[PATCH] scftorture: reject zero worker threads

[PATCH] scftorture: reject zero worker threads

[Samuel Moelius]

scftorture accepts nthreads=0. That value skips worker creation, but
module initialization can still create the stats thread when
stat_interval is positive.

Cleanup then tests "nthreads && scf_stats_p" before stopping the stats
task. With nthreads=0, cleanup jumps to the end and leaves the stats
task running after rmmod has returned.

Reject nthreads=0 before allocating state or creating helper threads.
Negative values still retain the existing default-to-online-CPUs
behavior.

Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
---
 kernel/scftorture.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/scftorture.c b/kernel/scftorture.c
index 327c315f411c..b190d9ff5157 100644
--- a/kernel/scftorture.c
+++ b/kernel/scftorture.c
@@ -661,6 +661,11 @@ static int __init scf_torture_init(void)
 	// Worker tasks invoking smp_call_function().
 	if (nthreads < 0)
 		nthreads = num_online_cpus();
+	if (nthreads == 0) {
+		SCFTORTOUT_ERRSTRING("nthreads must be positive");
+		firsterr = -EINVAL;
+		goto unwind;
+	}
 	scf_stats_p = kzalloc_objs(scf_stats_p[0], nthreads);
 	if (!scf_stats_p) {
 		SCFTORTOUT_ERRSTRING("out of memory");
-- 
2.43.0

Re: [PATCH] scftorture: reject zero worker threads

[Kees Cook]

On Fri, Jun 05, 2026 at 06:30:23PM +0000, Samuel Moelius wrote:
> scftorture accepts nthreads=0. That value skips worker creation, but
> module initialization can still create the stats thread when
> stat_interval is positive.
> 
> Cleanup then tests "nthreads && scf_stats_p" before stopping the stats
> task. With nthreads=0, cleanup jumps to the end and leaves the stats
> task running after rmmod has returned.
> 
> Reject nthreads=0 before allocating state or creating helper threads.
> Negative values still retain the existing default-to-online-CPUs
> behavior.
> 
> Assisted-by: Codex:gpt-5.5-cyber-preview
> Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
> ---
>  kernel/scftorture.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/kernel/scftorture.c b/kernel/scftorture.c
> index 327c315f411c..b190d9ff5157 100644
> --- a/kernel/scftorture.c
> +++ b/kernel/scftorture.c
> @@ -661,6 +661,11 @@ static int __init scf_torture_init(void)
>  	// Worker tasks invoking smp_call_function().
>  	if (nthreads < 0)
>  		nthreads = num_online_cpus();
> +	if (nthreads == 0) {
> +		SCFTORTOUT_ERRSTRING("nthreads must be positive");

Maybe "cannot be zero"? (Negative is a valid option...)

> +		firsterr = -EINVAL;
> +		goto unwind;
> +	}
>  	scf_stats_p = kzalloc_objs(scf_stats_p[0], nthreads);
>  	if (!scf_stats_p) {
>  		SCFTORTOUT_ERRSTRING("out of memory");
> -- 
> 2.43.0
> 

-- 
Kees Cook