All of lore.kernel.org
 help / color / mirror / Atom feed
From: Tao Cui <cui.tao@linux.dev>
To: Tejun Heo <tj@kernel.org>
Cc: David Vernet <void@manifault.com>,
	Andrea Righi <arighi@nvidia.com>,
	Changwoo Min <changwoo@igalia.com>,
	sched-ext@lists.linux.dev, cui.tao@linux.dev,
	Tao Cui <cuitao@kylinos.cn>
Subject: [PATCH 1/5] selftests/sched_ext: Fix reload_loop error-path use-after-free
Date: Fri,  9 Oct 2026 21:41:00 +0800	[thread overview]
Message-ID: <20261009134104.296891-2-cui.tao@linux.dev> (raw)
In-Reply-To: <20261009134104.296891-1-cui.tao@linux.dev>

From: Tao Cui <cuitao@kylinos.cn>

If the second pthread_create() fails, run() returns and the runner
calls cleanup, which destroys the skeleton while the first reload
thread is still running do_reload_loop() and dereferencing its maps -
a use-after-free on the error path.

Set force_exit and join the first thread before failing.

Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 tools/testing/selftests/sched_ext/reload_loop.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/sched_ext/reload_loop.c b/tools/testing/selftests/sched_ext/reload_loop.c
index 49297b83d748..ecff86f59e6c 100644
--- a/tools/testing/selftests/sched_ext/reload_loop.c
+++ b/tools/testing/selftests/sched_ext/reload_loop.c
@@ -53,7 +53,11 @@ static enum scx_test_status run(void *ctx)
 	SCX_FAIL_IF(err, "Failed to create thread 0");
 
 	err = pthread_create(&threads[1], NULL, do_reload_loop, NULL);
-	SCX_FAIL_IF(err, "Failed to create thread 1");
+	if (err) {
+		force_exit = true;
+		pthread_join(threads[0], NULL);
+		SCX_FAIL_IF(err, "Failed to create thread 1");
+	}
 
 	SCX_FAIL_IF(pthread_join(threads[0], &ret), "thread 0 failed");
 	SCX_FAIL_IF(pthread_join(threads[1], &ret), "thread 1 failed");
-- 
2.53.0


  reply	other threads:[~2026-10-09 13:41 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-09 13:40 [PATCH 0/5] sched_ext: selftest infrastructure fixes Tao Cui
2026-10-09 13:41 ` Tao Cui [this message]
2026-10-09 13:41 ` [PATCH 2/5] sched_ext: Add SCX_ECODE_RSN_CGROUP_OFFLINE to user_exit_info.h Tao Cui
2026-10-09 13:41 ` [PATCH 3/5] selftests/sched_ext: Fail loudly when EXIT_KIND is missing from BTF Tao Cui
2026-10-09 13:54   ` sashiko-bot
2026-10-09 13:41 ` [PATCH 4/5] selftests/sched_ext: Add SCX_ASSERT_ALIVE and adopt it Tao Cui
2026-10-09 13:41 ` [PATCH 5/5] selftests/sched_ext: Bound exit waits and report reload_loop failures Tao Cui
2026-10-09 13:48   ` sashiko-bot
2026-10-12 23:56 ` [PATCH 0/5] sched_ext: selftest infrastructure fixes Tejun Heo

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261009134104.296891-2-cui.tao@linux.dev \
    --to=cui.tao@linux.dev \
    --cc=arighi@nvidia.com \
    --cc=changwoo@igalia.com \
    --cc=cuitao@kylinos.cn \
    --cc=sched-ext@lists.linux.dev \
    --cc=tj@kernel.org \
    --cc=void@manifault.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.