mem: guard rt_smem_setname() against a NULL name#11598
Conversation
rt_smem_setname() dereferenced name[index] without checking for NULL first. Some callers legitimately pass an unnamed allocation through with a NULL name, which crashed instead of just leaving the trace field blank. Treat a NULL name the same as an empty string, so the existing fill-with-spaces loop below handles it without duplicating that logic. Fixes RT-Thread#9793 Signed-off-by: yi chen <94xhn1@gmail.com>
|
yi chen seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account. You have signed the CLA already but the status is still pending? Let us recheck it. |
|
👋 感谢您对 RT-Thread 的贡献!Thank you for your contribution to RT-Thread! 为确保代码符合 RT-Thread 的编码规范,请在你的仓库中执行以下步骤运行代码格式化工作流(如果格式化CI运行失败)。 🛠 操作步骤 | Steps
完成后,提交将自动更新至 如有问题欢迎联系我们,再次感谢您的贡献!💐 |
📌 Code Review Assignment🏷️ Tag: kernelReviewers: @GorrayLi @ReviewSun @hamburger-os @lianux-mm @wdfk-prog @xu18838022837 Changed Files (Click to expand)
📊 Current Review Status (Last Updated: 2026-07-09 12:10 CST)
📝 Review Instructions
|
为什么提交这份PR (why to submit this PR)
Fixes #9793.
rt_smem_setname()insrc/mem.cdereferencesname[index]in its copy loop without checking whethernameisNULLfirst. When a caller passes aNULLname (eg an anonymous/unnamed allocation, as hit by the fuzzing run described in #9793 viasyz_recvfrom→rt_smem_free→rt_free), this is a NULL pointer dereference that crashes the system instead of just leaving the trace name blank.你的解决方案是什么 (what is your solution)
Treat a
NULLname the same as an empty string before the existing copy loop runs, so the already-present "fill remaining space with spaces" loop below it handles the whole thing without needing a separate NULL-specific code path (the issue's own suggested patch duplicates that fill-with-spaces loop; this reuses it instead):请提供验证的bsp和config (provide the config and bsp)
CONFIG_RT_USING_MEMTRACE=y(this function only exists underRT_USING_MEMTRACE)rt_smem_setname()insrc/mem.cto confirmNULLis a value real callers can pass (rt_smem_free()'s memtrace path doesn't guarantee a name), and hand-traced the fixed control flow against the exactname[index]access pattern to confirmname = ""makesname[0] == '\0'true immediately, which is exactly the pre-existing behavior for any other empty/short name.当前拉取/合并请求的状态 Intent for your PR
必须选择一项 Choose one (Mandatory):
代码质量 Code Quality:
我在这个拉取/合并请求中已经考虑了 As part of this pull request, I've considered the following:
#if 0代码,不包含已经被注释了的代码 All redundant code is removed and cleaned up