Thread (2 messages) flat view 2 messages, 2 authors, 14h ago
HOTtoday

[PATCH] tracing: Fix crash passing ERR_PTR to kthread_stop()

From: Hui Su <hidden>
Date: 2026-08-15 19:03:14
Also in: lkml, stable
Subsystem: the rest, tracing · Maintainers: Linus Torvalds, Steven Rostedt, Masami Hiramatsu

event_test_stuff() calls kthread_run() and unconditionally passes the
returned task_struct pointer to kthread_stop(). kthread_run() returns an
error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for
example under memory pressure during the boot-time event self-test.
kthread_stop() then dereferences the invalid pointer, crashing the
kernel.

Check IS_ERR() on the result of kthread_run() before passing it to
kthread_stop(), matching the ring-buffer self-test fix in commit
91542863abad ("ring-buffer: Fix crash passing ERR_PTR to kthread_stop()").

Fixes: e6187007d6c3 ("tracing/events: add startup tests for events")
Cc: stable@vger.kernel.org
Signed-off-by: Hui Su <redacted>
---
 kernel/trace/trace_events.c | 2 ++
 1 file changed, 2 insertions(+)
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 3650d84d4f16..d21564733b4a 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -4901,6 +4901,8 @@ static __init void event_test_stuff(void)
 	struct task_struct *test_thread;
 
 	test_thread = kthread_run(event_test_thread, NULL, "test-events");
+	if (IS_ERR(test_thread))
+		return;
 	msleep(1);
 	kthread_stop(test_thread);
 }
-- 
2.54.0
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help