diff options
| author | Chris Gellermann <christian.gellermann@codasip.com> | 2026-09-04 11:59:15 +0200 |
|---|---|---|
| committer | David Heidelberg <david@ixit.cz> | 2026-09-23 22:13:16 +0200 |
| commit | 6be581aeffc215bfc77939cd59902b0dbc4af23e (patch) | |
| tree | 57118a02aab078bf12591dd1e27fe8964040c22f /drivers/nfc | |
| parent | eda518d2cdb6074a0bcdfa06af291616bcb5c421 (diff) | |
selftests/nci: Fix out-of-bounds store on thread join
The NCI test collects the exit status of its helper threads by passing
the address of an int to pthread_join():
int status;
...
pthread_join(thread_t, (void **) &status);
pthread_join() stores a void pointer to the memory location. On 64-bit
systems, a void pointer is wider than an int, so the store overruns the
4 bytes of space allocated on the stack for the integer and corrupts the
adjacent stack. On our CHERI system, this caused a fault due to a
capability bounds violation.
Fix this by introducing a helper that joins a thread through a void
pointer and converts the result back to an integer, which is what the
helper threads return.
While here, also fix the logic in disconnect_tag() if the helper thread
creation failed. Previously, it would have joined a thread that was
never created when pthread_create() failed.
Fixes: f595cf1242f3 ("selftests: Add nci suite")
Signed-off-by: Chris Gellermann <christian.gellermann@codasip.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260904095915.3372241-1-christian.gellermann@codasip.com
Signed-off-by: David Heidelberg <david@ixit.cz>
Diffstat (limited to 'drivers/nfc')
0 files changed, 0 insertions, 0 deletions
