kern/60750: compat_linux: stack garbage mistakes

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60750
>Category:       kern
>Synopsis:       compat_linux: stack garbage mistakes
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Sep 20 11:05:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, ...
>Organization:
Stack Array Garbage Collectors LLC
>Environment:
>Description:

	1. linux_sys_setgroups16 tries to copy in an array of gid_t,
	   but doesn't scale it by sizeof(gid_t) = 2, so it copies on
	   only half the array and leaves the rest as stack garbage for
	   kauth_cred_setgroups:

    276 	linux_gid16_t lset[COMPAT_NGROUPS16];
    277 	kauth_cred_t ncred;
    278 	int error;
    279 	gid_t grbuf[COMPAT_NGROUPS16];
    280 	unsigned int i, ngroups = SCARG(uap, gidsetsize);
    281 
    282 	if (ngroups > COMPAT_NGROUPS16)
    283 		return EINVAL;
    284 	error = copyin(SCARG(uap, gidset), lset, ngroups);
    285 	if (error != 0)
    286 		return error;
    287 
    288 	for (i = 0; i < ngroups; i++)
    289 		grbuf[i] = lset[i];
    290 
    291 	ncred = kauth_cred_alloc();
    292 	error = kauth_cred_setgroups(ncred, grbuf, SCARG(uap, gidsetsize),
    293 	    -1, UIO_SYSSPACE);

	   https://nxr.netbsd.org/xref/src/sys/compat/linux/common/linux_uid16.c?r=1.4#276

	2. linux_sys___prctl calls sys___lwp_setname/getname with
	   incompletely initialized arguments, leaving the target lwp
	   id as stack garbage:

    800 	switch(c) {
    801 	case LINUX_PR_SET_NAME: {
    802 		struct sys__lwp_setname_args sls;
    803 		SCARG(&sls, name) = (char *) SCARG(uap, args[0]);
    804 		return sys__lwp_setname(l, &sls, retval);
    805 	}
    806 
    807 	case LINUX_PR_GET_NAME: {
    808 		struct sys__lwp_getname_args slg;
    809 		SCARG(&slg, name) = (char *) SCARG(uap, args[0]);
    810 		SCARG(&slg, len) = MAXCOMLEN;
    811 		return sys__lwp_getname(l, &slg, retval);
    812 		}

	   https://nxr.netbsd.org/xref/src/sys/compat/linux/common/linux_sched.c?r=1.87#800

   2117 struct sys__lwp_setname_args {
   2118 	syscallarg(lwpid_t) target;
   2119 	syscallarg(const char *) name;
   2120 };
...
   2125 struct sys__lwp_getname_args {
   2126 	syscallarg(lwpid_t) target;
   2127 	syscallarg(char *) name;
   2128 	syscallarg(size_t) len;
   2129 };

	   https://nxr.netbsd.org/xref/src/sys/sys/syscallargs.h?r=1.313#2117

>How-To-Repeat:

	code inspection

>Fix:

	1. scale by sizeof array element
	2. memset zero