NetBSD Problem Report #60949

From www@netbsd.org  Sun Nov  1 12:38:47 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 3569C1A923B
	for <gnats-bugs@gnats.NetBSD.org>; Sun,  1 Nov 2026 12:38:47 +0000 (UTC)
Message-Id: <20261101123845.C578D1A923C@mollari.NetBSD.org>
Date: Sun,  1 Nov 2026 12:38:45 +0000 (UTC)
From: jonasboettiger@icloud.com
Reply-To: jonasboettiger@icloud.com
To: gnats-bugs@NetBSD.org
Subject: pthread_getname_np can write to empty buffer if there is no thread name
X-Send-Pr-Version: www-1.0
X-From4GNATS: "jonasboettiger@icloud.com via gnats" <gnats-admin@NetBSD.org>

>Number:         60949
>Category:       lib
>Synopsis:       pthread_getname_np can write to empty buffer if there is no thread name
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    kre
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Nov 01 12:40:01 +0000 2026
>Closed-Date:    Sun Nov 01 18:09:07 +0000 2026
>Last-Modified:  Sun Nov 01 18:09:07 +0000 2026
>Originator:     Jonas Böttiger
>Release:        current
>Organization:
Rust library team
>Environment:
>Description:
pthread_getname_np does not check whether the buffer is zero-sized before writing a NUL-terminator in the case where there is no thread name (https://github.com/NetBSD/src/blob/26c769bcf6ba2f6cf94679a4a745730efccacc3e/lib/libpthread/pthread.c#L819), resulting in undefined behaviour if passing a zero-sized buffer to pthread_getname_np.

I discovered this while working on miri support for NetBSD (see https://github.com/rust-lang/miri/pull/5109). In all likelihood this is only of theoretical concern, but it is something other BSDs avoid: https://cgit.freebsd.org/src/tree/lib/libthr/thread/thr_info.c#n139.
>How-To-Repeat:

>Fix:
Passing a zero length should be either be documented as undefined behaviour, or pthread_getname_np should check for that condition and not write a NUL terminator.

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: lib-bug-people->kre
Responsible-Changed-By: kre@NetBSD.org
Responsible-Changed-When: Sun, 01 Nov 2026 18:00:25 +0000
Responsible-Changed-Why:
I will fix this one.   It turns out that pthread_attr_getname_np(3) has the same issue,
so I will fix that as well.

In each case a len of 0 will become an error (which according to the man page would
be the only error possible from pthread_attr_getname_np(3) - but that was always
wrong, an invalid "attr" arg already returned EINVAL - so that man page needs an
update as well).

Since one could argue that any application which gives 0 as the length of the buffer
for either of those functions deserves whatever befalls it, and no sane application
ever would, I doubt this really needs pulling up to the released versions.


From: "Robert Elz" <kre@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60949 CVS commit: src/lib/libpthread
Date: Sun, 1 Nov 2026 18:04:18 +0000

 Module Name:	src
 Committed By:	kre
 Date:		Sun Nov  1 18:04:17 UTC 2026

 Modified Files:
 	src/lib/libpthread: pthread.c pthread_attr.c pthread_attr_getname_np.3

 Log Message:
 PR lib/60949 pthread*_getname_np(3) - avoid UB if len == 0

 Just make len == 0 be an EINVAL error.

 Update pthread_attr_getname_np(3) man page, so it no longer says
 there are no errors from pthread_attr_getname_np() - which was wrong
 in any case, as there was already one (if attr is invalid), and
 while there, one minor grammar fix.

 No pullups currently planned.


 To generate a diff of this commit:
 cvs rdiff -u -r1.196 -r1.197 src/lib/libpthread/pthread.c
 cvs rdiff -u -r1.22 -r1.23 src/lib/libpthread/pthread_attr.c
 cvs rdiff -u -r1.7 -r1.8 src/lib/libpthread/pthread_attr_getname_np.3

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: kre@NetBSD.org
State-Changed-When: Sun, 01 Nov 2026 18:09:07 +0000
State-Changed-Why:
Fixed in head.   Thanks for the PR.


>Unformatted:

Home	PR Database Search