[LTP] [PATCH v1 1/2] fsx-linux: Fix reference buffer corruption in op_map_read()

[LTP] [PATCH v1 1/2] fsx-linux: Fix reference buffer corruption in op_map_read()

[Jinseok Kim]

op_map_read() copied mmapped memory to file_buff before comparison,
overwriting the reference data. Drop the invalid memcpy().

Signed-off-by: Jinseok Kim <always.starving0@gmail.com>
---
 testcases/kernel/fs/fsx-linux/fsx-linux.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/testcases/kernel/fs/fsx-linux/fsx-linux.c b/testcases/kernel/fs/fsx-linux/fsx-linux.c
index 2e0f17a5e..21390c58c 100644
--- a/testcases/kernel/fs/fsx-linux/fsx-linux.c
+++ b/testcases/kernel/fs/fsx-linux/fsx-linux.c
@@ -219,8 +219,6 @@ static int op_map_read(void)
 		file_desc,
 		(off_t)pos.offset);

-	memcpy(file_buff + pos.offset, addr, pos.size);
-
 	int ret = memory_compare(
 		addr,
 		file_buff + pos.offset,
--
2.43.0

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v1 2/2] fsx-linux: Fix op_max_size handling in op_file_position()

[Jinseok Kim]

op_file_position() ignored op_max_size (-o option), causing operation
sizes to span up to the entire file size. Cap max_len with op_max_size
to honor the user option.

Signed-off-by: Jinseok Kim <always.starving0@gmail.com>
---
 testcases/kernel/fs/fsx-linux/fsx-linux.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/testcases/kernel/fs/fsx-linux/fsx-linux.c b/testcases/kernel/fs/fsx-linux/fsx-linux.c
index 21390c58c..81aca5dab 100644
--- a/testcases/kernel/fs/fsx-linux/fsx-linux.c
+++ b/testcases/kernel/fs/fsx-linux/fsx-linux.c
@@ -77,9 +77,15 @@ static void op_file_position(
 	struct file_pos_t *pos)
 {
 	long long diff;
+	long long max_len;

 	pos->offset = random() % fsize;
-	pos->size = random() % (fsize - pos->offset);
+
+	max_len = fsize - pos->offset;
+	if (max_len > op_max_size)
+		max_len = op_max_size;
+
+	pos->size = random() % max_len;

 	diff = pos->offset % align;

--
2.43.0

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] fsx-linux: Fix reference buffer corruption in op_map_read()

[linuxtestproject.agent]

Hi Jinseok,

On Tue, 18 Aug 2026, Jinseok Kim wrote:
> fsx-linux: Fix reference buffer corruption in op_map_read()

--- [PATCH 2/2] ---

> +	max_len = fsize - pos->offset;
> +	if (max_len > op_max_size)
> +		max_len = op_max_size;
> +
> +	pos->size = random() % max_len;
>
> 	diff = pos->offset % align;
>
> 	if (diff) {
> 		pos->offset -= diff;
> 		pos->size += diff;
> 	}

Could the offset be aligned before max_len is calculated, or could the final
size be capped after alignment?

The new cap bounds pos->size only before offset % align is added back. With
-o 1 -w 4096, pos->size starts at zero and can then grow to 4095 bytes, so
-o still is not an upper bound. This also affects the existing fsx05 entry,
which combines -o 1024 with -w 4096.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp