From: Avinesh Kumar via ltp <ltp@lists.linux.it>
To: ltp@lists.linux.it
Subject: [LTP] [PATCH] openposix: timer_*/speculative: Handle SIGSEGV on invalid timer ID
Date: Fri, 7 Aug 2026 22:12:08 +0200 [thread overview]
Message-ID: <20260807201209.116225-1-avinesh.kumar@suse.com> (raw)
From: Avinesh Kumar <avinesh.kumar@suse.com>
timer_delete/speculative/5-1, timer_getoverrun/speculative/6-1,
timer_gettime/speculative/6-1 and timer_settime/speculative/12-1
all pass a bogus value as an invalid timer_t timerid.
On i586, glibc dereferences timer_t as a pointer into
internal state, and the bogus pointer causes a SIGSEGV
instead of the tests' expected EINVAL:
timer_delete_sp[22499]: segfault at 7f4982f0 ip b7e07824 sp bfa4c140 error 4 in libc.so.6[a4824,b7d87000+191000]
POSIX defines no required behavior for an invalid timer ID (EINVAL is
only a recommendation), so a SIGSEGV is just as valid an outcome.
Signed-off-by: Avinesh Kumar <avinesh.kumar@suse.com>
---
.../interfaces/timer_delete/speculative/5-1.c | 19 ++++++++++++++++++
.../timer_getoverrun/speculative/6-1.c | 19 ++++++++++++++++++
.../timer_gettime/speculative/6-1.c | 20 +++++++++++++++++++
.../timer_settime/speculative/12-1.c | 20 +++++++++++++++++++
4 files changed, 78 insertions(+)
diff --git a/testcases/open_posix_testsuite/conformance/interfaces/timer_delete/speculative/5-1.c b/testcases/open_posix_testsuite/conformance/interfaces/timer_delete/speculative/5-1.c
index 912cf5800e6f..fb46c3e7dabb 100644
--- a/testcases/open_posix_testsuite/conformance/interfaces/timer_delete/speculative/5-1.c
+++ b/testcases/open_posix_testsuite/conformance/interfaces/timer_delete/speculative/5-1.c
@@ -12,17 +12,36 @@
#include <time.h>
#include <stdio.h>
+#include <stdlib.h>
#include <errno.h>
+#include <signal.h>
#include "posixtest.h"
#define BOGUSTIMERID 99999
+/*
+ * when timerid argument does not correspond to a timer ID returned by
+ * timer_create(), POSIX recommends EINVAL, but SIGSEGV is also
+ * valid outcome.
+ */
+static void sigsegv_handler(int signum PTS_ATTRIBUTE_UNUSED)
+{
+ printf("Got SIGSEGV when calling timer_delete() with an invalid timer ID\n");
+ printf("Test PASSED\n");
+ exit(PTS_PASS);
+}
+
int test_main(int argc PTS_ATTRIBUTE_UNUSED, char **argv PTS_ATTRIBUTE_UNUSED)
{
timer_t tid;
int tval = BOGUSTIMERID;
+ struct sigaction sa = { .sa_handler = sigsegv_handler };
+
tid = (timer_t) & tval;
+ sigfillset(&sa.sa_mask);
+ sigaction(SIGSEGV, &sa, NULL);
+
if (timer_delete(tid) == -1) {
if (errno == EINVAL) {
printf
diff --git a/testcases/open_posix_testsuite/conformance/interfaces/timer_getoverrun/speculative/6-1.c b/testcases/open_posix_testsuite/conformance/interfaces/timer_getoverrun/speculative/6-1.c
index 6e18560e5084..429b08379e9c 100644
--- a/testcases/open_posix_testsuite/conformance/interfaces/timer_getoverrun/speculative/6-1.c
+++ b/testcases/open_posix_testsuite/conformance/interfaces/timer_getoverrun/speculative/6-1.c
@@ -12,17 +12,36 @@
#include <time.h>
#include <stdio.h>
+#include <stdlib.h>
#include <errno.h>
+#include <signal.h>
#include "posixtest.h"
#define BOGUSTID 9999
+/*
+ * when timerid argument does not correspond to a timer ID returned by
+ * timer_create(), POSIX recommends EINVAL, but SIGSEGV is also
+ * valid outcome.
+ */
+static void sigsegv_handler(int signum PTS_ATTRIBUTE_UNUSED)
+{
+ printf("Got SIGSEGV when calling timer_getoverrun() with an invalid timer ID\n");
+ printf("Test PASSED\n");
+ exit(PTS_PASS);
+}
+
int test_main(int argc PTS_ATTRIBUTE_UNUSED, char **argv PTS_ATTRIBUTE_UNUSED)
{
timer_t tid;
int tval = BOGUSTID;
+ struct sigaction sa = { .sa_handler = sigsegv_handler };
+
tid = (timer_t) & tval;
+ sigfillset(&sa.sa_mask);
+ sigaction(SIGSEGV, &sa, NULL);
+
if (timer_getoverrun(tid) == -1) {
if (EINVAL == errno) {
printf("fcn returned -1 and errno=EINVAL\n");
diff --git a/testcases/open_posix_testsuite/conformance/interfaces/timer_gettime/speculative/6-1.c b/testcases/open_posix_testsuite/conformance/interfaces/timer_gettime/speculative/6-1.c
index d09c2f70901d..c124497153a9 100644
--- a/testcases/open_posix_testsuite/conformance/interfaces/timer_gettime/speculative/6-1.c
+++ b/testcases/open_posix_testsuite/conformance/interfaces/timer_gettime/speculative/6-1.c
@@ -12,17 +12,37 @@
#include <time.h>
#include <stdio.h>
+#include <stdlib.h>
#include <errno.h>
+#include <signal.h>
#include "posixtest.h"
#define BOGUSTID 9999
+/*
+ * when timerid argument does not correspond to a timer ID returned by
+ * timer_create(), POSIX recommends EINVAL, but SIGSEGV is also
+ * valid outcome.
+ */
+static void sigsegv_handler(int signum PTS_ATTRIBUTE_UNUSED)
+{
+ printf("Got SIGSEGV when calling timer_gettime() with an invalid timer ID\n");
+ printf("Test PASSED\n");
+ exit(PTS_PASS);
+}
+
int test_main(int argc PTS_ATTRIBUTE_UNUSED, char **argv PTS_ATTRIBUTE_UNUSED)
{
timer_t tid;
struct itimerspec its;
int tval = BOGUSTID;
+ struct sigaction sa = { .sa_handler = sigsegv_handler };
+
tid = (timer_t) & tval;
+
+ sigfillset(&sa.sa_mask);
+ sigaction(SIGSEGV, &sa, NULL);
+
if (timer_gettime(tid, &its) == -1) {
if (EINVAL == errno) {
printf("fcn returned -1 and errno==EINVAL\n");
diff --git a/testcases/open_posix_testsuite/conformance/interfaces/timer_settime/speculative/12-1.c b/testcases/open_posix_testsuite/conformance/interfaces/timer_settime/speculative/12-1.c
index 5d4e1dda30ba..056f75448ea8 100644
--- a/testcases/open_posix_testsuite/conformance/interfaces/timer_settime/speculative/12-1.c
+++ b/testcases/open_posix_testsuite/conformance/interfaces/timer_settime/speculative/12-1.c
@@ -11,17 +11,37 @@
#include <time.h>
#include <stdio.h>
+#include <stdlib.h>
#include <errno.h>
+#include <signal.h>
#include "posixtest.h"
#define BOGUSTID 9999
+/*
+ * when timerid argument does not correspond to a timer ID returned by
+ * timer_create(), POSIX recommends EINVAL, but SIGSEGV is also
+ * valid outcome.
+ */
+static void sigsegv_handler(int signum PTS_ATTRIBUTE_UNUSED)
+{
+ printf("Got SIGSEGV when calling timer_settime() with an invalid timer ID\n");
+ printf("Test PASSED\n");
+ exit(PTS_PASS);
+}
+
int test_main(int argc PTS_ATTRIBUTE_UNUSED, char **argv PTS_ATTRIBUTE_UNUSED)
{
timer_t tid;
struct itimerspec its;
int tval = BOGUSTID;
+ struct sigaction sa = { .sa_handler = sigsegv_handler };
+
tid = (timer_t) & tval;
+
+ sigfillset(&sa.sa_mask);
+ sigaction(SIGSEGV, &sa, NULL);
+
its.it_interval.tv_sec = 0;
its.it_interval.tv_nsec = 0;
its.it_value.tv_sec = 0;
--
2.55.0
--
Mailing list info: https://lists.linux.it/listinfo/ltp
next reply other threads:[~2026-08-07 20:12 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-07 20:12 Avinesh Kumar via ltp [this message]
2026-08-07 20:42 ` [LTP] openposix: timer_*/speculative: Handle SIGSEGV on invalid timer ID linuxtestproject.agent
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260807201209.116225-1-avinesh.kumar@suse.com \
--to=ltp@lists.linux.it \
--cc=avinesh.kumar@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.