diff options
| author | Tao Cui <cuitao@kylinos.cn> | 2026-10-14 21:13:20 +0800 |
|---|---|---|
| committer | Tejun Heo <tj@kernel.org> | 2026-10-14 08:13:25 -1000 |
| commit | 09d17543c3194ee68f2f2576a98d0db1f37de16d (patch) | |
| tree | f74e2a5f1295fc2bf30e7e7cc4da36abaeb3fa1f | |
| parent | a5ba5c61951dc00d296c79e96f0259b87861ce8c (diff) | |
| download | linux-next-09d17543c3194ee68f2f2576a98d0db1f37de16d.tar.gz linux-next-09d17543c3194ee68f2f2576a98d0db1f37de16d.zip | |
selftests/sched_ext: Fix reload_loop error-path use-after-free
If the second pthread_create() fails, run() returns and the runner
calls cleanup, which destroys the skeleton while the first reload
thread is still running do_reload_loop() and dereferencing its maps -
a use-after-free on the error path.
Set force_exit and join the first thread before failing.
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
| -rw-r--r-- | tools/testing/selftests/sched_ext/reload_loop.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/tools/testing/selftests/sched_ext/reload_loop.c b/tools/testing/selftests/sched_ext/reload_loop.c index 49297b83d748..a00f3964dba0 100644 --- a/tools/testing/selftests/sched_ext/reload_loop.c +++ b/tools/testing/selftests/sched_ext/reload_loop.c @@ -53,7 +53,11 @@ static enum scx_test_status run(void *ctx) SCX_FAIL_IF(err, "Failed to create thread 0"); err = pthread_create(&threads[1], NULL, do_reload_loop, NULL); - SCX_FAIL_IF(err, "Failed to create thread 1"); + if (err) { + force_exit = true; + pthread_join(threads[0], NULL); + SCX_FAIL("Failed to create thread 1"); + } SCX_FAIL_IF(pthread_join(threads[0], &ret), "thread 0 failed"); SCX_FAIL_IF(pthread_join(threads[1], &ret), "thread 1 failed"); |