Skip to content

mem: guard rt_smem_setname() against a NULL name#11598

Open
94xhn wants to merge 1 commit into
RT-Thread:masterfrom
94xhn:fix-smem-setname-null-name
Open

mem: guard rt_smem_setname() against a NULL name#11598
94xhn wants to merge 1 commit into
RT-Thread:masterfrom
94xhn:fix-smem-setname-null-name

Conversation

@94xhn

@94xhn 94xhn commented Jul 9, 2026

Copy link
Copy Markdown

为什么提交这份PR (why to submit this PR)

Fixes #9793. rt_smem_setname() in src/mem.c dereferences name[index] in its copy loop without checking whether name is NULL first. When a caller passes a NULL name (eg an anonymous/unnamed allocation, as hit by the fuzzing run described in #9793 via syz_recvfromrt_smem_freert_free), this is a NULL pointer dereference that crashes the system instead of just leaving the trace name blank.

你的解决方案是什么 (what is your solution)

Treat a NULL name the same as an empty string before the existing copy loop runs, so the already-present "fill remaining space with spaces" loop below it handles the whole thing without needing a separate NULL-specific code path (the issue's own suggested patch duplicates that fill-with-spaces loop; this reuses it instead):

rt_inline void rt_smem_setname(struct rt_small_mem_item *mem, const char *name)
{
    int index;
    if (name == RT_NULL)
    {
        name = "";
    }

    for (index = 0; index < sizeof(mem->thread); index ++)
    {
        if (name[index] == '\0') break;
        mem->thread[index] = name[index];
    }
    ...

请提供验证的bsp和config (provide the config and bsp)

  • BSP: bsp/qemu-vexpress-a9
  • .config: CONFIG_RT_USING_MEMTRACE=y (this function only exists under RT_USING_MEMTRACE)
  • action: I wasn't able to produce a CI build link for this — Actions on my fork require a one-time manual "enable workflows" click in the GitHub web UI that I don't have access to as an AI agent, and a local ARM toolchain build via WSL hit sustained network throttling that made it impractical to finish in reasonable time. What I did verify: the fix is a 4-line, single-purpose change that funnels into the loop immediately below it, which already exists and is unit-tested only by this crash report; I traced every call site of rt_smem_setname() in src/mem.c to confirm NULL is a value real callers can pass (rt_smem_free()'s memtrace path doesn't guarantee a name), and hand-traced the fixed control flow against the exact name[index] access pattern to confirm name = "" makes name[0] == '\0' true immediately, which is exactly the pre-existing behavior for any other empty/short name.

当前拉取/合并请求的状态 Intent for your PR

必须选择一项 Choose one (Mandatory):

  • 本拉取/合并请求是一个成熟版本 This PR is mature, and ready to be integrated into the repo

代码质量 Code Quality:

我在这个拉取/合并请求中已经考虑了 As part of this pull request, I've considered the following:

  • 已经仔细查看过代码改动的对比 Already check the difference between PR and old code
  • 代码风格正确,包括缩进空格,命名及其他风格 Style guide is adhered to, including spacing, naming and other styles
  • 没有垃圾代码,代码尽量精简,不包含#if 0代码,不包含已经被注释了的代码 All redundant code is removed and cleaned up
  • 所有变更均有原因及合理的,并且不会影响到其他软件组件代码或BSP All modifications are justified and not affect other components or BSP
  • 对难懂代码均提供对应的注释 I've commented appropriately where code is tricky
  • 代码是高质量的 Code in this PR is of high quality
  • 已经使用formatting 等源码格式化工具确保格式符合RT-Thread代码规范 This PR complies with RT-Thread code specification
  • 如果是新增bsp, 已经添加ci检查到.github/ALL_BSP_COMPILE.json 详细请参考链接BSP自查

rt_smem_setname() dereferenced name[index] without checking for
NULL first. Some callers legitimately pass an unnamed allocation
through with a NULL name, which crashed instead of just leaving
the trace field blank.

Treat a NULL name the same as an empty string, so the existing
fill-with-spaces loop below handles it without duplicating that
logic.

Fixes RT-Thread#9793

Signed-off-by: yi chen <94xhn1@gmail.com>
@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.


yi chen seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You have signed the CLA already but the status is still pending? Let us recheck it.

@github-actions

github-actions Bot commented Jul 9, 2026

Copy link
Copy Markdown

👋 感谢您对 RT-Thread 的贡献!Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范,请在你的仓库中执行以下步骤运行代码格式化工作流(如果格式化CI运行失败)。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).


🛠 操作步骤 | Steps

  1. 前往 Actions 页面 | Go to the Actions page
    点击进入工作流 → | Click to open workflow →

  2. 点击 Run workflow | Click Run workflow

  • 设置需排除的文件/目录(目录请以"/"结尾)
    Set files/directories to exclude (directories should end with "/")
  • 将目标分支设置为 \ Set the target branch to:fix-smem-setname-null-name
  • 设置PR number为 \ Set the PR number to:11598
  1. 等待工作流完成 | Wait for the workflow to complete
    格式化后的代码将自动推送至你的分支。
    The formatted code will be automatically pushed to your branch.

完成后,提交将自动更新至 fix-smem-setname-null-name 分支,关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the fix-smem-setname-null-name branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们,再次感谢您的贡献!💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

@github-actions github-actions Bot added the Kernel PR has src relate code label Jul 9, 2026
@github-actions

github-actions Bot commented Jul 9, 2026

Copy link
Copy Markdown

📌 Code Review Assignment

🏷️ Tag: kernel

Reviewers: @GorrayLi @ReviewSun @hamburger-os @lianux-mm @wdfk-prog @xu18838022837

Changed Files (Click to expand)
  • src/mem.c

📊 Current Review Status (Last Updated: 2026-07-09 12:10 CST)


📝 Review Instructions

  1. 维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
    Maintainers can refresh the review status by clicking here: 🔄 Refresh Status

  2. 确认审核通过后评论 LGTM/lgtm
    Comment LGTM/lgtm after confirming approval

  3. PR合并前需至少一位维护者确认
    PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Kernel PR has src relate code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Null Pointer Dereference in rt_smem_setname Function Causes System Crash

2 participants