github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-25 17:42:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selftests/nci: Fix out-of-bounds store on thread join

Browse Source 
The NCI test collects the exit status of its helper threads by passing
the address of an int to pthread_join():

	int status;
	...
	pthread_join(thread_t, (void **) &status);

pthread_join() stores a void pointer to the memory location. On 64-bit
systems, a void pointer is wider than an int, so the store overruns the
4 bytes of space allocated on the stack for the integer and corrupts the
adjacent stack. On our CHERI system, this caused a fault due to a
capability bounds violation.

Fix this by introducing a helper that joins a thread through a void
pointer and converts the result back to an integer, which is what the
helper threads return.

While here, also fix the logic in disconnect_tag() if the helper thread
creation failed. Previously, it would have joined a thread that was
never created when pthread_create() failed.

Fixes: f595cf1242 ("selftests: Add nci suite")
Signed-off-by: Chris Gellermann <christian.gellermann@codasip.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260904095915.3372241-1-christian.gellermann@codasip.com
Signed-off-by: David Heidelberg <david@ixit.cz>
This commit is contained in:
Chris Gellermann 2026-09-04 11:59:15 +02:00 committed by David Heidelberg
parent eda518d2cd
commit 6be581aeff
No known key found for this signature in database
GPG Key ID: 60023FC4D3492072
1 changed files with 20 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
tools/testing/selftests/nci/nci_dev.c
View File

@ -8,6 +8,7 @@
#include <stdlib.h>
#include <errno.h>
#include <stdint.h>
#include <string.h>
#include <sys/ioctl.h>
#include <fcntl.h>
@ -87,6 +88,16 @@ struct msgtemplate {
char buf[MAX_MSG_SIZE];
};
static int join_thread_status(pthread_t thread)
{
void *thread_ret = NULL;
if (pthread_join(thread, &thread_ret))
return -1;
return (int)(intptr_t)thread_ret;
}
static int create_nl_socket(void)
{
int fd;
@ -444,7 +455,7 @@ FIXTURE_SETUP(NCI)
NFC_CMD_DEV_UP, self->dev_idex);
EXPECT_EQ(rc, 0);
pthread_join(thread_t, (void **)&status);
status = join_thread_status(thread_t);
ASSERT_EQ(status, 0);
self->open_state = true;
}
@ -514,7 +525,7 @@ FIXTURE_TEARDOWN(NCI)
NFC_CMD_DEV_DOWN, self->dev_idex);
EXPECT_EQ(rc, 0);
pthread_join(thread_t, (void **)&status);
status = join_thread_status(thread_t);
ASSERT_EQ(status, 0);
}
@ -585,7 +596,6 @@ int start_polling(int dev_idx, int proto, int virtual_fd, int sd, int fid, int p
void *nla_start_poll_data[2] = {&dev_idx, &proto};
int nla_start_poll_len[2] = {4, 4};
pthread_t thread_t;
int status;
int rc;
rc = pthread_create(&thread_t, NULL, virtual_poll_start,
@ -598,14 +608,12 @@ int start_polling(int dev_idx, int proto, int virtual_fd, int sd, int fid, int p
if (rc != 0)
return rc;
pthread_join(thread_t, (void **)&status);
return status;
return join_thread_status(thread_t);
}
int stop_polling(int dev_idx, int virtual_fd, int sd, int fid, int pid)
{
pthread_t thread_t;
int status;
int rc;
rc = pthread_create(&thread_t, NULL, virtual_poll_stop,
@ -618,8 +626,7 @@ int stop_polling(int dev_idx, int virtual_fd, int sd, int fid, int pid)
if (rc != 0)
return rc;
pthread_join(thread_t, (void **)&status);
return status;
return join_thread_status(thread_t);
}
TEST_F(NCI, start_poll)
@ -834,8 +841,10 @@ int disconnect_tag(int nfc_sock, int virtual_fd)
return status;
close(nfc_sock);
pthread_join(thread_t, (void **)&status);
return status;
if (status)
return -1;
return join_thread_status(thread_t);
}
TEST_F(NCI, t4t_tag_read)
@ -882,7 +891,7 @@ TEST_F(NCI, deinit)
NFC_CMD_DEV_DOWN, self->dev_idex);
EXPECT_EQ(rc, 0);
pthread_join(thread_t, (void **)&status);
status = join_thread_status(thread_t);
self->open_state = 0;
ASSERT_EQ(status, 0);