Re: [LTP] thp04: Add ptrace support for CONFIG_PROC_MEM_FORCE_PTRACE=y

[linuxtestproject.agent@gmail.com]

Hi Jan,

On Tue, 7 Jul 2026 18:00:22 +0200, Jan Polensky wrote:
> thp04: Add ptrace support for CONFIG_PROC_MEM_FORCE_PTRACE=y

> - Restores lapi/mmap.h for MADV_* fallback definitions

The diff shows lapi/mmap.h was already present in the original file
and was not removed or re-added by this patch. "Restores" is
inaccurate here.

> +static void setup_ptrace_tracee(void)
> +{
> +	int status;
> +
> +	/* Test-loop state is initialized once and read-only afterwards. */
> +	child = SAFE_MMAP(NULL, sizeof(*child), PROT_READ | PROT_WRITE,
> +		MAP_SHARED | MAP_ANONYMOUS, -1, 0);
> +	memset(child, 0, sizeof(*child));
> +	child->writefd = -1;
> +	child->readfd = -1;
> +
> +	tracee_pid = SAFE_FORK();
> +	if (!tracee_pid) {
> +		tracee_main();
> +		exit(0);
> +	}
> +
> +	TST_CHECKPOINT_WAIT(0);
> +
> +	SAFE_PTRACE(PTRACE_SEIZE, tracee_pid, NULL, NULL);
> +
> +	/*
> +	 * Tracee will run first iteration (madvise + check) and self-stop
> +	 * with raise(SIGSTOP). Wait for that SIGSTOP - this is iteration 0.
> +	 */
> +	SAFE_WAITPID(tracee_pid, &status, 0);

There is a race here. After TST_CHECKPOINT_WAKE(0) the tracee runs the
for(;;) body immediately and calls raise(SIGSTOP). If that raise()
fires before PTRACE_SEIZE executes in the parent, the SIGSTOP causes a
job-control stop (T state), not a ptrace-stop. PTRACE_SEIZE on an
already-T-stopped process does not generate a new ptrace event.

SAFE_WAITPID(..., 0) without WUNTRACED cannot see a job-control stop,
so the parent hangs indefinitely.

The comment "Parent will PTRACE_CONT us when ready - no checkpoint
needed" assumes PTRACE_SEIZE always wins the race, which is not
guaranteed, especially on a loaded system.

A second checkpoint (wake from parent after PTRACE_SEIZE completes,
wait in tracee before the first loop iteration) would close the window.

> +/*
>   * CVE-2017-1000405
>   *
> [...]
> + * Test Modes:
> + *
> + * PROC_MEM_ALWAYS: Direct writes to /proc/self/mem ...

The patch modifies this description block. The required opening for an
LTP high-level description block is /*\ (with a backslash), not /*.
The block is exported to the test catalog and must use the /*\ form.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp