From: Lorenzo Stoakes <ljs@kernel.org>
To: Chris Gellermann <christian.gellermann@codasip.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
brauner@kernel.org, shuah@kernel.org, david@kernel.org,
liam@infradead.org, vbabka@kernel.org, rppt@kernel.org,
surenb@google.com, mhocko@suse.com, linux-kernel@vger.kernel.org,
linux-kselftest@vger.kernel.org, linux-mm@kvack.org
Subject: Re: [PATCH] selftest: Fix UB of getline due to missing var init
Date: Wed, 27 May 2026 17:23:33 +0100 [thread overview]
Message-ID: <ahcaVoRh_Ona6EWm@lucifer> (raw)
In-Reply-To: <20260526113409.ea65314eb1da831de7c90ca6@linux-foundation.org>
On Tue, May 26, 2026 at 11:34:09AM -0700, Andrew Morton wrote:
> On Tue, 26 May 2026 13:38:48 +0200 Chris Gellermann <christian.gellermann@codasip.com> wrote:
>
> > Subject: [PATCH] selftest: Fix UB of getline due to missing var init
>
> hm, what's "UB". Please expand the acronym.
>
> > Clone3_set_tid uses getline(&line, &len, f) in a loop to read the
> > child's process status. The code expects that getline allocates the
> > buffer for the line on the first loop iteration. For this, glibc[1]
> > requires char *line to be set to NULL:
> >
> > > ssize_t getline(char **restrict lineptr, ...)
> > > If *lineptr is set to NULL before the call, then getline() will
> > > allocate a buffer for storing the line.
> >
> > However, char *line is only declared, leading to an undefined
> > initialization value. Fix this by properly initializing it to NULL.
>
> Does the test crash? If not, how come? Luck?
>
> > Same issue fixed in mlock-random-test.
> >
> > [1] https://man7.org/linux/man-pages/man3/getline.3.html
>
> The two affected files are testing significantly different parts of the
> kernel.
>
> > Fixes: 41585bbeeef9 ("selftests: add tests for clone3() with *set_tid")
> > Fixes: 26b4224d9961 ("selftests: expanding more mlock selftest")
>
> And these were separated by three years.
>
> So can you please split this into a two-patch series? And I suggest
> you add "Cc: <stable@vger.kernel.org>" to each one. Please retain David's
> ack on both.
Since this looks fine (I also wondered about the fixes too of course), feel free
to add my tag to this too:
Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
>
> Thanks.
Cheers, Lorenzo
next prev parent reply other threads:[~2026-05-27 16:23 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-26 11:38 [PATCH] selftest: Fix UB of getline due to missing var init Chris Gellermann
2026-05-26 12:19 ` David Hildenbrand (Arm)
2026-05-26 13:33 ` Lorenzo Stoakes
2026-05-26 18:34 ` Andrew Morton
2026-05-27 16:23 ` Lorenzo Stoakes [this message]
2026-06-03 10:43 ` [PATCH v2 1/2] selftests/clone3: Fix wild pointer access of getline due to missing init Chris Gellermann
2026-06-03 10:43 ` [PATCH v2 2/2] selftests/mm: Fix potential " Chris Gellermann
2026-06-03 12:05 ` [PATCH v2 1/2] selftests/clone3: Fix " Lorenzo Stoakes
2026-06-03 14:57 ` Chris Gellermann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ahcaVoRh_Ona6EWm@lucifer \
--to=ljs@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=brauner@kernel.org \
--cc=christian.gellermann@codasip.com \
--cc=david@kernel.org \
--cc=liam@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mhocko@suse.com \
--cc=rppt@kernel.org \
--cc=shuah@kernel.org \
--cc=surenb@google.com \
--cc=vbabka@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.