[PATCH v3 bpf-next 0/5] selftests/bpf: Fix several issues in test_progs.c

[PATCH v3 bpf-next 0/5] selftests/bpf: Fix several issues in test_progs.c

[Feng Yang]

From: Feng Yang <yangfeng@kylinos.cn>

Fix several issues in test_progs.c

v3: Add fix incorrect error checking for pthread_create patch
    Memory allocation null checks for the worker logic are relatively complex;
    remove them for now and submit them separately in a follow-up patch.

v2: Fix several issues raised by sashiko-bot
    https://lore.kernel.org/all/20260722074748.674080-1-yangfeng59949@163.com/

v1: https://lore.kernel.org/all/20260721094404.593127-1-yangfeng59949@163.com/

Feng Yang (5):
  selftests/bpf: Fix double free of subtest_state->name
  selftests/bpf: Fix incorrect error checking for pthread_create
  selftests/bpf: Fix missing allocation null checks in test_progs.c
  selftests/bpf: Use calloc to allocate subtest_states
  selftests/bpf: Fix memory leak on subtest_states reallocation

 tools/testing/selftests/bpf/test_progs.c | 27 ++++++++++++++----------
 1 file changed, 16 insertions(+), 11 deletions(-)

-- 
2.43.0

[PATCH v3 bpf-next 1/5] selftests/bpf: Fix double free of subtest_state->name

[Feng Yang]

From: Feng Yang <yangfeng@kylinos.cn>

The name has already been freed in the free_subtest_state function
and does not need to be freed again.

Fixes: 0925225956bb ("bpf/selftests: Add granular subtest output for prog_test")
Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
---
 tools/testing/selftests/bpf/test_progs.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index 7ba82974ee78..1d3caf996971 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -1886,7 +1886,6 @@ static int worker_main_send_subtests(int sock, struct test_state *state)
 			worker_main_send_log(sock, subtest_state->log_buf, subtest_state->log_cnt);
 
 		free_subtest_state(subtest_state);
-		free(subtest_state->name);
 	}
 
 out:
-- 
2.43.0

[PATCH v3 bpf-next 2/5] selftests/bpf: Fix incorrect error checking for pthread_create

[Feng Yang]

From: Feng Yang <yangfeng@kylinos.cn>

pthread_create returns 0 on success and a positive error code on failure;
it never returns a negative value. The current conditional branch can never be taken.
Failures during thread creation are silently ignored, which will lead to
invalid memory access when waiting on threads or dereferencing thread handles later.

Fixes: 91b2c0afd00c ("selftests/bpf: Add parallelism to test_progs")
Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
---
 tools/testing/selftests/bpf/test_progs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index 1d3caf996971..312743c4337f 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -1741,7 +1741,7 @@ static void server_main(void)
 		data[i].worker_id = i;
 		data[i].sock_fd = env.worker_socks[i];
 		rc = pthread_create(&dispatcher_threads[i], NULL, dispatch_thread, &data[i]);
-		if (rc < 0) {
+		if (rc) {
 			perror("Failed to launch dispatcher thread");
 			exit(EXIT_ERR_SETUP_INFRA);
 		}
-- 
2.43.0

[PATCH v3 bpf-next 3/5] selftests/bpf: Fix missing allocation null checks in test_progs.c

[Feng Yang]

From: Feng Yang <yangfeng@kylinos.cn>

Add null checks after memory allocations to prevent potential segmentation faults.

Fixes: 79b453501310 ("tools/bpf: add a test for bpf_get_stack with tracepoint prog")
Fixes: 0925225956bb ("bpf/selftests: Add granular subtest output for prog_test")
Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
---
 tools/testing/selftests/bpf/test_progs.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index 312743c4337f..301c6e11ceaf 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -730,11 +730,14 @@ int compare_map_keys(int map1_fd, int map2_fd)
 int compare_stack_ips(int smap_fd, int amap_fd, int stack_trace_len)
 {
 	__u32 key, next_key, *cur_key_p, *next_key_p;
-	char *val_buf1, *val_buf2;
-	int i, err = 0;
+	char *val_buf1 = NULL, *val_buf2 = NULL;
+	int i, err = -ENOMEM;
 
 	val_buf1 = malloc(stack_trace_len);
 	val_buf2 = malloc(stack_trace_len);
+	if (!val_buf1 || !val_buf2)
+		goto out;
+	err = 0;
 	cur_key_p = NULL;
 	next_key_p = &key;
 	while (bpf_map_get_next_key(smap_fd, cur_key_p, next_key_p) == 0) {
@@ -1514,6 +1517,10 @@ static int dispatch_thread_send_subtests(int sock_fd, struct test_state *state)
 	int subtest_num = state->subtest_num;
 
 	state->subtest_states = malloc(subtest_num * sizeof(*subtest_state));
+	if (!state->subtest_states) {
+		state->subtest_num = 0;
+		return -ENOMEM;
+	}
 
 	for (int i = 0; i < subtest_num; i++) {
 		subtest_state = &state->subtest_states[i];
-- 
2.43.0

[PATCH v3 bpf-next 4/5] selftests/bpf: Use calloc to allocate subtest_states

[Feng Yang]

From: Feng Yang <yangfeng@kylinos.cn>

An early return triggered by read_prog_test_msg leaves uninitialized elements,
which leads to memory corruption during free_test_states cleanup.

Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
---
 tools/testing/selftests/bpf/test_progs.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index 301c6e11ceaf..07da45230c4b 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -1516,7 +1516,7 @@ static int dispatch_thread_send_subtests(int sock_fd, struct test_state *state)
 	struct subtest_state *subtest_state;
 	int subtest_num = state->subtest_num;
 
-	state->subtest_states = malloc(subtest_num * sizeof(*subtest_state));
+	state->subtest_states = calloc(subtest_num, sizeof(*subtest_state));
 	if (!state->subtest_states) {
 		state->subtest_num = 0;
 		return -ENOMEM;
@@ -1525,8 +1525,6 @@ static int dispatch_thread_send_subtests(int sock_fd, struct test_state *state)
 	for (int i = 0; i < subtest_num; i++) {
 		subtest_state = &state->subtest_states[i];
 
-		memset(subtest_state, 0, sizeof(*subtest_state));
-
 		if (read_prog_test_msg(sock_fd, &msg, MSG_SUBTEST_DONE))
 			return 1;
 
-- 
2.43.0

Re: [PATCH v3 bpf-next 4/5] selftests/bpf: Use calloc to allocate subtest_states

[bot+bpf-ci]

[-- Attachment #1: Type: text/plain, Size: 853 bytes --]

>     selftests/bpf: Use calloc to allocate subtest_states
>
>     An early return triggered by read_prog_test_msg leaves uninitialized elements,
>     which leads to memory corruption during free_test_states cleanup.
>
>     Signed-off-by: Feng Yang <yangfeng@kylinos.cn>

This looks like a fix for a memory corruption bug in
dispatch_thread_send_subtests().  The uninitialized elements that
free_test_states() later frees were introduced when the malloc() plus
per-element memset() allocation was added.  Should this include:

  Fixes: 0925225956bb ("bpf/selftests: Add granular subtest output for prog_test")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/29993688332

[PATCH v3 bpf-next 5/5] selftests/bpf: Fix memory leak on subtest_states reallocation

[Feng Yang]

From: Feng Yang <yangfeng@kylinos.cn>

Fix memory leak in subtest_states reallocation,
and revert subtest_num if allocation fails.

Fixes: 0925225956bb ("bpf/selftests: Add granular subtest output for prog_test")
Signed-off-by: Feng Yang <yangfeng@kylinos.cn>
---
 tools/testing/selftests/bpf/test_progs.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index 07da45230c4b..aa06bab30966 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -573,18 +573,19 @@ bool test__start_subtest_with_desc(const char *subtest_name, const char *subtest
 	struct subtest_state *subtest_state;
 	const char *subtest_display_name;
 	size_t sub_state_size = sizeof(*subtest_state);
+	void *tmp;
 
 	if (env.subtest_state)
 		test__end_subtest();
 
 	state->subtest_num++;
-	state->subtest_states =
-		realloc(state->subtest_states,
-			state->subtest_num * sub_state_size);
-	if (!state->subtest_states) {
+	tmp = realloc(state->subtest_states, state->subtest_num * sub_state_size);
+	if (!tmp) {
+		state->subtest_num--;
 		fprintf(stderr, "Not enough memory to allocate subtest result\n");
 		return false;
 	}
+	state->subtest_states = tmp;
 
 	subtest_state = &state->subtest_states[state->subtest_num - 1];
 
-- 
2.43.0

Re: [PATCH v3 bpf-next 0/5] selftests/bpf: Fix several issues in test_progs.c

[patchwork-bot+netdevbpf]

Hello:

This series was applied to bpf/bpf-next.git (master)
by Kumar Kartikeya Dwivedi <memxor@gmail.com>:

On Thu, 23 Jul 2026 16:50:55 +0800 you wrote:
> From: Feng Yang <yangfeng@kylinos.cn>
> 
> Fix several issues in test_progs.c
> 
> v3: Add fix incorrect error checking for pthread_create patch
>     Memory allocation null checks for the worker logic are relatively complex;
>     remove them for now and submit them separately in a follow-up patch.
> 
> [...]

Here is the summary with links:
  - [v3,bpf-next,1/5] selftests/bpf: Fix double free of subtest_state->name
    https://git.kernel.org/bpf/bpf-next/c/791841e038c4
  - [v3,bpf-next,2/5] selftests/bpf: Fix incorrect error checking for pthread_create
    https://git.kernel.org/bpf/bpf-next/c/b04b8d4e198a
  - [v3,bpf-next,3/5] selftests/bpf: Fix missing allocation null checks in test_progs.c
    https://git.kernel.org/bpf/bpf-next/c/12b362b2f06b
  - [v3,bpf-next,4/5] selftests/bpf: Use calloc to allocate subtest_states
    https://git.kernel.org/bpf/bpf-next/c/a813ad2185cd
  - [v3,bpf-next,5/5] selftests/bpf: Fix memory leak on subtest_states reallocation
    https://git.kernel.org/bpf/bpf-next/c/06efb01c6530

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html