Re: [LTP] lapi: Add io_uring_clone_buffers and RDS_CMSG_ZCOPY_COOKIE fallbacks

[linuxtestproject.agent@gmail.com]

Hi Sebastian,

On Thu, 4 Jun 2026, Sebastian Chlad wrote:
> lapi: Add io_uring_clone_buffers and RDS_CMSG_ZCOPY_COOKIE fallbacks

--- [PATCH 2/2] ---

testcases/kernel/syscalls/io_uring/.gitignore lists io_uring01..io_uring03
but the new io_uring04 binary is not added to it.

> +		ret = sendmsg(rds_fd, &msg, MSG_ZEROCOPY | MSG_DONTWAIT);
> +		if (ret >= 0)
> +			tst_brk(TBROK, "sendmsg() unexpectedly succeeded at iter %d", i);
> +
> +		if (errno == EFAULT)
> +			efaults++;

sendmsg() is the subject syscall here and must be wrapped in TEST()
rather than called bare.  Switch to TST_RET / TST_ERR instead of
ret / errno.

> +	if (efaults < GUP_PIN_COUNTING_BIAS)
> +		tst_res(TWARN, "Only %d/%d sends returned EFAULT - FOLL_PIN "
> +			"counter may not be fully drained",
> +			efaults, GUP_PIN_COUNTING_BIAS);

When fewer than GUP_PIN_COUNTING_BIAS sends returned EFAULT the pin
reference counter is not fully drained.  The test then continues to
unregister buffers and can end with TPASS without having exercised
the vulnerable path.

TWARN is not sufficient here; the run should be aborted with TCONF
or TBROK so the incomplete trigger is not silently reported as a pass.

> +	for (i = 0; i < CLEANUP_WAIT_SECS; i++) {
> +		sleep(1);
> +
> +		if (tst_taint_check()) {

sleep() must not be used for synchronization even inside a polling
loop.  For deferred kernel actions the expected pattern is an
exponential-backoff polling loop, e.g. TST_RETRY_FN_EXP_BACKOFF().

Verdict: Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp