Re: [LTP] thp04: Simplify to focus on CVE-2017-1000405 race test only

[linuxtestproject.agent@gmail.com]

Hi Jan,

On Tue, Jul 14 2026, Jan Polensky <japo@linux.ibm.com> wrote:
> thp04: Simplify to focus on CVE-2017-1000405 race test only

--- [PATCH 1/3] ---

> +static struct child_state *child;
> ...
> +	child = SAFE_MMAP(NULL, sizeof(*child), PROT_READ | PROT_WRITE,
> +		MAP_SHARED | MAP_ANONYMOUS, -1, 0);

> +static struct tst_test test = {
> +	.test_all = run,
> +	.setup = setup,
> +	.cleanup = cleanup,
> +	.runtime = 150,
> +	.forks_child = 1,

Is .forks_child = 1 intentional? tst_fzsync_pair_reset() is called
with thread_run as the second argument, which causes it to create a
pthread via SAFE_PTHREAD_CREATE -- not a child process.

tst_test.h: "@forks_child: Has to be set if the test intends to fork
children." No fork() or SAFE_FORK() is called anywhere in this test,
so .forks_child should not be set.

The child struct is also mapped with MAP_SHARED|MAP_ANONYMOUS.
MAP_SHARED is meaningful between a parent and a forked child; for
thread-only use MAP_PRIVATE is appropriate.

> -};
> +};
>  No newline at end of file

The file is missing a trailing newline. POSIX requires text files to
end with a newline; `make check` would catch this.

--- [PATCH 2/3] ---

> +/*\
> + * [Description]
> + *
> + * Verify that direct writes to /proc/self/mem are correctly rejected

The [Description] header is deprecated. Remove the [Description] line;
the RST block is treated as a description by default. See c-tests.md
rule 18.

> +	memfd = SAFE_OPEN("/proc/self/mem", O_RDWR);
> +}
> +
> +static void run(void)
> +{
> +	int test_val = 0xdeadbeef;
> +	ssize_t ret;
> +
> +	/* Seek to our test memory location */
> +	SAFE_LSEEK(memfd, (off_t)test_ptr, SEEK_SET);
> +
> +	/* Attempt to write to our own memory via /proc/self/mem */
> +	ret = write(memfd, &test_val, sizeof(test_val));

The write() here is the subject syscall and its result is being
checked, but it is not wrapped in TEST(). c-tests.md: "Subject
syscalls MUST still be wrapped in TEST() or a TST_EXP_* macro --
never called bare."

Use TEST(write(memfd, &test_val, sizeof(test_val))) and replace the
ret / errno checks with TST_RET and TST_ERR.

> +	/* Allocate a read-only page - writes via /proc/self/mem should fail */
> +	test_ptr = SAFE_MMAP(NULL, sizeof(int), PROT_READ | PROT_WRITE,

The comment says "read-only page" but the mmap uses PROT_READ|PROT_WRITE.
The page is made read-only by the SAFE_MPROTECT call two lines later.

Also the blank line immediately after '*test_ptr = 0;' contains a
trailing tab. Remove it.

There is no entry for ptrace12 in runtest/syscalls. The test will not
be picked up by any LTP run until that entry is added.

--- [PATCH 3/3] ---

> +/*\
> + * [Description]
> + *
> + * Verify that a parent process can write to a traced child's memory

Same [Description] issue as ptrace12 -- remove the deprecated header.

There is no entry for ptrace13 in runtest/syscalls.

The blank line after '*shared->test_ptr = 0;' in tracee_main() also
has a trailing tab.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp