From 791841e038c40fb4c69c2888356650e554a3209a Mon Sep 17 00:00:00 2001 From: Feng Yang Date: Thu, 23 Jul 2026 16:50:56 +0800 Subject: [PATCH 1/5] selftests/bpf: Fix extra free of subtest_state->name The name has already been freed in the free_subtest_state function and does not need to be freed again. The extra free is noop since the pointer was already set to NULL. Signed-off-by: Feng Yang Link: https://lore.kernel.org/bpf/20260723085100.482147-2-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi --- tools/testing/selftests/bpf/test_progs.c | 1 - 1 file changed, 1 deletion(-) diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c index 7ba82974ee78..1d3caf996971 100644 --- a/tools/testing/selftests/bpf/test_progs.c +++ b/tools/testing/selftests/bpf/test_progs.c @@ -1886,7 +1886,6 @@ static int worker_main_send_subtests(int sock, struct test_state *state) worker_main_send_log(sock, subtest_state->log_buf, subtest_state->log_cnt); free_subtest_state(subtest_state); - free(subtest_state->name); } out: From b04b8d4e198aefc863e7b702ececb957845b0c25 Mon Sep 17 00:00:00 2001 From: Feng Yang Date: Thu, 23 Jul 2026 16:50:57 +0800 Subject: [PATCH 2/5] selftests/bpf: Fix incorrect error checking for pthread_create pthread_create returns 0 on success and a positive error code on failure; it never returns a negative value. The current conditional branch can never be taken. Failures during thread creation are silently ignored, which will lead to invalid memory access when waiting on threads or dereferencing thread handles later. Fixes: 91b2c0afd00c ("selftests/bpf: Add parallelism to test_progs") Signed-off-by: Feng Yang Link: https://lore.kernel.org/bpf/20260723085100.482147-3-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi --- tools/testing/selftests/bpf/test_progs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c index 1d3caf996971..312743c4337f 100644 --- a/tools/testing/selftests/bpf/test_progs.c +++ b/tools/testing/selftests/bpf/test_progs.c @@ -1741,7 +1741,7 @@ static void server_main(void) data[i].worker_id = i; data[i].sock_fd = env.worker_socks[i]; rc = pthread_create(&dispatcher_threads[i], NULL, dispatch_thread, &data[i]); - if (rc < 0) { + if (rc) { perror("Failed to launch dispatcher thread"); exit(EXIT_ERR_SETUP_INFRA); } From 12b362b2f06b283b7d8a2450f702f9b6a0f94aed Mon Sep 17 00:00:00 2001 From: Feng Yang Date: Thu, 23 Jul 2026 16:50:58 +0800 Subject: [PATCH 3/5] selftests/bpf: Fix missing allocation null checks in test_progs.c Add null checks after memory allocations to prevent potential segmentation faults. Fixes: 79b453501310 ("tools/bpf: add a test for bpf_get_stack with tracepoint prog") Fixes: 0925225956bb ("bpf/selftests: Add granular subtest output for prog_test") Signed-off-by: Feng Yang Link: https://lore.kernel.org/bpf/20260723085100.482147-4-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi --- tools/testing/selftests/bpf/test_progs.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c index 312743c4337f..301c6e11ceaf 100644 --- a/tools/testing/selftests/bpf/test_progs.c +++ b/tools/testing/selftests/bpf/test_progs.c @@ -730,11 +730,14 @@ int compare_map_keys(int map1_fd, int map2_fd) int compare_stack_ips(int smap_fd, int amap_fd, int stack_trace_len) { __u32 key, next_key, *cur_key_p, *next_key_p; - char *val_buf1, *val_buf2; - int i, err = 0; + char *val_buf1 = NULL, *val_buf2 = NULL; + int i, err = -ENOMEM; val_buf1 = malloc(stack_trace_len); val_buf2 = malloc(stack_trace_len); + if (!val_buf1 || !val_buf2) + goto out; + err = 0; cur_key_p = NULL; next_key_p = &key; while (bpf_map_get_next_key(smap_fd, cur_key_p, next_key_p) == 0) { @@ -1514,6 +1517,10 @@ static int dispatch_thread_send_subtests(int sock_fd, struct test_state *state) int subtest_num = state->subtest_num; state->subtest_states = malloc(subtest_num * sizeof(*subtest_state)); + if (!state->subtest_states) { + state->subtest_num = 0; + return -ENOMEM; + } for (int i = 0; i < subtest_num; i++) { subtest_state = &state->subtest_states[i]; From a813ad2185cd9f653a79b96b7c8a24240118c4e1 Mon Sep 17 00:00:00 2001 From: Feng Yang Date: Thu, 23 Jul 2026 16:50:59 +0800 Subject: [PATCH 4/5] selftests/bpf: Use calloc to allocate subtest_states An early return triggered by read_prog_test_msg leaves uninitialized elements, which leads to memory corruption during free_test_states cleanup. Signed-off-by: Feng Yang Link: https://lore.kernel.org/bpf/20260723085100.482147-5-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi --- tools/testing/selftests/bpf/test_progs.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c index 301c6e11ceaf..07da45230c4b 100644 --- a/tools/testing/selftests/bpf/test_progs.c +++ b/tools/testing/selftests/bpf/test_progs.c @@ -1516,7 +1516,7 @@ static int dispatch_thread_send_subtests(int sock_fd, struct test_state *state) struct subtest_state *subtest_state; int subtest_num = state->subtest_num; - state->subtest_states = malloc(subtest_num * sizeof(*subtest_state)); + state->subtest_states = calloc(subtest_num, sizeof(*subtest_state)); if (!state->subtest_states) { state->subtest_num = 0; return -ENOMEM; @@ -1525,8 +1525,6 @@ static int dispatch_thread_send_subtests(int sock_fd, struct test_state *state) for (int i = 0; i < subtest_num; i++) { subtest_state = &state->subtest_states[i]; - memset(subtest_state, 0, sizeof(*subtest_state)); - if (read_prog_test_msg(sock_fd, &msg, MSG_SUBTEST_DONE)) return 1; From 06efb01c6530e9cfc247178cb96aa8adb3beaf61 Mon Sep 17 00:00:00 2001 From: Feng Yang Date: Thu, 23 Jul 2026 16:51:00 +0800 Subject: [PATCH 5/5] selftests/bpf: Fix memory leak on subtest_states reallocation Fix memory leak in subtest_states reallocation, and revert subtest_num if allocation fails. Fixes: 0925225956bb ("bpf/selftests: Add granular subtest output for prog_test") Signed-off-by: Feng Yang Link: https://lore.kernel.org/bpf/20260723085100.482147-6-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi --- tools/testing/selftests/bpf/test_progs.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c index 07da45230c4b..aa06bab30966 100644 --- a/tools/testing/selftests/bpf/test_progs.c +++ b/tools/testing/selftests/bpf/test_progs.c @@ -573,18 +573,19 @@ bool test__start_subtest_with_desc(const char *subtest_name, const char *subtest struct subtest_state *subtest_state; const char *subtest_display_name; size_t sub_state_size = sizeof(*subtest_state); + void *tmp; if (env.subtest_state) test__end_subtest(); state->subtest_num++; - state->subtest_states = - realloc(state->subtest_states, - state->subtest_num * sub_state_size); - if (!state->subtest_states) { + tmp = realloc(state->subtest_states, state->subtest_num * sub_state_size); + if (!tmp) { + state->subtest_num--; fprintf(stderr, "Not enough memory to allocate subtest result\n"); return false; } + state->subtest_states = tmp; subtest_state = &state->subtest_states[state->subtest_num - 1];