> diff --git a/tools/testing/selftests/bpf/prog_tests/memcg_ops.c
> b/tools/testing/selftests/bpf/prog_tests/memcg_ops.c
> index 8c787439f..378ee3b3b 100644
> --- a/tools/testing/selftests/bpf/prog_tests/memcg_ops.c
> +++ b/tools/testing/selftests/bpf/prog_tests/memcg_ops.c
[ ... ]
> +void test_memcg_ops_hierarchies(void)
> +{
> + int ret, first = -1, second = -1, third = -1;
> + struct memcg_ops *skel = NULL;
[ ... ]
> +cleanup:
> + bpf_link__destroy(link1);
> + bpf_link__destroy(link2);
> + bpf_link__destroy(link3);
> + memcg_ops__detach(skel);
> + memcg_ops__destroy(skel);
Can this crash if skel is NULL? Unlike the other tests in this file
which guard these calls with if (skel), this cleanup path calls
memcg_ops__detach() unconditionally. If any of the earlier goto cleanup
paths are taken before memcg_ops__open_and_load() succeeds, skel remains
NULL.
The generated skeleton __detach() function does not have a NULL check:
static inline void
%1$s__detach(struct %1$s *obj)
{
bpf_object__detach_skeleton(obj->skeleton);
}
This would dereference NULL when accessing obj->skeleton.
For comparison, test_memcg_ops_over_high(),
test_memcg_ops_below_low_over_high(),
and test_memcg_ops_below_min_over_high() in the same file all use:
if (skel) {
memcg_ops__detach(skel);
memcg_ops__destroy(skel);
}
> + close(first);
> + close(second);
> + close(third);
> + cleanup_cgroup_environment();
> +}
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/21665371660
AI-authorship-score: low
AI-authorship-explanation: The code follows consistent patterns with other
tests in the file and uses standard BPF selftest conventions, suggesting human
authorship with good domain knowledge.
issues-found: 1
issue-severity-score: low
issue-severity-explanation: NULL pointer dereference crash in selftest cleanup
path when cgroup setup fails, affecting test reliability but not production
kernel code.
