[PATCH v2 bpf-next 0/5] Fix several issues in test_progs.c

[PATCH v2 bpf-next 0/5] Fix several issues in test_progs.c

[Feng Yang]

From: Feng Yang <yangfeng@kylinos.cn>

Fix several issues in test_progs.c

v2: Fix several issues raised by sashiko-bot

v1: https://lore.kernel.org/all/20260721094404.593127-1-yangfeng59949@163.com/

Feng Yang (5):
  selftests/bpf: Fix double free of subtest_state->name
  selftests/bpf: Fix missing allocation null checks in test_progs.c
  selftests/bpf: Use calloc to allocate subtest_states
  selftests/bpf: Fix memory leak on subtest_states reallocation
  selftests/bpf: Fix potential NULL pointer dereference in strscpy call

 tools/testing/selftests/bpf/test_progs.c | 50 ++++++++++++++++++------
 1 file changed, 39 insertions(+), 11 deletions(-)

-- 
2.43.0

[PATCH v2 bpf-next 1/5] selftests/bpf: Fix double free of subtest_state->name

[Feng Yang]

From: Feng Yang <yangfeng@kylinos.cn>

The name has already been freed in the free_subtest_state function
and does not need to be freed again.

Fixes: 0925225956bb ("bpf/selftests: Add granular subtest output for prog_test")
Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
---
 tools/testing/selftests/bpf/test_progs.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index 7ba82974ee78..1d3caf996971 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -1886,7 +1886,6 @@ static int worker_main_send_subtests(int sock, struct test_state *state)
 			worker_main_send_log(sock, subtest_state->log_buf, subtest_state->log_cnt);
 
 		free_subtest_state(subtest_state);
-		free(subtest_state->name);
 	}
 
 out:
-- 
2.43.0

[PATCH v2 bpf-next 2/5] selftests/bpf: Fix missing allocation null checks in test_progs.c

[Feng Yang]

From: Feng Yang <yangfeng@kylinos.cn>

Add null checks after memory allocations to prevent potential segmentation faults.

Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
---
 tools/testing/selftests/bpf/test_progs.c | 33 ++++++++++++++++++++++--
 1 file changed, 31 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index 1d3caf996971..88c65ce5b018 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -730,11 +730,14 @@ int compare_map_keys(int map1_fd, int map2_fd)
 int compare_stack_ips(int smap_fd, int amap_fd, int stack_trace_len)
 {
 	__u32 key, next_key, *cur_key_p, *next_key_p;
-	char *val_buf1, *val_buf2;
-	int i, err = 0;
+	char *val_buf1 = NULL, *val_buf2 = NULL;
+	int i, err = -ENOMEM;
 
 	val_buf1 = malloc(stack_trace_len);
 	val_buf2 = malloc(stack_trace_len);
+	if (!val_buf1 || !val_buf2)
+		goto out;
+	err = 0;
 	cur_key_p = NULL;
 	next_key_p = &key;
 	while (bpf_map_get_next_key(smap_fd, cur_key_p, next_key_p) == 0) {
@@ -1514,6 +1517,8 @@ static int dispatch_thread_send_subtests(int sock_fd, struct test_state *state)
 	int subtest_num = state->subtest_num;
 
 	state->subtest_states = malloc(subtest_num * sizeof(*subtest_state));
+	if (!state->subtest_states)
+		return -ENOMEM;
 
 	for (int i = 0; i < subtest_num; i++) {
 		subtest_state = &state->subtest_states[i];
@@ -1732,9 +1737,24 @@ static void server_main(void)
 	sigaction(SIGINT, &sigact_int, NULL);
 
 	dispatcher_threads = calloc(sizeof(pthread_t), env.workers);
+	if (!dispatcher_threads) {
+		perror("Failed to calloc dispatcher_threads");
+		exit(EXIT_ERR_SETUP_INFRA);
+	}
 	data = calloc(sizeof(struct dispatch_data), env.workers);
+	if (!data) {
+		perror("Failed to calloc data");
+		free(dispatcher_threads);
+		exit(EXIT_ERR_SETUP_INFRA);
+	}
 
 	env.worker_current_test = calloc(sizeof(int), env.workers);
+	if (!env.worker_current_test) {
+		perror("Failed to calloc env.worker_current_test");
+		free(data);
+		free(dispatcher_threads);
+		exit(EXIT_ERR_SETUP_INFRA);
+	}
 	for (i = 0; i < env.workers; i++) {
 		int rc;
 
@@ -2094,7 +2114,16 @@ int main(int argc, char **argv)
 	env.worker_id = -1; /* main process */
 	if (env.workers) {
 		env.worker_pids = calloc(sizeof(pid_t), env.workers);
+		if (!env.worker_pids) {
+			perror("Failed to calloc worker_pids");
+			return -ENOMEM;
+		}
 		env.worker_socks = calloc(sizeof(int), env.workers);
+		if (!env.worker_socks) {
+			perror("Failed to calloc worker_socks");
+			free(env.worker_pids);
+			return -ENOMEM;
+		}
 		if (env.debug)
 			fprintf(stdout, "Launching %d workers.\n", env.workers);
 		for (i = 0; i < env.workers; i++) {
-- 
2.43.0

[PATCH v2 bpf-next 3/5] selftests/bpf: Use calloc to allocate subtest_states

[Feng Yang]

From: Feng Yang <yangfeng@kylinos.cn>

An early return triggered by read_prog_test_msg leaves uninitialized elements,
which leads to memory corruption during free_test_states cleanup.

Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
---
 tools/testing/selftests/bpf/test_progs.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index 88c65ce5b018..ed9ad7ad3352 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -1516,15 +1516,13 @@ static int dispatch_thread_send_subtests(int sock_fd, struct test_state *state)
 	struct subtest_state *subtest_state;
 	int subtest_num = state->subtest_num;
 
-	state->subtest_states = malloc(subtest_num * sizeof(*subtest_state));
+	state->subtest_states = calloc(subtest_num, sizeof(*subtest_state));
 	if (!state->subtest_states)
 		return -ENOMEM;
 
 	for (int i = 0; i < subtest_num; i++) {
 		subtest_state = &state->subtest_states[i];
 
-		memset(subtest_state, 0, sizeof(*subtest_state));
-
 		if (read_prog_test_msg(sock_fd, &msg, MSG_SUBTEST_DONE))
 			return 1;
 
-- 
2.43.0

[PATCH v2 bpf-next 4/5] selftests/bpf: Fix memory leak on subtest_states reallocation

[Feng Yang]

From: Feng Yang <yangfeng@kylinos.cn>

Fix memory leak in subtest_states reallocation,
and revert subtest_num if allocation fails.

Fixes: 0925225956bb ("bpf/selftests: Add granular subtest output for prog_test")
Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
---
 tools/testing/selftests/bpf/test_progs.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index ed9ad7ad3352..ea9c887201ae 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -573,18 +573,19 @@ bool test__start_subtest_with_desc(const char *subtest_name, const char *subtest
 	struct subtest_state *subtest_state;
 	const char *subtest_display_name;
 	size_t sub_state_size = sizeof(*subtest_state);
+	void *tmp;
 
 	if (env.subtest_state)
 		test__end_subtest();
 
 	state->subtest_num++;
-	state->subtest_states =
-		realloc(state->subtest_states,
-			state->subtest_num * sub_state_size);
-	if (!state->subtest_states) {
+	tmp = realloc(state->subtest_states, state->subtest_num * sub_state_size);
+	if (!tmp) {
+		state->subtest_num--;
 		fprintf(stderr, "Not enough memory to allocate subtest result\n");
 		return false;
 	}
+	state->subtest_states = tmp;
 
 	subtest_state = &state->subtest_states[state->subtest_num - 1];
 
-- 
2.43.0

[PATCH v2 bpf-next 5/5] selftests/bpf: Fix potential NULL pointer dereference in strscpy call

[Feng Yang]

From: Feng Yang <yangfeng@kylinos.cn>

In test__start_subtest_with_desc, if strdup fails or an empty name is passed,
the function returns early. Later, worker_main_send_subtests copies the name via strscpy,
which leads to a NULL pointer dereference.

Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
---
 tools/testing/selftests/bpf/test_progs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index ea9c887201ae..ab88268db9e2 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -1882,7 +1882,8 @@ static int worker_main_send_subtests(int sock, struct test_state *state)
 
 		msg.subtest_done.num = i;
 
-		strscpy(msg.subtest_done.name, subtest_state->name, MAX_SUBTEST_NAME);
+		const char *name = subtest_state->name ? : "";
+		strscpy(msg.subtest_done.name, name, MAX_SUBTEST_NAME);
 
 		msg.subtest_done.error_cnt = subtest_state->error_cnt;
 		msg.subtest_done.skipped = subtest_state->skipped;
-- 
2.43.0

Re: [PATCH v2 bpf-next 2/5] selftests/bpf: Fix missing allocation null checks in test_progs.c

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 1136 bytes --]

>     selftests/bpf: Fix missing allocation null checks in test_progs.c
>
>     Add null checks after memory allocations to prevent potential segmentation faults.
>
>     Signed-off-by: Feng Yang <yangfeng@kylinos.cn>

This looks like a bug fix, but there is no Fixes: tag.  Most of the
corrected allocation sites (dispatcher_threads, data, and
env.worker_current_test in server_main(), and env.worker_pids and
env.worker_socks in main()) were added without null checks when the
parallel worker infrastructure went in.  Should this carry:

  Fixes: 91b2c0afd00c ("selftests/bpf: Add parallelism to test_progs")

The change also touches two allocation sites from other commits, the
val_buf1/val_buf2 checks in compare_stack_ips() and the
state->subtest_states check in dispatch_thread_send_subtests(), so more
than one Fixes: tag may be warranted, but 91b2c0afd00c covers the bulk
of the change.


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/29903681308

Re: [PATCH v2 bpf-next 0/5] Fix several issues in test_progs.c

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Kumar Kartikeya Dwivedi <memxor@gmail.com>:

On Wed, 22 Jul 2026 15:47:43 +0800 you wrote:
> From: Feng Yang <yangfeng@kylinos.cn>
> 
> Fix several issues in test_progs.c
> 
> v2: Fix several issues raised by sashiko-bot
> 
> v1: https://lore.kernel.org/all/20260721094404.593127-1-yangfeng59949@163.com/
> 
> [...]

Here is the summary with links:
  - [v2,bpf-next,1/5] selftests/bpf: Fix double free of subtest_state->name
    https://git.kernel.org/bpf/bpf-next/c/791841e038c4
  - [v2,bpf-next,2/5] selftests/bpf: Fix missing allocation null checks in test_progs.c
    (no matching commit)
  - [v2,bpf-next,3/5] selftests/bpf: Use calloc to allocate subtest_states
    (no matching commit)
  - [v2,bpf-next,4/5] selftests/bpf: Fix memory leak on subtest_states reallocation
    https://git.kernel.org/bpf/bpf-next/c/06efb01c6530
  - [v2,bpf-next,5/5] selftests/bpf: Fix potential NULL pointer dereference in strscpy call
    (no matching commit)

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html