Chris Gellermann 6be581aeff selftests/nci: Fix out-of-bounds store on thread join ...

The NCI test collects the exit status of its helper threads by passing
the address of an int to pthread_join():

	int status;
	...
	pthread_join(thread_t, (void **) &status);

pthread_join() stores a void pointer to the memory location. On 64-bit
systems, a void pointer is wider than an int, so the store overruns the
4 bytes of space allocated on the stack for the integer and corrupts the
adjacent stack. On our CHERI system, this caused a fault due to a
capability bounds violation.

Fix this by introducing a helper that joins a thread through a void
pointer and converts the result back to an integer, which is what the
helper threads return.

While here, also fix the logic in disconnect_tag() if the helper thread
creation failed. Previously, it would have joined a thread that was
never created when pthread_create() failed.

Fixes: f595cf1242 ("selftests: Add nci suite")
Signed-off-by: Chris Gellermann <[email protected]>
Reviewed-by: Simon Horman <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: David Heidelberg <[email protected]>

2026-09-23 22:13:16 +02:00

..

.gitignore

…

config

…

Makefile

…

nci_dev.c

selftests/nci: Fix out-of-bounds store on thread join

2026-09-23 22:13:16 +02:00