Re: [PATCH 7/7] lib/tests: test_ratelimit: fix stress test thread lifecycle and leak

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Use-After-Free in kthread_stop() due to uncontrolled child thread exit
--

commit cb9c7c9c5b3cf7b61d434d8dc2e4e72ebc4cfd3a
Author: Jia He <justin.he@arm.com>

lib/tests: test_ratelimit: fix stress test thread lifecycle and leak

This commit changes the stress test to use kthread_create() and
wake_up_process() instead of kthread_run() to properly handle creation
failures. It adds an out_stop label to clean up successfully started
threads if a subsequent thread fails to start, and resets doneflag
before spawning threads.

> diff --git a/lib/tests/test_ratelimit.c b/lib/tests/test_ratelimit.c
> index 33cea5f3d28b2..64f26260c0d85 100644
> --- a/lib/tests/test_ratelimit.c
> +++ b/lib/tests/test_ratelimit.c
[ ... ]
> @@ -105,26 +105,44 @@ static void test_ratelimit_stress(struct kunit *test)
[ ... ]
>  	schedule_timeout_idle(stress_duration);
> +
> +out_stop:
>  	WRITE_ONCE(doneflag, 1);
> -	for (i = 0; i < n_stress_kthread; i++) {
> +	for (i = 0; i < n_started; i++) {
>  		kthread_stop(sktp[i].tp);

Could this trigger a use-after-free if the child threads exit before
kthread_stop() is called?

When WRITE_ONCE(doneflag, 1) is executed, the child threads running
test_ratelimit_stress_child() observe the flag and return, which invokes
do_exit() and drops the task_struct reference.

If a child thread exits completely before the parent loop reaches its
kthread_stop() call, kthread_stop() will attempt to access a freed
task_struct. This appears to affect both the new error path and the
normal teardown path.

Would it be safer for the parent to take an explicit reference via
get_task_struct() during creation and use kthread_stop_put(), or
alternatively, have the children spin on kthread_should_stop() instead
of exiting immediately on doneflag?
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260514050455.2954509-1-justin.he@arm.com?part=7