Three calloc() calls in the ublk selftests lack NULL return checks,
leading to potential NULL pointer dereferences on allocation failure:

1. kublk.c ublk_ctrl_init(): the allocated `dev` is dereferenced
   immediately via `info = &dev->dev_info` without checking for NULL.

2. batch.c alloc_batch_commit_buf(): the allocated `t->commit` is
   dereferenced in the following for-loop without checking for NULL.

3. batch.c alloc_batch_fetch_buf(): the allocated `t->fetch` is
   dereferenced in the following for-loop without checking for NULL.

Add NULL checks after each calloc(), returning NULL or -ENOMEM consistent
with existing error handling in the same functions.

Signed-off-by: longlong yan <yanlonglong@kylinos.cn>
---
 tools/testing/selftests/ublk/batch.c  | 4 ++++
 tools/testing/selftests/ublk/kublk.c | 9 +++++++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/ublk/batch.c b/tools/testing/selftests/ublk/batch.c
index d8d9ebed5979..5dd6bdfaf9c1 100644
--- a/tools/testing/selftests/ublk/batch.c
+++ b/tools/testing/selftests/ublk/batch.c
@@ -88,6 +88,8 @@ static int alloc_batch_commit_buf(struct ublk_thread *t)
 	int i, ret, j = 0;
 
 	t->commit = calloc(t->nr_queues, sizeof(*t->commit));
+	if (!t->commit)
+		return -ENOMEM;
 	for (i = 0; i < t->dev->dev_info.nr_hw_queues; i++) {
 		if (t->q_map[i])
 			t->commit[j++].q_id = i;
@@ -184,6 +186,8 @@ static int alloc_batch_fetch_buf(struct ublk_thread *t)
 	/* double fetch buffer for each queue */
 	t->nr_fetch_bufs = t->nr_queues * 2;
 	t->fetch = calloc(t->nr_fetch_bufs, sizeof(*t->fetch));
+	if (!t->fetch)
+		return -ENOMEM;
 
 	/* allocate one buffer for each queue */
 	for (i = 0; i < t->nr_fetch_bufs; i++) {
diff --git a/tools/testing/selftests/ublk/kublk.c b/tools/testing/selftests/ublk/kublk.c
index 2400b4615766..f7ddbb4c5582 100644
--- a/tools/testing/selftests/ublk/kublk.c
+++ b/tools/testing/selftests/ublk/kublk.c
@@ -435,9 +435,14 @@ static void ublk_ctrl_deinit(struct ublk_dev *dev)
 static struct ublk_dev *ublk_ctrl_init(void)
 {
 	struct ublk_dev *dev = (struct ublk_dev *)calloc(1, sizeof(*dev));
-	struct ublksrv_ctrl_dev_info *info = &dev->dev_info;
+	struct ublksrv_ctrl_dev_info *info;
 	int ret;
 
+	if (!dev)
+		return NULL;
+
+	info = &dev->dev_info;
+
 	dev->ctrl_fd = open(CTRL_DEV, O_RDWR);
 	if (dev->ctrl_fd < 0) {
 		free(dev);
-- 
2.43.0

On Wed, Sep 2, 2026 at 1:45 AM longlong yan <yanlonglong@kylinos.cn> wrote:
>
> Three calloc() calls in the ublk selftests lack NULL return checks,
> leading to potential NULL pointer dereferences on allocation failure:
>
> 1. kublk.c ublk_ctrl_init(): the allocated `dev` is dereferenced
>    immediately via `info = &dev->dev_info` without checking for NULL.
>
> 2. batch.c alloc_batch_commit_buf(): the allocated `t->commit` is
>    dereferenced in the following for-loop without checking for NULL.
>
> 3. batch.c alloc_batch_fetch_buf(): the allocated `t->fetch` is
>    dereferenced in the following for-loop without checking for NULL.
>
> Add NULL checks after each calloc(), returning NULL or -ENOMEM consistent
> with existing error handling in the same functions.
>
> Signed-off-by: longlong yan <yanlonglong@kylinos.cn>

Looks fine, all needn't special failure handling:

Reviewed-by: Ming Lei <tom.leiming@gmail.com>



Thanks,
Ming