From nobody Mon Sep 28 13:17:46 2026 Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F16D448C40F for ; Fri, 21 Aug 2026 11:45:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787312728; cv=none; b=T6JDh6KxzhwiW4yLDReSOHSPW7MJqzfshN6mq6QPyZ5S9bJZdS+4G4HbOaDjHBeDj5NrdSvkZN3/mmPP0J3iP2pXxsCUxNzEsc+3yurrnycj0VWUbyAA5igWLNVRR/F+kDciQXjMP5KAG1PKbw5ovpWZlQBbpnFe60IVyibzjf0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787312728; c=relaxed/simple; bh=gmpADQjqRAeqL6GeAdarpZCon3lnJxV4Ps618bZVbQg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=otpuImeAs31uiTLMy03WDuwBD8s67ZCogl3a5lGb9cwZmFZU2AEOl2HhLTy6vKqwi/DbxWfF2IfV5m6kip3yfjLqryEJ+rc/p35rE57Gzya7WMCbXJdvjGjBxFk2XNCSOMDgOGtQT7TgYgD54xdgTa5f5f7wrjpxcBqgHPm1V9w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=lROOrJnq; arc=none smtp.client-ip=209.85.214.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="lROOrJnq" Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2cc7ef7ec27so12258185ad.1 for ; Fri, 21 Aug 2026 04:45:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787312725; x=1787917525; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=JSy4cnyR4S+sHUGi7h02BTfopN89+3p/alRrTWBOPrA=; b=lROOrJnqLHU9rOcJq1AiNJODelouTnuFrSCXR7s52JHkITQcm/l7z/LIvkA4YsBzT/ dRd9rmaoBiARLqkZMzkd6ipmskn5iMEXjqtgHBVHMivWMTexQzjE8fzcCV0nl833f71f FwcdUFLWPeuRPoWuk+K+6dAjSdmPpORlsa5k1se3GCSedG0bPW+htn14wyL80UnxuoJV xjpGPQlEfzGgnDljj/ubd6fgfLtMHj8aSkZUgnzuC8GemOCYyB1wV9IbgQl4MjC1fTXj FHj+wxwULcW6BYe4yJXi4THul4uI+qOivovSW5WB1ES3yvmcFuGgloF51Xt1XMemoHfi 31Hg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787312725; x=1787917525; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=JSy4cnyR4S+sHUGi7h02BTfopN89+3p/alRrTWBOPrA=; b=rANg8//sOIdrbFvWY4rotE27WslsxSchmQdhM5e+r7caMh2lec9ECmpaVlcvGErp/j i1JJ6DA9ah2dGiFYS4caw6qHUhYCtD0IdkHK7QzvMsFYtfOvFgJb9OF0GRzKkCyh2r/8 +DgQOqcjeGcLB/bVIgCt66VUbi4KNkgfdBl/WfRX91gUQfbXJQezTlqeVUPkVC3zl8OS dPsQlDTwB91H7pgZjfa5LBHYOUkk7gItNM+WoiMz8kagOV/3JVQiQ4Rz73UiQ/Ihfm+V Q+yeX4frrBqjoLFiXY5+yKfwUWdyp1Bky+4Myoqxx0wgdFFNF4KDRtei3OFqaSgy6Fkc 90qA== X-Forwarded-Encrypted: i=1; AHgh+Rqv2iULNVFEqB783vnfJQLiuTmRUx6JsAmLKMQ6QvggUIuUpZgKt5Fpbqhjacz0y1PV9ZFo/eatEqKr5Xo=@vger.kernel.org X-Gm-Message-State: AFuF++k+Qo1P4BTcMRKru7YjM+SHWE8kyO0mlfg8ORcJrsuBAEnH8GWO /oeIgV9MedphaAEm5CLU2KLgNGU3u3xlChWSpsrbMIZno5nLvtBTntJq X-Gm-Gg: AR+sD13fxLbf/f2VSQZifSD7snwxglUM1darsOHQAoEws910VpOzFNLA4IGcDD8s//6 k4BybdHt5VQ9grHUJQHmwC7gr68b0teMXfLgIVPmMXskkUCZlbOnkkkcAv1Jr1ZEgkS+pDr52Zx pJqRS7zm7J+hGsdnX7ElZdFTgYkrUxPfY3PGlAEu4UYF4M1UPhjNja4HZxHqeETK65nAbLufiQa FQacPy017LS4ESiaYEx1GRaV0gOh+9mpt9E5yYDC2pb0O2W1FnhsM6Ib2gDfO06ayF6EJ6GP/gh Ka08f2CUoJNW/79Bs5xr+MZaTwKewMOFPg9cahkp8qEPXMmQ7xFrqSiDZR7mgr9ZJpAv2J+UI7N XQZeSpG0j/EPXPP49WKdZCTSCMc8joDyuPMp3kqLfHKbU0EZVdEE8GrbtAR07m6FXs9kmuM1dka Xs9OhvHp8fXkqdcXs9VoOMFtrb9MfdhqHiZu0/3IFEteUYDWV2AvzjRZpjIf9TV8yaDpVNBFr7K fzpbkidps5GVOlmQK3iE8FnE0E= X-Received: by 2002:a17:902:fdb0:b0:2cc:6018:f030 with SMTP id d9443c01a7336-2d64b0b5652mr124872615ad.14.1787312724901; Fri, 21 Aug 2026 04:45:24 -0700 (PDT) Received: from Anshuman ([103.161.223.14]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-327c946293dsm20771743eec.22.2026.08.21.04.45.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Aug 2026 04:45:24 -0700 (PDT) From: Anshuman To: Andrew Morton , David Hildenbrand , Lorenzo Stoakes Cc: Shuah Khan , Zi Yan , Baolin Wang , "Liam R . Howlett" , Nico Pache , Ryan Roberts , Dev Jain , Barry Song , Lance Yang , Usama Arif , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, Anshuman Subject: [PATCH] selftests/mm: check strdup() and fix buf leak in parse_test_type() Date: Fri, 21 Aug 2026 17:14:16 +0530 Message-ID: <20260821114416.12255-1-anshumantewari123@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The return value of strdup() is never checked before being passed to strsep() and strcmp(). If strdup() fails and returns NULL, strsep() returns NULL as well, and the subsequent strcmp(NULL, "all") is undefined behavior, likely causing a crash. Additionally, buf is never freed. strsep() advances the buf pointer past the first token, so by the time buf would normally be freed, the original pointer returned by strdup() has already been overwritten and is no longer available. Check strdup()'s return value and fail cleanly on allocation failure. Keep a separate pointer to the original allocation so it can be freed once buf is done being used, after all parsing has completed successfully. Signed-off-by: Anshuman Suggested-by or Debugged-by also don't apply here. --- tools/testing/selftests/mm/khugepaged.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/tools/testing/selftests/mm/khugepaged.c b/tools/testing/selfte= sts/mm/khugepaged.c index 10e8dedcb..a84fb87bd 100644 --- a/tools/testing/selftests/mm/khugepaged.c +++ b/tools/testing/selftests/mm/khugepaged.c @@ -1110,6 +1110,7 @@ static void parse_test_type(int argc, char **argv) { int opt; char *buf; + char *c; const char *token; =20 while ((opt =3D getopt(argc, argv, "s:h")) !=3D -1) { @@ -1135,7 +1136,10 @@ static void parse_test_type(int argc, char **argv) } =20 buf =3D strdup(argv[0]); - token =3D strsep(&buf, ":"); + if (!buf) + ksft_exit_fail_msg("Insufficient memory\n"); + c =3D buf; + token =3D strsep(&c, ":"); =20 if (!strcmp(token, "all")) { khugepaged_context =3D &__khugepaged_context; @@ -1148,26 +1152,27 @@ static void parse_test_type(int argc, char **argv) usage(); } =20 - if (!buf) + if (!c) usage(); =20 - if (!strcmp(buf, "all")) { + if (!strcmp(c, "all")) { read_only_file_ops =3D &__read_only_file_ops; read_write_file_read_ops =3D &__read_write_file_read_ops; read_write_file_write_ops =3D &__read_write_file_write_ops; anon_ops =3D &__anon_ops; shmem_ops =3D &__shmem_ops; - } else if (!strcmp(buf, "anon")) { + } else if (!strcmp(c, "anon")) { anon_ops =3D &__anon_ops; - } else if (!strcmp(buf, "file")) { + } else if (!strcmp(c, "file")) { read_only_file_ops =3D &__read_only_file_ops; read_write_file_read_ops =3D &__read_write_file_read_ops; read_write_file_write_ops =3D &__read_write_file_write_ops; - } else if (!strcmp(buf, "shmem")) { + } else if (!strcmp(c, "shmem")) { shmem_ops =3D &__shmem_ops; } else { usage(); } + free(buf); =20 if (!read_only_file_ops && !read_write_file_read_ops && !read_write_file_write_ops) --=20 2.55.0