From 125706443838fa29e78993aeb9992f3f608c381d Mon Sep 17 00:00:00 2001
From: wangyikai <wangyikai14@huawei.com>
Date: Fri, 11 Oct 2024 11:04:13 +0800
Subject: [PATCH] =?UTF-8?q?=E3=80=90HDF=5FCORE=E3=80=91=E5=90=91=E4=B8=9A?=
 =?UTF-8?q?=E5=8A=A1service=E5=88=86=E6=B4=BE=E6=B6=88=E6=81=AF=E6=97=B6?=
 =?UTF-8?q?=EF=BC=8C=E5=8A=A0=E9=94=81=E9=81=BF=E5=85=8Drelease=E9=80=A0?=
 =?UTF-8?q?=E6=88=90uaf?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: wangyikai <wangyikai14@huawei.com>
---
 adapter/uhdf2/host/BUILD.gn                        |  4 +++-
 adapter/uhdf2/host/src/device_service_stub.c       | 14 ++++++++++++++
 framework/core/host/src/hdf_device_node.c          | 12 ++++++++++++
 framework/core/host/src/hdf_device_object.c        |  6 ++++++
 interfaces/inner_api/host/shared/hdf_device_desc.h |  8 ++++++++
 5 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/adapter/uhdf2/host/BUILD.gn b/adapter/uhdf2/host/BUILD.gn
index 082140461..859bd4fd5 100644
--- a/adapter/uhdf2/host/BUILD.gn
+++ b/adapter/uhdf2/host/BUILD.gn
@@ -34,8 +34,10 @@ if (defined(ohos_lite)) {
   }
 } else {
   ohos_shared_library("libhdf_host") {
+    defines = [ "__USER__" ]
+
     if (target_cpu == "arm64" || target_cpu == "x86_64") {
-      defines = [ "__ARCH64__" ]
+      defines += [ "__ARCH64__" ]
     }
 
     public_configs = [ ":libhdf_host_public_config" ]
diff --git a/adapter/uhdf2/host/src/device_service_stub.c b/adapter/uhdf2/host/src/device_service_stub.c
index 55ac66fbc..51419c660 100644
--- a/adapter/uhdf2/host/src/device_service_stub.c
+++ b/adapter/uhdf2/host/src/device_service_stub.c
@@ -19,6 +19,9 @@
 #include "hdf_log.h"
 #include "hdf_sbuf.h"
 #include "osal_mem.h"
+#ifdef __USER__
+#include <pthread.h>
+#endif
 
 int DeviceServiceStubDispatch(
     struct HdfRemoteService *stub, int code, struct HdfSBuf *data, struct HdfSBuf *reply)
@@ -27,7 +30,14 @@ int DeviceServiceStubDispatch(
     struct IDeviceIoService *ioService = service->super.deviceObject.service;
     int ret = HDF_FAILURE;
 
+#ifdef __USER__
+    pthread_rwlock_rdlock(&service->super.deviceObject.mutex);
+#endif
+
     if (ioService == NULL) {
+#ifdef __USER__
+        pthread_rwlock_unlock(&service->super.deviceObject.mutex);
+#endif
         return HDF_FAILURE;
     }
 
@@ -39,6 +49,10 @@ int DeviceServiceStubDispatch(
     if (ioService->Dispatch != NULL) {
         ret = ioService->Dispatch(&client, code, data, reply);
     }
+
+#ifdef __USER__
+    pthread_rwlock_unlock(&service->super.deviceObject.mutex);
+#endif
     return ret;
 }
 
diff --git a/framework/core/host/src/hdf_device_node.c b/framework/core/host/src/hdf_device_node.c
index 6475b0991..063645e4b 100644
--- a/framework/core/host/src/hdf_device_node.c
+++ b/framework/core/host/src/hdf_device_node.c
@@ -20,6 +20,9 @@
 #include "hdf_log.h"
 #include "hdf_object_manager.h"
 #include "osal_mem.h"
+#ifdef __USER__
+#include <pthread.h>
+#endif
 #include "power_state_token.h"
 
 #define HDF_LOG_TAG device_node
@@ -186,7 +189,16 @@ static void HdfDeviceUnlaunchNode(struct HdfDeviceNode *devNode)
     }
 
     if (driverEntry != NULL && driverEntry->Release != NULL) {
+#ifdef __USER__
+        pthread_rwlock_wrlock(&devNode->deviceObject.mutex);
+#endif
+
         driverEntry->Release(&devNode->deviceObject);
+
+#ifdef __USER__
+        devNode->deviceObject.service = NULL;
+        pthread_rwlock_unlock(&devNode->deviceObject.mutex);
+#endif
     }
 
     if (devNode->servStatus) {
diff --git a/framework/core/host/src/hdf_device_object.c b/framework/core/host/src/hdf_device_object.c
index fed79048e..9f994454d 100644
--- a/framework/core/host/src/hdf_device_object.c
+++ b/framework/core/host/src/hdf_device_object.c
@@ -18,6 +18,9 @@
 #include "hdf_power_manager.h"
 #include "hdf_service_observer.h"
 #include "osal_mem.h"
+#ifdef __USER__
+#include <pthread.h>
+#endif
 #include "power_state_token.h"
 
 #define HDF_LOG_TAG device_object
@@ -168,6 +171,9 @@ bool HdfDeviceSetClass(struct HdfDeviceObject *deviceObject, DeviceClass deviceC
 void HdfDeviceObjectConstruct(struct HdfDeviceObject *deviceObject)
 {
     if (deviceObject != NULL) {
+#ifdef __USER__
+        pthread_rwlock_init(&deviceObject->mutex, NULL);
+#endif
 #ifdef LOSCFG_DRIVERS_HDF_CONFIG_MACRO
         deviceObject->deviceMatchAttr = NULL;
 #else
diff --git a/interfaces/inner_api/host/shared/hdf_device_desc.h b/interfaces/inner_api/host/shared/hdf_device_desc.h
index 8a924a1fb..6dc8c3ad3 100644
--- a/interfaces/inner_api/host/shared/hdf_device_desc.h
+++ b/interfaces/inner_api/host/shared/hdf_device_desc.h
@@ -33,6 +33,9 @@
 #include "hdf_io_service_if.h"
 #include "hdf_object.h"
 #include "hdf_sbuf.h"
+#ifdef __USER__
+#include <pthread.h>
+#endif
 
 #ifdef __cplusplus
 extern "C" {
@@ -102,6 +105,11 @@ struct HdfDeviceObject {
     DeviceClass deviceClass;
     /** Pointer to the private data of the device */
     void *priv;
+
+#ifdef __USER__
+    /** lock for service, guarantee the service is valid in HDF */
+    pthread_rwlock_t mutex;
+#endif
 };
 
 /**
-- 
Gitee