[components][lwp] harden sys_getaddrinfo user pointer handling

sys_getaddrinfo() validated the top-level res buffer, then wrote the
resolved socket address through res->ai_addr, a user-controlled nested
pointer that was never checked. On Smart/MMU builds a user program could
therefore turn getaddrinfo() into an arbitrary kernel write. The hints
fields were also read directly from user memory after the access check,
leaving a TOCTOU window.

Copy res and hints into kernel temporaries with lwp_get_from_user() so
all nested pointers come from one validated snapshot. Write the nested
sockaddr and the outer addrinfo back with lwp_put_to_user(), which
validates the destination range and never dereferences an unchecked user
pointer in kernel context.

Also fix the servname copy check (a size_t result can never be < 0),
allocate the kernel addrinfo with sizeof(*k_hints), and release k_res on
the new error paths.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Author: 2 people

components/lwp/syscall/syscall_netdb.c

@@ -63,16 +63,24 @@ sysret_t sys_getaddrinfo(const char *nodename,
     char *k_nodename = NULL;
     char *k_servname = NULL;
     struct addrinfo *k_hints = NULL;
+    struct musl_addrinfo k_res_musl = { 0 };
+    struct musl_addrinfo k_hints_musl = { 0 };
 #ifdef ARCH_MM_MMU
     int len = 0;
 #endif
 
+    /*
+     * Work on a kernel copy of res: ai_addr is a user pointer and must not be
+     * re-read from user memory after validation (TOCTOU).
+     */
 #ifdef ARCH_MM_MMU
-    if (!lwp_user_accessable((void *)res, sizeof(*res)))
+    if (lwp_get_from_user(&k_res_musl, (void *)res, sizeof(k_res_musl)) != sizeof(k_res_musl))
     {
         SET_ERRNO(EFAULT);
         goto exit;
     }
+#else
+    k_res_musl = *res;
 #endif
     if (nodename)
     {
@@ -122,7 +130,7 @@ sysret_t sys_getaddrinfo(const char *nodename,
             goto exit;
         }
 
-        if (lwp_get_from_user(k_servname, (void *)servname, len + 1) < 0)
+        if (lwp_get_from_user(k_servname, (void *)servname, len + 1) != len + 1)
         {
             SET_ERRNO(EFAULT);
             goto exit;
@@ -140,45 +148,73 @@ sysret_t sys_getaddrinfo(const char *nodename,
     if (hints)
     {
 #ifdef ARCH_MM_MMU
-        if (!lwp_user_accessable((void *)hints, sizeof(*hints)))
+        if (lwp_get_from_user(&k_hints_musl, (void *)hints, sizeof(k_hints_musl)) != sizeof(k_hints_musl))
         {
             SET_ERRNO(EFAULT);
             goto exit;
         }
+#else
+        k_hints_musl = *hints;
 #endif
-        k_hints = (struct addrinfo *)rt_malloc(sizeof *hints);
+        k_hints = (struct addrinfo *)rt_malloc(sizeof(*k_hints));
         if (!k_hints)
         {
             SET_ERRNO(ENOMEM);
             goto exit;
         }
 
-        rt_memset(k_hints, 0x0, sizeof(struct addrinfo));
-        k_hints->ai_flags = hints->ai_flags;
-        k_hints->ai_family = hints->ai_family;
-        k_hints->ai_socktype = hints->ai_socktype;
-        k_hints->ai_protocol = hints->ai_protocol;
-        k_hints->ai_addrlen = hints->ai_addrlen;
+        rt_memset(k_hints, 0x0, sizeof(*k_hints));
+        k_hints->ai_flags = k_hints_musl.ai_flags;
+        k_hints->ai_family = k_hints_musl.ai_family;
+        k_hints->ai_socktype = k_hints_musl.ai_socktype;
+        k_hints->ai_protocol = k_hints_musl.ai_protocol;
+        k_hints->ai_addrlen = k_hints_musl.ai_addrlen;
     }
 
     ret = sal_getaddrinfo(k_nodename, k_servname, k_hints, &k_res);
     if (ret == 0)
     {
         /* set sockaddr */
-        sockaddr_tomusl(k_res->ai_addr, res->ai_addr);
-        res->ai_addrlen = k_res->ai_addrlen;
+        if (k_res->ai_addr && k_res_musl.ai_addr)
+        {
+#ifdef ARCH_MM_MMU
+            struct musl_sockaddr k_sockaddr;
+
+            sockaddr_tomusl(k_res->ai_addr, &k_sockaddr);
+            if (lwp_put_to_user(k_res_musl.ai_addr, &k_sockaddr, sizeof(k_sockaddr)) != sizeof(k_sockaddr))
+            {
+                SET_ERRNO(EFAULT);
+                ret = -1;
+                goto exit;
+            }
+#else
+            sockaddr_tomusl(k_res->ai_addr, k_res_musl.ai_addr);
+#endif
+        }
+        k_res_musl.ai_addrlen = k_res->ai_addrlen;
 
         /* set up addrinfo */
-        res->ai_family = k_res->ai_family;
-        res->ai_flags = k_res->ai_flags;
-        res->ai_next = NULL;
+        k_res_musl.ai_family = k_res->ai_family;
+        k_res_musl.ai_flags = k_res->ai_flags;
+        k_res_musl.ai_next = NULL;
 
         if (hints != NULL)
         {
             /* copy socktype & protocol from hints if specified */
-            res->ai_socktype = hints->ai_socktype;
-            res->ai_protocol = hints->ai_protocol;
+            k_res_musl.ai_socktype = k_hints_musl.ai_socktype;
+            k_res_musl.ai_protocol = k_hints_musl.ai_protocol;
+        }
+
+#ifdef ARCH_MM_MMU
+        if (lwp_put_to_user(res, &k_res_musl, sizeof(k_res_musl)) != sizeof(k_res_musl))
+        {
+            SET_ERRNO(EFAULT);
+            ret = -1;
+            goto exit;
         }
+#else
+        *res = k_res_musl;
+#endif
 
         sal_freeaddrinfo(k_res);
         k_res = NULL;
@@ -215,6 +251,10 @@ sysret_t sys_getaddrinfo(const char *nodename,
     {
         rt_free(k_hints);
     }
+    if (k_res)
+    {
+        sal_freeaddrinfo(k_res);
+    }
 
     return ret;
 }