sched: fix 1-byte overflow in prctl(PR_GET_NAME)

[Junbo-Zheng]

Summary

The documented caller contract for prctl(PR_GET_NAME) is a buffer of CONFIG_TASK_NAME_SIZE bytes, NUL included (include/sys/prctl.h shows char myname[CONFIG_TASK_NAME_SIZE] as the usage example). However, the implementation passed sizeof(tcb->name), i.e. CONFIG_TASK_NAME_SIZE + 1, to strlcpy():

strlcpy(name, tcb->name, sizeof(tcb->name));
name[CONFIG_TASK_NAME_SIZE - 1] = '\0';

tcb->name is char[CONFIG_TASK_NAME_SIZE + 1] and normally holds exactly CONFIG_TASK_NAME_SIZE characters after nxtask_setup_name() truncation. In that case strlcpy() copies all of them and writes its terminating NUL at name[CONFIG_TASK_NAME_SIZE] -- one byte past the caller's buffer. The forced-NUL line below it is a leftover from the strncpy era and ran after the overflow had already happened.

The fix passes CONFIG_TASK_NAME_SIZE to strlcpy() so the copy is truncated in bounds (at most CONFIG_TASK_NAME_SIZE - 1 characters plus NUL), and drops the stale forced-NUL line.

Impact

• Users: fixes a 1-byte out-of-bounds stack write for any caller that follows the documented buffer size when querying a task whose name was truncated to exactly CONFIG_TASK_NAME_SIZE characters. The returned name is now truncated to CONFIG_TASK_NAME_SIZE - 1 characters plus NUL, matching the documented contract and Linux behavior.
• Build: None.
• Hardware: None -- plain libc-level fix, no board specifics.
• Documentation: None -- the code now matches the existing contract documented in include/sys/prctl.h.
• Security & Compatibility: closes a memory-corruption defect (single NUL byte written past a caller-provided buffer). No API change.

Testing

Simulated (sim:nsh host build on Ubuntu x86-64, CONFIG_TASK_NAME_SIZE=31).

Build and run:

cmake -B build -DBOARD_CONFIG=sim:nsh -GNinja
cmake --build build -j$(nproc)
echo hello | ./build/nuttx

then run "hello" at the NSH prompt.

The test was carried by apps/examples/hello/hello_main.c (scratch only, not part of this PR); its diff:

--- a/examples/hello/hello_main.c
+++ b/examples/hello/hello_main.c
@@ -24,6 +24,8 @@

 #include <nuttx/config.h>
 #include <stdio.h>
+#include <string.h>
+#include <sys/prctl.h>

 /****************************************************************************
  * Public Functions
@@ -35,6 +37,55 @@

 int main(int argc, FAR char *argv[])
 {
+  /* Longest-legal task name: exactly CONFIG_TASK_NAME_SIZE chars, the
+   * normal result of nxtask_setup_name() truncation.
+   */
+
+  static const char longname[] =
+    "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
+
+  /* Caller buffer per the documented prctl(PR_GET_NAME) contract, with a
+   * guard byte immediately after it to detect the 1-byte overflow.
+   */
+
+  struct
+    {
+      char buf[CONFIG_TASK_NAME_SIZE];
+      volatile unsigned char guard;
+    } s;
+
+  _Static_assert(sizeof(longname) - 1 > CONFIG_TASK_NAME_SIZE,
+                 "test name must exceed CONFIG_TASK_NAME_SIZE");
+
   printf("Hello, World!!\n");
+  printf("prctl test: CONFIG_TASK_NAME_SIZE=%d\n", CONFIG_TASK_NAME_SIZE);
+
+  s.guard = 0xaa;
+  s.buf[0] = '\0';
+
+  if (prctl(PR_SET_NAME, (unsigned long)longname) != 0)
+    {
+      printf("prctl test: PR_SET_NAME failed\n");
+      return 1;
+    }
+
+  if (prctl(PR_GET_NAME, (unsigned long)s.buf) != 0)
+    {
+      printf("prctl test: PR_GET_NAME failed\n");
+      return 1;
+    }
+
+  printf("prctl test: guard=0x%02x (expected 0xaa), name len=%zu, "
+         "last char=0x%02x\n",
         s.guard, strlen(s.buf), (unsigned char)s.buf[strlen(s.buf)]);
+
+  if (s.guard != 0xaa)
+    {
+      printf("prctl test: FAIL - terminating NUL written 1 byte past "
+             "the caller buffer\n");
+      return 1;
+    }
+
+  printf("prctl test: PASS - caller buffer intact\n");
   return 0;
 }

Before the fix:

prctl test: CONFIG_TASK_NAME_SIZE=31
prctl test: guard=0x00 (expected 0xaa), name len=30, last char=0x00
prctl test: FAIL - terminating NUL written 1 byte past the caller buffer

After the fix:

prctl test: CONFIG_TASK_NAME_SIZE=31
prctl test: guard=0xaa (expected 0xaa), name len=30, last char=0x00
prctl test: PASS - caller buffer intact

The before/after outputs were reproduced independently in this session on the unfixed base (origin/master) and on this branch.

Signed-off-by: Junbo Zheng zhengjunbo1@xiaomi.com

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• arduino-mega2560
• esp32-devkitc
• hifive1-revb
• mirtoo
• qemu-armv8a
• qemu-intel64
• rx65n-rsk2mb
• s698pm-dkit
• stm32-nucleo-f103rb