 32 bytes, `CONFIG_INIT_ENTRYPOINT="nsh_main"` | `User Exception: EXCCAUSE=001c task: AppBringUp`, `VADDR: 9b7a00f8`, no prompt | NSH prompt, `mount` shows only `/proc` | | valid, 1024 bytes (genromfs 0.5) | NSH prompt, `/etc/init.d` has `init.rc`, `rc.sysinit`, `rcS` | the same; `ostest` runs | `qemu-armv8a:nsh` under QEMU: NSH starts from `/etc/init.d/init.rc` and `ls -l /etc/init.d` lists it. Builds: `esp32s3-devkit:nsh` and `qemu-armv8a:nsh`, no warnings. `tools/checkpatch.sh -c -u -m -g` passes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
