fix: 增强对LOS_ArchCopyToUser接口的安全防护

Close: #I61CLY
Signed-off-by: Nzhangdengyu <zhangdengyu2@huawei.com>
Change-Id: I0faf8e5849c24b108f290e483124f3edaf70ef50

kernel/base/vm/shm.c

@@ -604,7 +604,7 @@ INT32 ShmCtl(INT32 shmid, INT32 cmd, struct shmid_ds *buf)
 {
     struct shmIDSource *seg = NULL;
     INT32 ret = 0;
-    struct shm_info shmInfo;
+    struct shm_info shmInfo = { 0 };
     struct ipc_perm shm_perm;
 
     cmd = ((UINT32)cmd & ~IPC_64);

syscall/fs_syscall.c

@@ -1520,7 +1520,7 @@ ssize_t SysPread64(int fd, void *buf, size_t nbytes, off64_t offset)
     if (bufRet == NULL) {
         return -ENOMEM;
     }
-
+    (void)memset_s(bufRet, nbytes, 0, nbytes);
     ret = pread64(fd, (buf ? bufRet : NULL), nbytes, offset);
     if (ret < 0) {
         (void)LOS_MemFree(OS_SYS_MEM_ADDR, bufRet);

syscall/ipc_syscall.c

@@ -106,7 +106,8 @@ int SysMqNotify(mqd_t personal, const struct sigevent *sigev)
 int SysMqGetSetAttr(mqd_t mqd, const struct mq_attr *new, struct mq_attr *old)
 {
     int ret;
-    struct mq_attr knew, kold;
+    struct mq_attr knew;
+    struct mq_attr kold = { 0 };
 
     if (new != NULL) {
         ret = LOS_ArchCopyFromUser(&knew, new, sizeof(struct mq_attr));
@@ -256,7 +257,7 @@ int SysSigTimedWait(const sigset_t_l *setl, siginfo_t *info, const struct timesp
     sigset_t set;
     unsigned int tick;
     int retVal, ret;
-    siginfo_t infoIntr;
+    siginfo_t infoIntr = { 0 };
     struct timespec timeoutIntr;
 
     retVal = LOS_ArchCopyFromUser(&set, &(setl->sig[0]), sizeof(sigset_t));

syscall/misc_syscall.c

@@ -208,7 +208,7 @@ long SysSysconf(int name)
 int SysUgetrlimit(int resource, unsigned long long k_rlim[2])
 {
     int ret;
-    struct rlimit lim;
+    struct rlimit lim = { 0 };
 
     ret = getrlimit(resource, &lim);
     if (ret < 0) {

syscall/process_syscall.c

@@ -255,7 +255,7 @@ int SysSchedRRGetInterval(int pid, struct timespec *tp)
     int ret;
     SchedParam param = { 0 };
     time_t timeSlice = 0;
-    struct timespec tv;
+    struct timespec tv = { 0 };
     LosTaskCB *taskCB = NULL;
     LosProcessCB *processCB = NULL;