From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from picard.linux.it (picard.linux.it [213.254.12.146]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id AEB03C4452B for ; Tue, 21 Jul 2026 20:25:39 +0000 (UTC) Received: from picard.linux.it (localhost [IPv6:::1]) by picard.linux.it (Postfix) with ESMTP id C3C783E5283 for ; Tue, 21 Jul 2026 22:25:37 +0200 (CEST) Received: from in-2.smtp.seeweb.it (in-2.smtp.seeweb.it [217.194.8.2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (No client certificate requested) by picard.linux.it (Postfix) with ESMTPS id 158F13E1B59 for ; Tue, 21 Jul 2026 22:25:07 +0200 (CEST) Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by in-2.smtp.seeweb.it (Postfix) with ESMTPS id EF650600A0C for ; Tue, 21 Jul 2026 22:25:06 +0200 (CEST) Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66LHBr8G1652092; Tue, 21 Jul 2026 20:25:05 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=KwtGo97bCRpCCcu1v 1xC6W9CilgWlB/6Jj4Yd/tgBVg=; b=UidStOMXsTDuD85n+Z4GQdcFTVv8TWAsR P+eicFAyR3s4jA582z6UJsI7za+VRcqJSfJGlvoubM0aVvN6s9kaF/TY81g+jgk5 HyYyOBLSA243ftnIR2VejYflx8K14uKlDlyJz5Wh5NU9+8xNgrbCE4h6kba7Z2dd vZcGBPKXHvJti1uxR/PWtSg3EeyOY18mrmWSvDDNqRmhITEwx2eHN7uJQE0ieH4c j2h6Ak0m/WVRLPPEGgPz+rGiOewkW2pLIdpFkijwXzw4vl5g8aCePWTI9SS+eAv2 IPCDaroQUklPsWKxvrIv6gBV9O5okilVZhINZuyuzoJwTG2zR2EAg== Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fg790xpav-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 21 Jul 2026 20:25:04 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66LKJexv015291; Tue, 21 Jul 2026 20:25:03 GMT Received: from smtprelay05.fra02v.mail.ibm.com ([9.218.2.225]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4fgktq4b2b-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 21 Jul 2026 20:25:03 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (smtpav06.fra02v.mail.ibm.com [10.20.54.105]) by smtprelay05.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66LKOxEn38928800 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 21 Jul 2026 20:24:59 GMT Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BA93720101; Tue, 21 Jul 2026 20:24:59 +0000 (GMT) Received: from smtpav06.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7E8C8200BE; Tue, 21 Jul 2026 20:24:59 +0000 (GMT) Received: from li-276bd24c-2dcc-11b2-a85c-945b6f05615c.ibm.com.com (unknown [9.87.158.239]) by smtpav06.fra02v.mail.ibm.com (Postfix) with ESMTP; Tue, 21 Jul 2026 20:24:59 +0000 (GMT) From: Jan Polensky To: ltp@lists.linux.it Date: Tue, 21 Jul 2026 22:24:49 +0200 Message-ID: <20260721202452.315581-2-japo@linux.ibm.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721202452.315581-1-japo@linux.ibm.com> References: <20260721202452.315581-1-japo@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: KXbrCIm8fDXK1KWwozpaMzn0zM-WvwBa X-Authority-Analysis: v=2.4 cv=V6RNF+ni c=1 sm=1 tr=0 ts=6a5fd5a0 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=aKpMiE9gd_-pdFYVdXcA:9 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIxMDIxMCBTYWx0ZWRfX5AMW5CCMCRbX xJ17Bo3r+ENUquqAZFBOUlOPuIFL/dE0FrhxOtkA6rC4guda0aI2ACNI4t15Fbg7lVYZUeV7xKp fLm9/llChBSkFPp+WrCvLUUjE12k+wM= X-Proofpoint-GUID: KXbrCIm8fDXK1KWwozpaMzn0zM-WvwBa X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIxMDIxMCBTYWx0ZWRfXzIFP24FfpuED m5etOsJwhyq24uiU1xLo+BEx5dOJPdEK05Yx0D+88UYYKrThgLEeqKQHRNXi1XAL67gVFgNI23q iQ0DT6UGh3Plegi+One+9g4tC06xjYmryoOYFyhbrXQuSsR7Lj+E23FU1e4Br2RQRIdhqrNR/s1 Te7SpJAQphwFKMFJw3DERJXcDFRpYhKEhp1Xt0nsl8/nZq9IEyV7QO3GqmygU2ZCGGG/mgK4Q/q jIvFNp0la1uV7X6Qtfmxi88GdKKZkiy5aFSBIG969TdgXs89TKsTOiUIhLjzT39qR5YRd+u9lh0 WNApXgNg/+cdK+SaxFNOyGHhaXpgLLIYcI63IyAP6gnnCekdSyaJdrsrWTFLUlSYyAXzUxC0RfO bbnRiL9fleZHwMwx3SJVmvSRFBdxuSqQpy0KnvtnWZUbczWtE3GcclO+0xeLnS2X93VQUbeapEG 66/oXTcV3rwyCCUS/Aw== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-21_03,2026-07-21_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 adultscore=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 spamscore=0 impostorscore=0 phishscore=0 priorityscore=1501 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607210210 X-Virus-Scanned: clamav-milter 1.0.9 at in-2.smtp.seeweb.it X-Virus-Status: Clean Subject: [LTP] [PATCH v3 1/3] thp04: Simplify to focus on CVE-2017-1000405 race test only X-BeenThere: ltp@lists.linux.it X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux Test Project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ltp-bounces+ltp=archiver.kernel.org@lists.linux.it Sender: "ltp" Remove ptrace mode support from thp04.c to keep the test focused on its original purpose: testing the CVE-2017-1000405 race condition. The ptrace-based /proc/pid/mem write functionality is now covered by dedicated tests in testcases/kernel/syscalls/ptrace/: - ptrace12: Tests that CONFIG_PROC_MEM_FORCE_PTRACE blocks self-writes - ptrace13: Tests that ptrace allows parent-to-child memory writes This separation follows the principle of one test per feature and makes the test suite more maintainable. Signed-off-by: Jan Polensky --- testcases/kernel/mem/thp/thp04.c | 163 +++++++++++++++++++++---------- 1 file changed, 111 insertions(+), 52 deletions(-) diff --git a/testcases/kernel/mem/thp/thp04.c b/testcases/kernel/mem/thp/thp04.c index 16d766c349b7..c5c07b5b58d1 100644 --- a/testcases/kernel/mem/thp/thp04.c +++ b/testcases/kernel/mem/thp/thp04.c @@ -3,7 +3,7 @@ * Copyright (c) 2019 SUSE LLC */ -/* +/*\ * CVE-2017-1000405 * * Check for the Huge Dirty Cow vulnerability which allows a userspace process @@ -21,27 +21,40 @@ * On old kernel such as 4.9, it has fixed the Dirty Cow bug but a similar check * in huge_memory.c was forgotten. As a result, remote memory writes to ro regions * of memory backed by transparent huge pages cause an infinite loop in the kernel. - * While in this state the process is stil SIGKILLable, but little else works. + * While in this state the process is still SIGKILLable, but little else works. * It is also a regression test about kernel * commit 8310d48b125d("huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp"). + * + * This test uses direct writes to /proc/self/mem with fuzzy-sync to trigger + * the race condition. If direct writes are not available (e.g., when + * CONFIG_PROC_MEM_FORCE_PTRACE=y is set), the test reports TCONF. + * For ptrace-based /proc/pid/mem testing, see testcases/kernel/syscalls/ptrace/. */ -#include "tst_test.h" +#include + #include "lapi/mmap.h" #include "tst_fuzzy_sync.h" +#include "tst_test.h" -static char *write_thp, *read_thp; -static int *write_ptr, *read_ptr; -static size_t thp_size; -static int writefd = -1, readfd = -1; -static struct tst_fzsync_pair fzsync_pair; +struct thp_state { + char *write_thp; + char *read_thp; + int *write_ptr; + int *read_ptr; + size_t thp_size; + int writefd; + int readfd; + struct tst_fzsync_pair fzsync_pair; +}; -static void *alloc_zero_page(void *baseaddr) +static struct thp_state *state; + +static void *alloc_zero_page(void *baseaddr, size_t thp_size) { int i; void *ret; - /* Find aligned chunk of address space. MAP_HUGETLB doesn't work. */ for (i = 0; i < 16; i++, baseaddr += thp_size) { ret = mmap(baseaddr, thp_size, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); @@ -67,47 +80,68 @@ static void *alloc_zero_page(void *baseaddr) } tst_brk(TBROK, "Cannot map huge zero page near the specified address"); - return NULL; /* Silence compiler warning */ + return NULL; } -static void setup(void) +static void thp_cleanup(void) +{ + if (!state) + return; + + tst_fzsync_pair_cleanup(&state->fzsync_pair); + + if (state->readfd >= 0) + SAFE_CLOSE(state->readfd); + + if (state->writefd >= 0) + SAFE_CLOSE(state->writefd); + + if (state->read_thp) + SAFE_MUNMAP(state->read_thp, state->thp_size); + + if (state->write_thp) + SAFE_MUNMAP(state->write_thp, state->thp_size); +} + +static void thp_setup(void) { size_t i; - thp_size = tst_get_hugepage_size(); + state->thp_size = tst_get_hugepage_size(); - if (!thp_size) + if (!state->thp_size) tst_brk(TCONF, "Kernel does not support huge pages"); - write_thp = alloc_zero_page((void *)thp_size); + state->write_thp = alloc_zero_page((void *)state->thp_size, + state->thp_size); - for (i = 0; i < thp_size; i++) { - if (write_thp[i]) + for (i = 0; i < state->thp_size; i++) { + if (state->write_thp[i]) tst_brk(TCONF, "Huge zero page is pre-polluted"); } - /* leave a hole between read and write THP to prevent merge */ - read_thp = alloc_zero_page(write_thp + 2 * thp_size); - write_ptr = (int *)(write_thp + thp_size - sizeof(int)); - read_ptr = (int *)(read_thp + thp_size - sizeof(int)); - writefd = SAFE_OPEN("/proc/self/mem", O_RDWR); - readfd = SAFE_OPEN("/proc/self/mem", O_RDWR); + state->read_thp = alloc_zero_page(state->write_thp + 2 * state->thp_size, + state->thp_size); + state->write_ptr = (int *)(state->write_thp + state->thp_size - sizeof(int)); + state->read_ptr = (int *)(state->read_thp + state->thp_size - sizeof(int)); - fzsync_pair.exec_loops = 100000; - tst_fzsync_pair_init(&fzsync_pair); + state->writefd = SAFE_OPEN("/proc/self/mem", O_RDWR); + state->readfd = SAFE_OPEN("/proc/self/mem", O_RDWR); + state->fzsync_pair.exec_loops = 100000; + tst_fzsync_pair_init(&state->fzsync_pair); } static void *thread_run(void *arg) { int c; - while (tst_fzsync_run_b(&fzsync_pair)) { - tst_fzsync_start_race_b(&fzsync_pair); - madvise(write_thp, thp_size, MADV_DONTNEED); - memcpy(&c, write_ptr, sizeof(c)); - SAFE_LSEEK(readfd, (off_t)write_ptr, SEEK_SET); - SAFE_READ(1, readfd, &c, sizeof(int)); - tst_fzsync_end_race_b(&fzsync_pair); + while (tst_fzsync_run_b(&state->fzsync_pair)) { + tst_fzsync_start_race_b(&state->fzsync_pair); + madvise(state->write_thp, state->thp_size, MADV_DONTNEED); + memcpy(&c, state->write_ptr, sizeof(c)); + SAFE_LSEEK(state->readfd, (off_t)state->write_ptr, SEEK_SET); + SAFE_READ(1, state->readfd, &c, sizeof(int)); + tst_fzsync_end_race_b(&state->fzsync_pair); /* Wait for dirty page handling before next madvise() */ usleep(10); } @@ -119,20 +153,20 @@ static void run(void) { int c = 0xdeadbeef; - tst_fzsync_pair_reset(&fzsync_pair, thread_run); + tst_fzsync_pair_reset(&state->fzsync_pair, thread_run); - while (tst_fzsync_run_a(&fzsync_pair)) { + while (tst_fzsync_run_a(&state->fzsync_pair)) { /* Write into the main huge page */ - tst_fzsync_start_race_a(&fzsync_pair); - SAFE_LSEEK(writefd, (off_t)write_ptr, SEEK_SET); - madvise(write_thp, thp_size, MADV_DONTNEED); - SAFE_WRITE(SAFE_WRITE_ALL, writefd, &c, sizeof(int)); - tst_fzsync_end_race_a(&fzsync_pair); + tst_fzsync_start_race_a(&state->fzsync_pair); + SAFE_LSEEK(state->writefd, (off_t)state->write_ptr, SEEK_SET); + madvise(state->write_thp, state->thp_size, MADV_DONTNEED); + SAFE_WRITE(SAFE_WRITE_ALL, state->writefd, &c, sizeof(int)); + tst_fzsync_end_race_a(&state->fzsync_pair); /* Check the other huge zero page for pollution */ - madvise(read_thp, thp_size, MADV_DONTNEED); + madvise(state->read_thp, state->thp_size, MADV_DONTNEED); - if (*read_ptr != 0) { + if (*state->read_ptr != 0) { tst_res(TFAIL, "Huge zero page was polluted"); return; } @@ -141,20 +175,45 @@ static void run(void) tst_res(TPASS, "Huge zero page is still clean"); } +static void setup(void) +{ + int test_val = 0; + + state = SAFE_MMAP(NULL, sizeof(*state), PROT_READ | PROT_WRITE, + MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); + memset(state, 0, sizeof(*state)); + state->writefd = -1; + state->readfd = -1; + + thp_setup(); + + /* Verify that direct writes to /proc/self/mem work */ + TEST(lseek(state->writefd, (off_t)state->write_ptr, SEEK_SET)); + if (TST_RET == -1) + tst_brk(TBROK | TTERRNO, "lseek on /proc/self/mem failed"); + + TEST(write(state->writefd, &test_val, sizeof(test_val))); + + if (TST_RET == -1 && TST_ERR == EIO) { + tst_brk(TCONF, + "Direct writes to /proc/self/mem disabled " + "(CONFIG_PROC_MEM_FORCE_PTRACE=y). " + "See testcases/kernel/syscalls/ptrace/ptrace12 and ptrace13 for ptrace coverage."); + } + + if (TST_RET == -1) + tst_brk(TBROK | TTERRNO, "test write to /proc/self/mem failed"); + + if (TST_RET != sizeof(test_val)) + tst_brk(TBROK, "short write to /proc/self/mem: %ld bytes", TST_RET); +} + static void cleanup(void) { - tst_fzsync_pair_cleanup(&fzsync_pair); + thp_cleanup(); - if (readfd >= 0) - SAFE_CLOSE(readfd); - - if (writefd >= 0) - SAFE_CLOSE(writefd); - - if (read_thp) - SAFE_MUNMAP(read_thp, thp_size); - if (write_thp) - SAFE_MUNMAP(write_thp, thp_size); + if (state) + SAFE_MUNMAP(state, sizeof(*state)); } static struct tst_test test = { -- 2.55.0 -- Mailing list info: https://lists.linux.it/listinfo/ltp