summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorChris Gellermann <christian.gellermann@codasip.com>2026-09-04 11:59:15 +0200
committerDavid Heidelberg <david@ixit.cz>2026-09-23 22:13:16 +0200
commit6be581aeffc215bfc77939cd59902b0dbc4af23e (patch)
tree57118a02aab078bf12591dd1e27fe8964040c22f /drivers
parenteda518d2cdb6074a0bcdfa06af291616bcb5c421 (diff)
selftests/nci: Fix out-of-bounds store on thread join
The NCI test collects the exit status of its helper threads by passing the address of an int to pthread_join(): int status; ... pthread_join(thread_t, (void **) &status); pthread_join() stores a void pointer to the memory location. On 64-bit systems, a void pointer is wider than an int, so the store overruns the 4 bytes of space allocated on the stack for the integer and corrupts the adjacent stack. On our CHERI system, this caused a fault due to a capability bounds violation. Fix this by introducing a helper that joins a thread through a void pointer and converts the result back to an integer, which is what the helper threads return. While here, also fix the logic in disconnect_tag() if the helper thread creation failed. Previously, it would have joined a thread that was never created when pthread_create() failed. Fixes: f595cf1242f3 ("selftests: Add nci suite") Signed-off-by: Chris Gellermann <christian.gellermann@codasip.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260904095915.3372241-1-christian.gellermann@codasip.com Signed-off-by: David Heidelberg <david@ixit.cz>
Diffstat (limited to 'drivers')
0 files changed, 0 insertions, 0 deletions