[LTP] [PATCH v2] openposix: timer_*/speculative: Handle SIGSEGV on invalid timer ID

[LTP] [PATCH v2] openposix: timer_*/speculative: Handle SIGSEGV on invalid timer ID

[Avinesh Kumar via ltp]

From: Avinesh Kumar <avinesh.kumar@suse.com>

timer_delete/speculative/5-1, timer_getoverrun/speculative/6-1,
timer_gettime/speculative/6-1 and timer_settime/speculative/12-1
all pass a bogus value as an invalid timer_t timerid.
On i586, glibc dereferences timer_t as a pointer into
internal state, and the bogus pointer causes a SIGSEGV
instead of the tests' expected EINVAL:

  timer_delete_sp[22499]: segfault at 7f4982f0 ip b7e07824 sp bfa4c140 error 4 in libc.so.6[a4824,b7d87000+191000]

POSIX defines no required behavior for an invalid timer ID (EINVAL is
only a recommendation), so a SIGSEGV is just as valid an outcome.

Signed-off-by: Avinesh Kumar <avinesh.kumar@suse.com>
---
 .../interfaces/timer_delete/speculative/5-1.c | 19 ++++++++++++++++++
 .../timer_getoverrun/speculative/6-1.c        | 19 ++++++++++++++++++
 .../timer_gettime/speculative/6-1.c           | 20 +++++++++++++++++++
 .../timer_settime/speculative/12-1.c          | 20 +++++++++++++++++++
 4 files changed, 78 insertions(+)

diff --git a/testcases/open_posix_testsuite/conformance/interfaces/timer_delete/speculative/5-1.c b/testcases/open_posix_testsuite/conformance/interfaces/timer_delete/speculative/5-1.c
index 912cf5800e6f..af01f72a59d1 100644
--- a/testcases/open_posix_testsuite/conformance/interfaces/timer_delete/speculative/5-1.c
+++ b/testcases/open_posix_testsuite/conformance/interfaces/timer_delete/speculative/5-1.c
@@ -13,16 +13,35 @@
 #include <time.h>
 #include <stdio.h>
 #include <errno.h>
+#include <signal.h>
+#include <unistd.h>
 #include "posixtest.h"
 
 #define BOGUSTIMERID 99999
 
+/*
+ * when timerid argument does not correspond to a timer ID returned by
+ * timer_create(), POSIX recommends EINVAL, but SIGSEGV is also
+ * valid outcome.
+ */
+static void sigsegv_handler(int signum PTS_ATTRIBUTE_UNUSED)
+{
+	PTS_WRITE_MSG("Got SIGSEGV when calling timer_delete() with an invalid timer ID\n");
+	PTS_WRITE_MSG("Test PASSED\n");
+	_exit(PTS_PASS);
+}
+
 int test_main(int argc PTS_ATTRIBUTE_UNUSED, char **argv PTS_ATTRIBUTE_UNUSED)
 {
 	timer_t tid;
 	int tval = BOGUSTIMERID;
+	struct sigaction sa = { .sa_handler = sigsegv_handler };
+
 	tid = (timer_t) & tval;
 
+	sigfillset(&sa.sa_mask);
+	sigaction(SIGSEGV, &sa, NULL);
+
 	if (timer_delete(tid) == -1) {
 		if (errno == EINVAL) {
 			printf
diff --git a/testcases/open_posix_testsuite/conformance/interfaces/timer_getoverrun/speculative/6-1.c b/testcases/open_posix_testsuite/conformance/interfaces/timer_getoverrun/speculative/6-1.c
index 6e18560e5084..faaa4bc09329 100644
--- a/testcases/open_posix_testsuite/conformance/interfaces/timer_getoverrun/speculative/6-1.c
+++ b/testcases/open_posix_testsuite/conformance/interfaces/timer_getoverrun/speculative/6-1.c
@@ -13,16 +13,35 @@
 #include <time.h>
 #include <stdio.h>
 #include <errno.h>
+#include <signal.h>
+#include <unistd.h>
 #include "posixtest.h"
 
 #define BOGUSTID 9999
 
+/*
+ * when timerid argument does not correspond to a timer ID returned by
+ * timer_create(), POSIX recommends EINVAL, but SIGSEGV is also
+ * valid outcome.
+ */
+static void sigsegv_handler(int signum PTS_ATTRIBUTE_UNUSED)
+{
+	PTS_WRITE_MSG("Got SIGSEGV when calling timer_getoverrun() with an invalid timer ID\n");
+	PTS_WRITE_MSG("Test PASSED\n");
+	_exit(PTS_PASS);
+}
+
 int test_main(int argc PTS_ATTRIBUTE_UNUSED, char **argv PTS_ATTRIBUTE_UNUSED)
 {
 	timer_t tid;
 	int tval = BOGUSTID;
+	struct sigaction sa = { .sa_handler = sigsegv_handler };
+
 	tid = (timer_t) & tval;
 
+	sigfillset(&sa.sa_mask);
+	sigaction(SIGSEGV, &sa, NULL);
+
 	if (timer_getoverrun(tid) == -1) {
 		if (EINVAL == errno) {
 			printf("fcn returned -1 and errno=EINVAL\n");
diff --git a/testcases/open_posix_testsuite/conformance/interfaces/timer_gettime/speculative/6-1.c b/testcases/open_posix_testsuite/conformance/interfaces/timer_gettime/speculative/6-1.c
index d09c2f70901d..91c8aaad59c6 100644
--- a/testcases/open_posix_testsuite/conformance/interfaces/timer_gettime/speculative/6-1.c
+++ b/testcases/open_posix_testsuite/conformance/interfaces/timer_gettime/speculative/6-1.c
@@ -13,16 +13,36 @@
 #include <time.h>
 #include <stdio.h>
 #include <errno.h>
+#include <signal.h>
+#include <unistd.h>
 #include "posixtest.h"
 
 #define BOGUSTID 9999
 
+/*
+ * when timerid argument does not correspond to a timer ID returned by
+ * timer_create(), POSIX recommends EINVAL, but SIGSEGV is also
+ * valid outcome.
+ */
+static void sigsegv_handler(int signum PTS_ATTRIBUTE_UNUSED)
+{
+	PTS_WRITE_MSG("Got SIGSEGV when calling timer_gettime() with an invalid timer ID\n");
+	PTS_WRITE_MSG("Test PASSED\n");
+	_exit(PTS_PASS);
+}
+
 int test_main(int argc PTS_ATTRIBUTE_UNUSED, char **argv PTS_ATTRIBUTE_UNUSED)
 {
 	timer_t tid;
 	struct itimerspec its;
 	int tval = BOGUSTID;
+	struct sigaction sa = { .sa_handler = sigsegv_handler };
+
 	tid = (timer_t) & tval;
+
+	sigfillset(&sa.sa_mask);
+	sigaction(SIGSEGV, &sa, NULL);
+
 	if (timer_gettime(tid, &its) == -1) {
 		if (EINVAL == errno) {
 			printf("fcn returned -1 and errno==EINVAL\n");
diff --git a/testcases/open_posix_testsuite/conformance/interfaces/timer_settime/speculative/12-1.c b/testcases/open_posix_testsuite/conformance/interfaces/timer_settime/speculative/12-1.c
index 5d4e1dda30ba..092ca723975d 100644
--- a/testcases/open_posix_testsuite/conformance/interfaces/timer_settime/speculative/12-1.c
+++ b/testcases/open_posix_testsuite/conformance/interfaces/timer_settime/speculative/12-1.c
@@ -12,16 +12,36 @@
 #include <time.h>
 #include <stdio.h>
 #include <errno.h>
+#include <signal.h>
+#include <unistd.h>
 #include "posixtest.h"
 
 #define BOGUSTID 9999
 
+/*
+ * when timerid argument does not correspond to a timer ID returned by
+ * timer_create(), POSIX recommends EINVAL, but SIGSEGV is also
+ * valid outcome.
+ */
+static void sigsegv_handler(int signum PTS_ATTRIBUTE_UNUSED)
+{
+	PTS_WRITE_MSG("Got SIGSEGV when calling timer_settime() with an invalid timer ID\n");
+	PTS_WRITE_MSG("Test PASSED\n");
+	_exit(PTS_PASS);
+}
+
 int test_main(int argc PTS_ATTRIBUTE_UNUSED, char **argv PTS_ATTRIBUTE_UNUSED)
 {
 	timer_t tid;
 	struct itimerspec its;
 	int tval = BOGUSTID;
+	struct sigaction sa = { .sa_handler = sigsegv_handler };
+
 	tid = (timer_t) & tval;
+
+	sigfillset(&sa.sa_mask);
+	sigaction(SIGSEGV, &sa, NULL);
+
 	its.it_interval.tv_sec = 0;
 	its.it_interval.tv_nsec = 0;
 	its.it_value.tv_sec = 0;
-- 
2.55.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] openposix: timer_*/speculative: Handle SIGSEGV on invalid timer ID

[linuxtestproject.agent]

Hi Avinesh,

On Sat, 8 Aug 2026 17:03:31 +0200, Avinesh Kumar wrote:
> openposix: timer_*/speculative: Handle SIGSEGV on invalid timer ID

Verdict - Reviewed

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v2] openposix: timer_*/speculative: Handle SIGSEGV on invalid timer ID

[Petr Vorel]

Hi Avines,

> timer_delete/speculative/5-1, timer_getoverrun/speculative/6-1,
> timer_gettime/speculative/6-1 and timer_settime/speculative/12-1
> all pass a bogus value as an invalid timer_t timerid.
> On i586, glibc dereferences timer_t as a pointer into
> internal state, and the bogus pointer causes a SIGSEGV
> instead of the tests' expected EINVAL:

>   timer_delete_sp[22499]: segfault at 7f4982f0 ip b7e07824 sp bfa4c140 error 4 in libc.so.6[a4824,b7d87000+191000]

Good catch, thanks!

> POSIX defines no required behavior for an invalid timer ID (EINVAL is
> only a recommendation), so a SIGSEGV is just as valid an outcome.

> Signed-off-by: Avinesh Kumar <avinesh.kumar@suse.com>
> ---
>  .../interfaces/timer_delete/speculative/5-1.c | 19 ++++++++++++++++++
>  .../timer_getoverrun/speculative/6-1.c        | 19 ++++++++++++++++++
>  .../timer_gettime/speculative/6-1.c           | 20 +++++++++++++++++++
>  .../timer_settime/speculative/12-1.c          | 20 +++++++++++++++++++
>  4 files changed, 78 insertions(+)

> diff --git a/testcases/open_posix_testsuite/conformance/interfaces/timer_delete/speculative/5-1.c b/testcases/open_posix_testsuite/conformance/interfaces/timer_delete/speculative/5-1.c
> index 912cf5800e6f..af01f72a59d1 100644
> --- a/testcases/open_posix_testsuite/conformance/interfaces/timer_delete/speculative/5-1.c
> +++ b/testcases/open_posix_testsuite/conformance/interfaces/timer_delete/speculative/5-1.c
> @@ -13,16 +13,35 @@
>  #include <time.h>
>  #include <stdio.h>
>  #include <errno.h>
> +#include <signal.h>
> +#include <unistd.h>
>  #include "posixtest.h"

>  #define BOGUSTIMERID 99999

> +/*
> + * when timerid argument does not correspond to a timer ID returned by
> + * timer_create(), POSIX recommends EINVAL, but SIGSEGV is also
> + * valid outcome.
> + */
> +static void sigsegv_handler(int signum PTS_ATTRIBUTE_UNUSED)
> +{
> +	PTS_WRITE_MSG("Got SIGSEGV when calling timer_delete() with an invalid timer ID\n");
> +	PTS_WRITE_MSG("Test PASSED\n");
> +	_exit(PTS_PASS);
> +}

I'm not sure if the approach of creating bogus timer_t is a good idea anyway.
Shouldn't be just some timer_t tid set to invalid value? That would IMHO be
less awkward solution.

That would help not having to fallback due SIGSEGV which 1) can happen on any
arch (covered because fix is not i686 specific) 2) test is simple but any
potential SIGSEGV.

And, if we want to use kind of bad pointer, shouldn't we backport
tst_get_bad_addr() from lib/tst_get_bad_addr.c?

void *tst_get_bad_addr(void (*cleanup_fn) (void))
{
	void *bad_addr;

	bad_addr = mmap(0, 1, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
	if (bad_addr == MAP_FAILED)
		tst_brkm(TBROK, cleanup_fn, "mmap() failed to get bad address");

	return bad_addr;
}

Tests which are using this it does not SIGSEGV.

nit: if the current approach is ok, even the function is small, it's in 4 files.
We have general helpers in testcases/open_posix_testsuite/include/,
sigsegv_handler() could be in one of them (I'd omit function name, which is test
specific).

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v2] openposix: timer_*/speculative: Handle SIGSEGV on invalid timer ID

[Cyril Hrubis]

Hi!
> I'm not sure if the approach of creating bogus timer_t is a good idea anyway.
> Shouldn't be just some timer_t tid set to invalid value? That would IMHO be
> less awkward solution.

There is no documented invalid value. It's a opaque handle we get from
libc and different versions of libc interpret the value differently.
Sometimes it's a pointer, sometimes it is not and we have no idea what
it is until we try to pass it to the timer functions.

So choosing safe enough safe value and handling SIGSEGV is probably the
best we can do.

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v2] openposix: timer_*/speculative: Handle SIGSEGV on invalid timer ID

[Petr Vorel]

Hi Cyril,

> Hi!
> > I'm not sure if the approach of creating bogus timer_t is a good idea anyway.
> > Shouldn't be just some timer_t tid set to invalid value? That would IMHO be
> > less awkward solution.

> There is no documented invalid value. It's a opaque handle we get from
> libc and different versions of libc interpret the value differently.
> Sometimes it's a pointer, sometimes it is not and we have no idea what
> it is until we try to pass it to the timer functions.

> So choosing safe enough safe value and handling SIGSEGV is probably the
> best we can do.

Thanks for correcting me, fair enough. I guess we don't bother with factoring
out function into include/.

Reviewed-by: Petr Vorel <pvorel@suse.cz>

Will you add your RBT/ABT?

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v2] openposix: timer_*/speculative: Handle SIGSEGV on invalid timer ID

[Petr Vorel]

> Hi!
> > I'm not sure if the approach of creating bogus timer_t is a good idea anyway.
> > Shouldn't be just some timer_t tid set to invalid value? That would IMHO be
> > less awkward solution.

> There is no documented invalid value. It's a opaque handle we get from
> libc and different versions of libc interpret the value differently.
> Sometimes it's a pointer, sometimes it is not and we have no idea what
> it is until we try to pass it to the timer functions.

> So choosing safe enough safe value and handling SIGSEGV is probably the
> best we can do.

I trust Cyril that this is safer.

FYI, not sure how much relevant, but the change was reported by Rich Felker
(musl author) in 2013 [1]. IEEE Std 1003.1-2008, 2016 Edition is the first
standard which introduced it as an undefined behavior [2]:

	The behavior is undefined if the value specified by the timerid argument to
	timer_delete() does not correspond to a timer ID returned by timer_create()
	but not yet deleted by timer_delete().

The last standard *without* is IEEE Std 1003.1, 2013 Edition [3].

Kind regards,
Petr

[1] https://austingroupbugs.net/view.php?id=659
[2] https://pubs.opengroup.org/onlinepubs/9699919799.2016edition/functions/timer_delete.html
[3] https://pubs.opengroup.org/onlinepubs/9699919799.2013edition/functions/timer_delete.html

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp