From 7cd7e05ba4179ac3d73fe127c103083a648ae1c4 Mon Sep 17 00:00:00 2001
From: AFWEF_147 <olm_cse@hust.edu.cn>
Date: Mon, 23 Mar 2026 12:09:59 +0000
Subject: [PATCH] fix(lwp): validate thread priority in sched syscalls

---
 components/lwp/lwp_syscall.c | 26 ++++++++++++++++++++++++++
 src/scheduler_comm.c         |  2 +-
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/components/lwp/lwp_syscall.c b/components/lwp/lwp_syscall.c
index 6efc3a0e16..33c0cdfffd 100644
--- a/components/lwp/lwp_syscall.c
+++ b/components/lwp/lwp_syscall.c
@@ -8746,6 +8746,8 @@ sysret_t sys_sysinfo(void *info)
 #endif
 }
 
+static rt_bool_t _sys_sched_priority_is_valid(int priority);
+
 /**
  * @brief Set scheduling parameters for a specific thread.
  *
@@ -8785,6 +8787,12 @@ sysret_t sys_sched_setparam(pid_t tid, void *param)
         return -EINVAL;
     }
 
+    if (!_sys_sched_priority_is_valid(sched_param->sched_priority))
+    {
+        kmem_put(sched_param);
+        return -EINVAL;
+    }
+
     thread = lwp_tid_get_thread_and_inc_ref(tid);
 
     if (thread)
@@ -8915,6 +8923,18 @@ sysret_t sys_sched_get_priority_min(int policy)
     return 0;
 }
 
+static rt_bool_t _sys_sched_priority_is_valid(int priority)
+{
+    return (priority >= 0) && (priority < RT_THREAD_PRIORITY_MAX);
+}
+
+#if defined(RT_USING_UTESTCASES) && defined(RT_USING_SMART)
+rt_bool_t rt_utest_sys_sched_priority_is_valid(int priority)
+{
+    return _sys_sched_priority_is_valid(priority);
+}
+#endif
+
 /**
  * @brief Set the scheduling policy and parameters for a thread.
  *
@@ -8958,6 +8978,12 @@ sysret_t sys_sched_setscheduler(int tid, int policy, void *param)
         return -EINVAL;
     }
 
+    if (!_sys_sched_priority_is_valid(sched_param->sched_priority))
+    {
+        kmem_put(sched_param);
+        return -EINVAL;
+    }
+
     thread = lwp_tid_get_thread_and_inc_ref(tid);
     ret = rt_thread_control(thread, RT_THREAD_CTRL_RESET_PRIORITY, (void *)&sched_param->sched_priority);
     lwp_tid_dec_ref(thread);
diff --git a/src/scheduler_comm.c b/src/scheduler_comm.c
index e68c2a17d3..bd51e16777 100644
--- a/src/scheduler_comm.c
+++ b/src/scheduler_comm.c
@@ -523,4 +523,4 @@ void rt_scheduler_stack_check(struct rt_thread *thread)
 #endif /* ARCH_CPU_STACK_GROWS_UPWARD */
 }
 
-#endif /* RT_USING_OVERFLOW_CHECK */
\ No newline at end of file
+#endif /* RT_USING_OVERFLOW_CHECK */