[PATCH] tracing: Fix crash passing ERR_PTR to kthread_stop()

[PATCH] tracing: Fix crash passing ERR_PTR to kthread_stop()

[Hui Su]

event_test_stuff() calls kthread_run() and unconditionally passes the
returned task_struct pointer to kthread_stop(). kthread_run() returns an
error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for
example under memory pressure during the boot-time event self-test.
kthread_stop() then dereferences the invalid pointer, crashing the
kernel.

Check IS_ERR() on the result of kthread_run() before passing it to
kthread_stop(), matching the ring-buffer self-test fix in commit
91542863abad ("ring-buffer: Fix crash passing ERR_PTR to kthread_stop()").

Fixes: e6187007d6c3 ("tracing/events: add startup tests for events")
Cc: stable@vger.kernel.org
Signed-off-by: Hui Su <sh_def@163.com>
---
 kernel/trace/trace_events.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 3650d84d4f16..d21564733b4a 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -4901,6 +4901,8 @@ static __init void event_test_stuff(void)
 	struct task_struct *test_thread;
 
 	test_thread = kthread_run(event_test_thread, NULL, "test-events");
+	if (IS_ERR(test_thread))
+		return;
 	msleep(1);
 	kthread_stop(test_thread);
 }
-- 
2.54.0

Re: [PATCH] tracing: Fix crash passing ERR_PTR to kthread_stop()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Silent Test Bypass
--

--- Patch [1]: [PATCH] tracing: Fix crash passing ERR_PTR to kthread_stop() ---
commit 40985725587eec80dcbbfbf251d18cd9797fe26c
Author: Hui Su <sh_def@163.com>

    tracing: Fix crash passing ERR_PTR to kthread_stop()

    event_test_stuff() calls kthread_run() and unconditionally passes the
    returned task_struct pointer to kthread_stop(). kthread_run() returns an
    error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for
    example under memory pressure during the boot-time event self-test.
    kthread_stop() then dereferences the invalid pointer, crashing the
    kernel.

> diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
> index 0356cae0cf74e..207f47f54dbbf 100644
> --- a/kernel/trace/trace_events.c
> +++ b/kernel/trace/trace_events.c
> @@ -3866,6 +3866,8 @@ static __init void event_test_stuff(void)
>  	struct task_struct *test_thread;
>  
>  	test_thread = kthread_run(event_test_thread, NULL, "test-events");
> +	if (IS_ERR(test_thread))
> +		return;

[Severity: Medium]
Does returning silently here cause the self-test framework to falsely report
success when the workload thread cannot be created?

The caller event_trace_self_tests() unconditionally prints "OK" after calling
this function:

kernel/trace/trace_events.c:event_trace_self_tests() {
        ...
		ftrace_event_enable_disable(file, 1);
		event_test_stuff();
		ftrace_event_enable_disable(file, 0);

		pr_cont("OK\n");
	}
        ...
}

Should event_test_stuff() propagate the error so that the caller can correctly
report the test failure or skip it appropriately?

>  	msleep(1);
>  	kthread_stop(test_thread);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260815190151.568893-4-sh_def@163.com?part=1

Re: [PATCH] tracing: Fix crash passing ERR_PTR to kthread_stop()

[Steven Rostedt]

On Sat, 15 Aug 2026 19:10:34 +0000
sashiko-bot@kernel.org wrote:

> > diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
> > index 0356cae0cf74e..207f47f54dbbf 100644
> > --- a/kernel/trace/trace_events.c
> > +++ b/kernel/trace/trace_events.c
> > @@ -3866,6 +3866,8 @@ static __init void event_test_stuff(void)
> >  	struct task_struct *test_thread;
> >  
> >  	test_thread = kthread_run(event_test_thread, NULL, "test-events");
> > +	if (IS_ERR(test_thread))
> > +		return;  
> 
> [Severity: Medium]
> Does returning silently here cause the self-test framework to falsely report
> success when the workload thread cannot be created?
> 
> The caller event_trace_self_tests() unconditionally prints "OK" after calling
> this function:
> 
> kernel/trace/trace_events.c:event_trace_self_tests() {
>         ...
> 		ftrace_event_enable_disable(file, 1);
> 		event_test_stuff();
> 		ftrace_event_enable_disable(file, 0);
> 
> 		pr_cont("OK\n");
> 	}
>         ...
> }
> 
> Should event_test_stuff() propagate the error so that the caller can correctly
> report the test failure or skip it appropriately?

Right, this is just a boot up test that is only done for debugging.
This is not something for production. If it fails, it should not fail
silently. If anything, it should be:

	if (WARN_ON(IS_ERR(test_thread))
		return;

-- Steve