Re: [PATCH] tracing: Fix crash passing ERR_PTR to kthread_stop()
From: sashiko-bot@kernel.org
Date: 2026-08-15 19:10:34
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] Silent Test Bypass --
--- Patch [1]: [PATCH] tracing: Fix crash passing ERR_PTR to kthread_stop() ---commit 40985725587eec80dcbbfbf251d18cd9797fe26c
Author: Hui Su [off-list ref]
tracing: Fix crash passing ERR_PTR to kthread_stop()
event_test_stuff() calls kthread_run() and unconditionally passes the
returned task_struct pointer to kthread_stop(). kthread_run() returns an
error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for
example under memory pressure during the boot-time event self-test.
kthread_stop() then dereferences the invalid pointer, crashing the
kernel.
quoted hunk ↗ jump to hunk
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 0356cae0cf74e..207f47f54dbbf 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c@@ -3866,6 +3866,8 @@ static __init void event_test_stuff(void) struct task_struct *test_thread; test_thread = kthread_run(event_test_thread, NULL, "test-events"); + if (IS_ERR(test_thread)) + return;
[Severity: Medium]
Does returning silently here cause the self-test framework to falsely report
success when the workload thread cannot be created?
The caller event_trace_self_tests() unconditionally prints "OK" after calling
this function:
kernel/trace/trace_events.c:event_trace_self_tests() {
...
ftrace_event_enable_disable(file, 1);
event_test_stuff();
ftrace_event_enable_disable(file, 0);
pr_cont("OK\n");
}
...
}
Should event_test_stuff() propagate the error so that the caller can correctly
report the test failure or skip it appropriately?
msleep(1); kthread_stop(test_thread); }
-- Sashiko AI review · https://sashiko.dev/#/patchset/20260815190151.568893-4-sh_def@163.com?part=1