Re: [PATCH] selftests/nci: Fix out-of-bounds store on thread join

[Simon Horman <horms@kernel.org>]

On Fri, Sep 04, 2026 at 11:59:15AM +0200, Chris Gellermann wrote:
> The NCI test collects the exit status of its helper threads by passing
> the address of an int to pthread_join():
> 
> 	int status;
> 	...
> 	pthread_join(thread_t, (void **) &status);
> 
> pthread_join() stores a void pointer to the memory location. On 64-bit
> systems, a void pointer is wider than an int, so the store overruns the
> 4 bytes of space allocated on the stack for the integer and corrupts the
> adjacent stack. On our CHERI system, this caused a fault due to a
> capability bounds violation.
> 
> Fix this by introducing a helper that joins a thread through a void
> pointer and converts the result back to an integer, which is what the
> helper threads return.
> 
> While here, also fix the logic in disconnect_tag() if the helper thread
> creation failed. Previously, it would have joined a thread that was
> never created when pthread_create() failed.
> 
> Fixes: f595cf1242f3 ("selftests: Add nci suite")
> Signed-off-by: Chris Gellermann <christian.gellermann@codasip.com>

Reviewed-by: Simon Horman <horms@kernel.org>