[PATCH 1/2] samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify

[PATCH 1/2] samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify

[Haotian Zhang]

ftrace_direct_multi_init() assigns kthread_run()'s return value to
simple_tsk without an IS_ERR() check. When kthread_run() fails it
returns ERR_PTR(-ENOMEM), but init still returns 0, so the module loads
with simple_tsk holding an error pointer. On unload,
ftrace_direct_multi_exit() then passes that ERR_PTR to kthread_stop(),
leading to a null-pointer-dereference.

Check the return value of kthread_run() with IS_ERR(); on failure,
unregister the ftrace direct call and propagate the error code.

Fixes: e1067a07cfbc ("ftrace/samples: Add module to test multi direct modify interface")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
---
 samples/ftrace/ftrace-direct-multi-modify.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/samples/ftrace/ftrace-direct-multi-modify.c b/samples/ftrace/ftrace-direct-multi-modify.c
index 8f7986d698d8..f339131654c7 100644
--- a/samples/ftrace/ftrace-direct-multi-modify.c
+++ b/samples/ftrace/ftrace-direct-multi-modify.c
@@ -364,8 +364,13 @@ static int __init ftrace_direct_multi_init(void)
 
 	ret = register_ftrace_direct(&direct, my_tramp);
 
-	if (!ret)
+	if (!ret) {
 		simple_tsk = kthread_run(simple_thread, NULL, "event-sample-fn");
+		if (IS_ERR(simple_tsk)) {
+			unregister_ftrace_direct(&direct, my_tramp, true);
+			ret = PTR_ERR(simple_tsk);
+		}
+	}
 	return ret;
 }
 
-- 
2.43.0

Re: [PATCH 1/2] samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify

[Steven Rostedt]

On Tue, 25 Aug 2026 17:34:21 +0800
Haotian Zhang <vulab@iscas.ac.cn> wrote:

> ftrace_direct_multi_init() assigns kthread_run()'s return value to
> simple_tsk without an IS_ERR() check. When kthread_run() fails it
> returns ERR_PTR(-ENOMEM), but init still returns 0, so the module loads
> with simple_tsk holding an error pointer. On unload,
> ftrace_direct_multi_exit() then passes that ERR_PTR to kthread_stop(),
> leading to a null-pointer-dereference.
> 
> Check the return value of kthread_run() with IS_ERR(); on failure,
> unregister the ftrace direct call and propagate the error code.
> 
> Fixes: e1067a07cfbc ("ftrace/samples: Add module to test multi direct modify interface")
> Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
> ---
>  samples/ftrace/ftrace-direct-multi-modify.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/samples/ftrace/ftrace-direct-multi-modify.c b/samples/ftrace/ftrace-direct-multi-modify.c
> index 8f7986d698d8..f339131654c7 100644
> --- a/samples/ftrace/ftrace-direct-multi-modify.c
> +++ b/samples/ftrace/ftrace-direct-multi-modify.c
> @@ -364,8 +364,13 @@ static int __init ftrace_direct_multi_init(void)
>  
>  	ret = register_ftrace_direct(&direct, my_tramp);
>  
> -	if (!ret)
> +	if (!ret) {
>  		simple_tsk = kthread_run(simple_thread, NULL, "event-sample-fn");
> +		if (IS_ERR(simple_tsk)) {
> +			unregister_ftrace_direct(&direct, my_tramp, true);
> +			ret = PTR_ERR(simple_tsk);
> +		}
> +	}
>  	return ret;
>  }
>  

And simplify this one too.

Oh, and if you have a series "[PATCH 1/2]" then you need a cover letter and
have each patch be a reply to of that patch. Otherwise just send the
patches as is without the numbered series. Because sending the patches one
by one with a series number makes it confusing.

-- Steve


-- Steve