NetBSD Problem Report #60750

From www@netbsd.org  Sun Sep 20 11:01:17 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 8F1711A923B
	for <gnats-bugs@gnats.NetBSD.org>; Sun, 20 Sep 2026 11:01:17 +0000 (UTC)
Message-Id: <20260920110116.820E61A923C@mollari.NetBSD.org>
Date: Sun, 20 Sep 2026 11:01:16 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: compat_linux: stack garbage mistakes
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60750
>Category:       kern
>Synopsis:       compat_linux: stack garbage mistakes
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Sep 20 11:05:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Sun Sep 27 00:03:20 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, ...
>Organization:
Stack Array Garbage Collectors LLC
>Environment:
>Description:

	1. linux_sys_setgroups16 tries to copy in an array of gid_t,
	   but doesn't scale it by sizeof(gid_t) = 2, so it copies on
	   only half the array and leaves the rest as stack garbage for
	   kauth_cred_setgroups:

    276 	linux_gid16_t lset[COMPAT_NGROUPS16];
    277 	kauth_cred_t ncred;
    278 	int error;
    279 	gid_t grbuf[COMPAT_NGROUPS16];
    280 	unsigned int i, ngroups = SCARG(uap, gidsetsize);
    281 
    282 	if (ngroups > COMPAT_NGROUPS16)
    283 		return EINVAL;
    284 	error = copyin(SCARG(uap, gidset), lset, ngroups);
    285 	if (error != 0)
    286 		return error;
    287 
    288 	for (i = 0; i < ngroups; i++)
    289 		grbuf[i] = lset[i];
    290 
    291 	ncred = kauth_cred_alloc();
    292 	error = kauth_cred_setgroups(ncred, grbuf, SCARG(uap, gidsetsize),
    293 	    -1, UIO_SYSSPACE);

	   https://nxr.netbsd.org/xref/src/sys/compat/linux/common/linux_uid16.c?r=1.4#276

	2. linux_sys___prctl calls sys___lwp_setname/getname with
	   incompletely initialized arguments, leaving the target lwp
	   id as stack garbage:

    800 	switch(c) {
    801 	case LINUX_PR_SET_NAME: {
    802 		struct sys__lwp_setname_args sls;
    803 		SCARG(&sls, name) = (char *) SCARG(uap, args[0]);
    804 		return sys__lwp_setname(l, &sls, retval);
    805 	}
    806 
    807 	case LINUX_PR_GET_NAME: {
    808 		struct sys__lwp_getname_args slg;
    809 		SCARG(&slg, name) = (char *) SCARG(uap, args[0]);
    810 		SCARG(&slg, len) = MAXCOMLEN;
    811 		return sys__lwp_getname(l, &slg, retval);
    812 		}

	   https://nxr.netbsd.org/xref/src/sys/compat/linux/common/linux_sched.c?r=1.87#800

   2117 struct sys__lwp_setname_args {
   2118 	syscallarg(lwpid_t) target;
   2119 	syscallarg(const char *) name;
   2120 };
...
   2125 struct sys__lwp_getname_args {
   2126 	syscallarg(lwpid_t) target;
   2127 	syscallarg(char *) name;
   2128 	syscallarg(size_t) len;
   2129 };

	   https://nxr.netbsd.org/xref/src/sys/sys/syscallargs.h?r=1.313#2117

>How-To-Repeat:

	code inspection

>Fix:

	1. scale by sizeof array element
	2. memset zero

>Release-Note:

>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60750 CVS commit: src/sys/compat/linux/common
Date: Sun, 20 Sep 2026 13:41:23 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sun Sep 20 13:41:23 UTC 2026

 Modified Files:
 	src/sys/compat/linux/common: linux_uid16.c

 Log Message:
 compat_linux setgroups16(2): Fix array copyin sizing.

 PR kern/60750: compat_linux: stack garbage mistakes


 To generate a diff of this commit:
 cvs rdiff -u -r1.4 -r1.5 src/sys/compat/linux/common/linux_uid16.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60750 CVS commit: src/sys/compat/linux/common
Date: Sun, 20 Sep 2026 13:41:53 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sun Sep 20 13:41:52 UTC 2026

 Modified Files:
 	src/sys/compat/linux/common: linux_sched.c

 Log Message:
 compat_linux __prctl(2): Use self, not stack garbage lwpid.

 PR kern/60750: compat_linux: stack garbage mistakes


 To generate a diff of this commit:
 cvs rdiff -u -r1.87 -r1.88 src/sys/compat/linux/common/linux_sched.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60750 CVS commit: src/sys/compat
Date: Sun, 20 Sep 2026 13:43:52 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sun Sep 20 13:43:52 UTC 2026

 Modified Files:
 	src/sys/compat/linux/arch/alpha: linux_machdep.c
 	src/sys/compat/linux/arch/arm: linux_machdep.c
 	src/sys/compat/linux/arch/i386: linux_machdep.c
 	src/sys/compat/linux/arch/m68k: linux_machdep.c
 	src/sys/compat/linux/arch/powerpc: linux_machdep.c
 	src/sys/compat/linux/common: linux_file.c linux_file64.c
 	    linux_inotify.c linux_ioctl.c linux_ipc.c linux_ipccall.c
 	    linux_misc.c linux_misc_notalpha.c linux_mqueue.c linux_oldmmap.c
 	    linux_sched.c linux_signal.c linux_socket.c linux_termios.c
 	    linux_time.c linux_uid16.c
 	src/sys/compat/linux32/common: linux32_dirent.c linux32_fcntl.c
 	    linux32_ioctl.c linux32_ipccall.c linux32_misc.c linux32_mman.c
 	    linux32_resource.c linux32_sched.c linux32_signal.c
 	    linux32_socket.c linux32_termios.c linux32_time.c linux32_uid16.c
 	    linux32_unistd.c linux32_wait.c

 Log Message:
 compat_linux, compat_linux32: Always zero syscall args on stack.

 This is an attempt to systematically eliminate a class of stack
 garbage bugs:

 PR kern/60750: compat_linux: stack garbage mistakes


 To generate a diff of this commit:
 cvs rdiff -u -r1.52 -r1.53 src/sys/compat/linux/arch/alpha/linux_machdep.c
 cvs rdiff -u -r1.34 -r1.35 src/sys/compat/linux/arch/arm/linux_machdep.c
 cvs rdiff -u -r1.169 -r1.170 src/sys/compat/linux/arch/i386/linux_machdep.c
 cvs rdiff -u -r1.45 -r1.46 src/sys/compat/linux/arch/m68k/linux_machdep.c
 cvs rdiff -u -r1.51 -r1.52 src/sys/compat/linux/arch/powerpc/linux_machdep.c
 cvs rdiff -u -r1.136 -r1.137 src/sys/compat/linux/common/linux_file.c
 cvs rdiff -u -r1.68 -r1.69 src/sys/compat/linux/common/linux_file64.c
 cvs rdiff -u -r1.8 -r1.9 src/sys/compat/linux/common/linux_inotify.c
 cvs rdiff -u -r1.60 -r1.61 src/sys/compat/linux/common/linux_ioctl.c \
     src/sys/compat/linux/common/linux_ipc.c
 cvs rdiff -u -r1.37 -r1.38 src/sys/compat/linux/common/linux_ipccall.c
 cvs rdiff -u -r1.267 -r1.268 src/sys/compat/linux/common/linux_misc.c
 cvs rdiff -u -r1.115 -r1.116 \
     src/sys/compat/linux/common/linux_misc_notalpha.c
 cvs rdiff -u -r1.2 -r1.3 src/sys/compat/linux/common/linux_mqueue.c
 cvs rdiff -u -r1.74 -r1.75 src/sys/compat/linux/common/linux_oldmmap.c
 cvs rdiff -u -r1.88 -r1.89 src/sys/compat/linux/common/linux_sched.c
 cvs rdiff -u -r1.91 -r1.92 src/sys/compat/linux/common/linux_signal.c
 cvs rdiff -u -r1.162 -r1.163 src/sys/compat/linux/common/linux_socket.c
 cvs rdiff -u -r1.39 -r1.40 src/sys/compat/linux/common/linux_termios.c
 cvs rdiff -u -r1.42 -r1.43 src/sys/compat/linux/common/linux_time.c
 cvs rdiff -u -r1.5 -r1.6 src/sys/compat/linux/common/linux_uid16.c
 cvs rdiff -u -r1.20 -r1.21 src/sys/compat/linux32/common/linux32_dirent.c
 cvs rdiff -u -r1.11 -r1.12 src/sys/compat/linux32/common/linux32_fcntl.c
 cvs rdiff -u -r1.15 -r1.16 src/sys/compat/linux32/common/linux32_ioctl.c
 cvs rdiff -u -r1.12 -r1.13 src/sys/compat/linux32/common/linux32_ipccall.c
 cvs rdiff -u -r1.34 -r1.35 src/sys/compat/linux32/common/linux32_misc.c
 cvs rdiff -u -r1.8 -r1.9 src/sys/compat/linux32/common/linux32_mman.c
 cvs rdiff -u -r1.13 -r1.14 src/sys/compat/linux32/common/linux32_resource.c \
     src/sys/compat/linux32/common/linux32_wait.c
 cvs rdiff -u -r1.9 -r1.10 src/sys/compat/linux32/common/linux32_sched.c
 cvs rdiff -u -r1.24 -r1.25 src/sys/compat/linux32/common/linux32_signal.c
 cvs rdiff -u -r1.32 -r1.33 src/sys/compat/linux32/common/linux32_socket.c
 cvs rdiff -u -r1.16 -r1.17 src/sys/compat/linux32/common/linux32_termios.c
 cvs rdiff -u -r1.40 -r1.41 src/sys/compat/linux32/common/linux32_time.c
 cvs rdiff -u -r1.2 -r1.3 src/sys/compat/linux32/common/linux32_uid16.c
 cvs rdiff -u -r1.44 -r1.45 src/sys/compat/linux32/common/linux32_unistd.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Sun, 27 Sep 2026 00:03:20 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11, pullup-10


>Unformatted:

Home	PR Database Search