From 09d17543c3194ee68f2f2576a98d0db1f37de16d Mon Sep 17 00:00:00 2001 From: Tao Cui Date: Wed, 14 Oct 2026 21:13:20 +0800 Subject: selftests/sched_ext: Fix reload_loop error-path use-after-free If the second pthread_create() fails, run() returns and the runner calls cleanup, which destroys the skeleton while the first reload thread is still running do_reload_loop() and dereferencing its maps - a use-after-free on the error path. Set force_exit and join the first thread before failing. Signed-off-by: Tao Cui Signed-off-by: Tejun Heo --- tools/testing/selftests/sched_ext/reload_loop.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'tools') diff --git a/tools/testing/selftests/sched_ext/reload_loop.c b/tools/testing/selftests/sched_ext/reload_loop.c index 49297b83d748..a00f3964dba0 100644 --- a/tools/testing/selftests/sched_ext/reload_loop.c +++ b/tools/testing/selftests/sched_ext/reload_loop.c @@ -53,7 +53,11 @@ static enum scx_test_status run(void *ctx) SCX_FAIL_IF(err, "Failed to create thread 0"); err = pthread_create(&threads[1], NULL, do_reload_loop, NULL); - SCX_FAIL_IF(err, "Failed to create thread 1"); + if (err) { + force_exit = true; + pthread_join(threads[0], NULL); + SCX_FAIL("Failed to create thread 1"); + } SCX_FAIL_IF(pthread_join(threads[0], &ret), "thread 0 failed"); SCX_FAIL_IF(pthread_join(threads[1], &ret), "thread 1 failed"); -- cgit v1.2.3