Bug Report: sys_poll integer wraparound on 32-bit RT-Smart gives kernel heap out-of-bounds read/write

RT-Thread Version

v5.0.0 – v5.3.0 and current master (v5.4.0-dev, verified at commit 5d1fb66d).
Introduced by commit ecf2d821 (2022-12-03, "sync branch rt-smart. (#6641)"), first release: v5.0.0.

Affected area

Kernel / RT-Smart (light-weight process) — components/lwp/lwp_syscall.c (sys_poll),
components/libc/posix/io/poll/poll.c.

Hardware-BSP vendor

Other (architecture-dependent, not vendor-dependent)

Architecture

ARM 32-bit (any sizeof(size_t) == 4 target with RT_USING_SMART enabled).
64-bit builds are NOT affected (the product nfds * sizeof is promoted to 64-bit and does not
wrap; the oversized allocation simply fails with -ENOMEM).

Board and hardware details

Reproduced on bsp/qemu-vexpress-a9 (Cortex-A9, QEMU vexpress-a9 machine) with the official
CI RT-Smart configuration fragment (.github/utest/configs/rtsmart/rtsmart.cfg) and the
official CI musl toolchain (toolchains-ci v1.7, arm-linux-musleabi-gcc 7.3.0).

Develop Toolchain

GCC (arm-linux-musleabi 7.3.0 for the kernel; the PoC is a freestanding user program that
issues raw svc calls, no libc needed).

Describe the bug

On 32-bit RT-Smart builds, sys_poll() computes the size of the kernel-side pollfd array
with a multiplication that wraps modulo 2^32, while still handing the unwrapped fd count
to the kernel poll loop. An unprivileged user process can therefore make the kernel allocate
an 8-byte heap block and then linearly read and write far beyond it, corrupting the kernel
heap and deterministically killing the system.

Vulnerable code (components/lwp/lwp_syscall.c, sys_poll):

if (!lwp_user_accessable((void *)fds, nfds * sizeof *fds))   /* nfds_t = unsigned int */
    return -EFAULT;

kfds = (struct pollfd *)kmem_get(nfds * sizeof *kfds);       /* wraps on 32-bit */
...
lwp_get_from_user(kfds, fds, nfds * sizeof *kfds);

ret = poll(kfds, nfds, timeout);                             /* original nfds, unwrapped */

With nfds = 0x20000001 and sizeof(struct pollfd) == 8:
0x20000001 * 8 = 0x1_00000008, which wraps to 8 on a 32-bit size_t.
The !size early-out in lwp_user_accessible_ext() only catches products that wrap to
exactly zero, so the wrapped size passes the access check, kmem_get(8) (= rt_malloc(8))
returns an 8-byte kernel heap block, and poll(kfds, 0x20000001, 0) walks
536,870,913 entries starting at that block.

Inside do_pollfd() (poll.c:207-242), for each entry pf:

• fd = pollfd->fd — out-of-bounds read of kernel heap memory past the 8-byte block;
• fd_get(fd) — the garbage fd is used as an fdt index (further OOB access);
• pollfd->revents = mask — out-of-bounds write of a 4-byte value at every 8-byte offset
  (POLLNVAL = 0x20, or mask & (events | POLLERR | POLLHUP) where events itself is the
  OOB-read heap data, i.e. partially groomable).

Steps to reproduce (full chain, no host-side shortcuts):

1. Build the qemu-vexpress-a9 BSP with the official CI smart fragment:
   cat .github/utest/configs/rtsmart/rtsmart.cfg >> bsp/qemu-vexpress-a9/.config
   (plus scons --pyconfig-silent && scons with RTT_CC_PREFIX=arm-linux-musleabi-).
2. Place a freestanding user program as /sbin/init on the FAT sd.bin rootfs
   (RT-Smart execs /sbin/init as pid 1 at boot). The program issues one raw syscall:
   sys_call(SYS_poll /* RT-Thread syscall #9 */, fds, 0x20000001, 0)
   with fds pointing at a valid user buffer {fd=1, events=POLLIN}.
   PoC source: one file, ~200 lines, no libc, pure svc (available on request).
3. Run: qemu-system-arm -M vexpress-a9 -m 512 -kernel rtthread.bin -sd sd.bin -serial stdio

Actual result (serial log):

msh />[poc] sys_poll nfds wraparound attack start
[W/mm.fault] rt_aspace_fault_try_fix: varea not found at 0x48000
data abort:Execption:
r00:0xc0125800 r01:0x00000000 r02:0x0000fdfd r03:0x0004801c
...
sp :0xc0141450 lr :0xc002a25c pc :0xc0040d8c
dfsr:0x00000005
dfar:0x00048040

Backtrace (addr2line on the crash addresses printed by the kernel):

fd_get    components/dfs/dfs_v2/src/dfs.c:500
poll_do   components/libc/posix/io/poll/poll.c:281
poll      components/libc/posix/io/poll/poll.c:355
sys_poll  components/lwp/lwp_syscall.c:933        <-- poll(kfds, nfds, timeout) with unwrapped nfds
arch_syscall_exit  components/lwp/arch/arm/cortex-a/lwp_gcc.S:193

r03 = 0x0004801c is the linearly advanced pf pointer — the walk has already covered
dozens of KB past the 8-byte kmem block when the first unmapped access (dfar=0x48040)
faults. Because do_pollfd() assigns pf->revents on every iteration, 4096+ out-of-bounds
4-byte writes into the kernel heap occur before the fault point. After the first data abort
the kernel then enters a cascade of 726 consecutive data aborts (heap metadata corrupted;
every subsequent kernel path dies) — a full system crash.

Control run: the same program with the legal value nfds = 1 returns 0, sets
revents = 0, and the system stays alive (msh keeps running). The only differing input is
the nfds value.

Expected result: sys_poll() must validate that nfds * sizeof *fds does not overflow
(e.g. if (nfds > (SIZE_MAX / sizeof *fds)) return -EINVAL;) — the same for sys_epoll_pwait's
cnt * sizeof(struct epoll_event) (see below) — or clamp/limit the count consistently for
allocation, copy and traversal.

Other additional context

• Suggested fix (one-line family):

  if (nfds > (size_t)-1 / sizeof *fds) return -EINVAL;   /* sys_poll, before access check */
  if ((unsigned)cnt > (size_t)-1 / sizeof(struct epoll_event)) return -EINVAL; /* sys_epoll_pwait */

• Sibling path with the same root cause (not the subject of this report but should be fixed
  together): sys_epoll_pwait() at lwp_syscall.c:10519-10522 —
  kmem_get(cnt * sizeof(struct epoll_event)) wraps the same way on 32-bit
  (cnt = 0x10000001, sizeof = 16 → allocates 16 bytes) while epoll_do() uses the
  original cnt as maxevents and memcpys a 16-byte struct epoll_event per ready-list
  entry whose 8-byte data payload is fully attacker-chosen via epoll_ctl(EPOLL_CTL_ADD);
  level-triggered entries are re-appended to the ready list, so a single ready fd can smear
  the same attacker-controlled 16-byte pattern linearly across the kernel heap. We verified
  the code path statically; on our board epoll_create1() currently fails for an unrelated
  reason so we did not complete a runtime reproduction of this variant.
• Attack prerequisites (explicit): 32-bit RT-Smart build; the attacker needs to run code
  as any unprivileged user process (e.g. a third-party application or module on the device);
  no privileges, no race, no user interaction, single syscall.
• CVSS 3.1: 6.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) — deterministic kernel heap
  OOB write + full system crash; 64-bit builds unaffected.
• CWE: CWE-190 (Integer Overflow or Wraparound) leading to CWE-787/CWE-125
  (OOB write/read) and CWE-400.
• Relationship to existing reports: none found (issue search for poll/epoll overflow
  empty; [Bug] Insufficient pointer validation vulnerability in the sys_select system call in Smart version of RT-Thread #10298 concerns sys_select's timeout pointer validation — different function, root
  cause and sink; the CVE-2025 lwp family covers pointer-validation bugs, not size arithmetic).