[LTP] [PATCH 0/3] Fix bugs in LTP core library

[LTP] [PATCH 0/3] Fix bugs in LTP core library

[Andrea Cervesato]

These bugs were found by LLM long time ago, after asking to check for
errors in memory management and general usage. An in-depth analysis was
not done, because these were mostly cases where LTP might produce false
positives or crash the application. Keep it simple.

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
Andrea Cervesato (3):
      lib: Avoid loop_info.lo_name buffer overflow
      lib: Close directory fd on ENOSPC in tst_fill_fs
      lib: Fix wrong field in tst_iovec_alloc

 lib/tst_buffers.c | 2 +-
 lib/tst_device.c  | 2 +-
 lib/tst_fill_fs.c | 1 +
 3 files changed, 3 insertions(+), 2 deletions(-)
---
base-commit: a67fe5f7b20492ff6ee7f4b1776a7579d4b3859b
change-id: 20260717-fix_core_library-c9fef66bd8df

Best regards,
-- 
Andrea Cervesato <andrea.cervesato@suse.com>


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH 1/3] lib: Avoid loop_info.lo_name buffer overflow

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

The backing file path may be longer than the fixed-size lo_name field,
so an unbounded strcpy() can overflow the loop_info structure. Copy at
most the field size and rely on the preceding memset() for termination.

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 lib/tst_device.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tst_device.c b/lib/tst_device.c
index d3c53a1a18d2e4948ebff21d6d66c0ccd1590c6f..b5c3ccdb7be52ce600fbd7d7a83f6081df65d616 100644
--- a/lib/tst_device.c
+++ b/lib/tst_device.c
@@ -182,7 +182,7 @@ int tst_attach_device(const char *dev, const char *file)
 	 * LOOP_SET_FD and LOOP_SET_STATUS.
 	 */
 	memset(&loopinfo, 0, sizeof(loopinfo));
-	strcpy(loopinfo.lo_name, file);
+	strncpy(loopinfo.lo_name, file, sizeof(loopinfo.lo_name) - 1);
 
 	if (ioctl(dev_fd, LOOP_SET_STATUS, &loopinfo)) {
 		close(dev_fd);

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] lib: Avoid loop_info.lo_name buffer overflow

[linuxtestproject.agent]

Hi Andrea,

On Fri, 17 Jul 2026 14:33:18 +0200, Andrea Cervesato wrote:
> lib: Avoid loop_info.lo_name buffer overflow

Verdict - Reviewed

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH 1/3] lib: Avoid loop_info.lo_name buffer overflow

[Petr Vorel]

> From: Andrea Cervesato <andrea.cervesato@suse.com>

> The backing file path may be longer than the fixed-size lo_name field,
> so an unbounded strcpy() can overflow the loop_info structure. Copy at
> most the field size and rely on the preceding memset() for termination.

> Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
> ---
>  lib/tst_device.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

> diff --git a/lib/tst_device.c b/lib/tst_device.c
> index d3c53a1a18d2e4948ebff21d6d66c0ccd1590c6f..b5c3ccdb7be52ce600fbd7d7a83f6081df65d616 100644
> --- a/lib/tst_device.c
> +++ b/lib/tst_device.c
> @@ -182,7 +182,7 @@ int tst_attach_device(const char *dev, const char *file)
>  	 * LOOP_SET_FD and LOOP_SET_STATUS.
>  	 */
>  	memset(&loopinfo, 0, sizeof(loopinfo));
> -	strcpy(loopinfo.lo_name, file);
> +	strncpy(loopinfo.lo_name, file, sizeof(loopinfo.lo_name) - 1);

Reviewed-by: Petr Vorel <pvorel@suse.cz>

I suppose strncpy() is recommended as safer alternative to strcpy(),
right? Shouldn't we check for strlen(file) is not longer than
sizeof(loopinfo.lo_name) -1 while we are at it?

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH 1/3] lib: Avoid loop_info.lo_name buffer overflow

[Andrea Cervesato via ltp]

Hi Petr,

> I suppose strncpy() is recommended as safer alternative to strcpy(),
> right? Shouldn't we check for strlen(file) is not longer than
> sizeof(loopinfo.lo_name) -1 while we are at it?

we don't need to check for strlen(file) because strncpy() copy
min(strlen(loopinfo.lo_name), strlen(file)) chars at max.

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH 1/3] lib: Avoid loop_info.lo_name buffer overflow

[Petr Vorel]

> Hi Petr,

> > I suppose strncpy() is recommended as safer alternative to strcpy(),
> > right? Shouldn't we check for strlen(file) is not longer than
> > sizeof(loopinfo.lo_name) -1 while we are at it?

> we don't need to check for strlen(file) because strncpy() copy
> min(strlen(loopinfo.lo_name), strlen(file)) chars at max.

I mean if file is longer, then only part will be copied and following ioctl()
will fail, right? Therefore warning about too long name would help.

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH 1/3] lib: Avoid loop_info.lo_name buffer overflow

[Andrea Cervesato via ltp]

> I mean if file is longer, then only part will be copied and following ioctl()
> will fail, right? Therefore warning about too long name would help.

sure, we can add that

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH 2/3] lib: Close directory fd on ENOSPC in tst_fill_fs

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

The directory descriptor opened at the top of the function was leaked
when openat() failed with ENOSPC and the function returned early. Close
it before returning.

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 lib/tst_fill_fs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/tst_fill_fs.c b/lib/tst_fill_fs.c
index c62d48e289965d59ef6c877870c6047bbecb33da..b1e48fdeea6ab00848aab482fd3899fc6f6ce23c 100644
--- a/lib/tst_fill_fs.c
+++ b/lib/tst_fill_fs.c
@@ -91,6 +91,7 @@ static void fill_flat_vec(const char *path, int verbose)
 	if (fd == -1) {
 		if (errno == ENOSPC) {
 			tst_res(TINFO | TERRNO, "openat()");
+			SAFE_CLOSE(dir);
 			return;
 		}
 		tst_brk(TBROK | TERRNO, "openat(%d, %d, 0600) failed for path %s",

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH 2/3] lib: Close directory fd on ENOSPC in tst_fill_fs

[Petr Vorel]

Hi Andrea,

> The directory descriptor opened at the top of the function was leaked
> when openat() failed with ENOSPC and the function returned early. Close
> it before returning.

> Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
> ---
>  lib/tst_fill_fs.c | 1 +
>  1 file changed, 1 insertion(+)

> diff --git a/lib/tst_fill_fs.c b/lib/tst_fill_fs.c
> index c62d48e289965d59ef6c877870c6047bbecb33da..b1e48fdeea6ab00848aab482fd3899fc6f6ce23c 100644
> --- a/lib/tst_fill_fs.c
> +++ b/lib/tst_fill_fs.c
> @@ -91,6 +91,7 @@ static void fill_flat_vec(const char *path, int verbose)
>  	if (fd == -1) {
>  		if (errno == ENOSPC) {
>  			tst_res(TINFO | TERRNO, "openat()");
> +			SAFE_CLOSE(dir);
Good catch!
Reviewed-by: Petr Vorel <pvorel@suse.cz>

Kind regards,
Petr
>  			return;
>  		}

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH 3/3] lib: Fix wrong field in tst_iovec_alloc

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

The zero-size branch assigned iov_base twice and left iov_len unset,
clearly a copy-paste typo. Set iov_len to 0 as intended.

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 lib/tst_buffers.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tst_buffers.c b/lib/tst_buffers.c
index ac76a784bb7060ad46815310b56b2a4229bfd395..048b322457c3173df61e0617ad0bc190581c78a7 100644
--- a/lib/tst_buffers.c
+++ b/lib/tst_buffers.c
@@ -123,7 +123,7 @@ struct iovec *tst_iovec_alloc(int sizes[])
 			iovec[i].iov_len = sizes[i];
 		} else {
 			iovec[i].iov_base = NULL;
-			iovec[i].iov_base = 0;
+			iovec[i].iov_len = 0;
 		}
 	}
 

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH 3/3] lib: Fix wrong field in tst_iovec_alloc

[Petr Vorel]

Hi Andrea,

...
>  			iovec[i].iov_base = NULL;
> -			iovec[i].iov_base = 0;
> +			iovec[i].iov_len = 0;

Good catch!
Reviewed-by: Petr Vorel <pvorel@suse.cz>
Fixes: ee761d81b9 ("lib: Add support for guarded buffers")

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH 0/3] Fix bugs in LTP core library

[Andrea Cervesato via ltp]

Merged, Thanks!

With suggested @Petr feedback on tst_attach_device:


int tst_attach_device(const char *dev, const char *file)
{
  ...

	if (strlen(file) >= LO_NAME_SIZE) {
		tst_brkm(TBROK, NULL, "Device name can't be longer than %u chars",
			 LO_NAME_SIZE);
	}

  ...
}

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp