Linux Test Project
 help / color / mirror / Atom feed
From: linuxtestproject.agent@gmail.com
To: Andrea Cervesato <andrea.cervesato@suse.de>
Cc: ltp@lists.linux.it
Subject: Re: [LTP] sched_setattr01: Convert to new API
Date: Thu,  3 Sep 2026 16:04:11 +0000	[thread overview]
Message-ID: <20260903160411.9148-1-linuxtestproject.agent@gmail.com> (raw)
In-Reply-To: <20260903-cve-ghostlock-v7-1-771e99aa3057@suse.com>

Hi Andrea,

On Thu, Sep 3, 2026, Andrea Cervesato wrote:
> sched_setattr01: Convert to new API

--- [PATCH 4/5] ---

> +#ifndef PR_SET_MM_MAP
> +# define PR_SET_MM_MAP	14
> +#endif

PR_SET_MM_MAP_SIZE is listed in the commit message but is not defined here.
Add its UAPI value, 15, alongside PR_SET_MM_MAP.

--- [PATCH 5/5] ---

> +	map.start_code = map.start_data = map.end_data =
> +	map.start_brk = map.brk = map.start_stack = map.arg_start =
> +	map.arg_end = map.env_start = map.env_end = (uint64_t)(uintptr_t)&map;

PR_SET_MM_MAP copies these values into current->mm, so this sets the process
break to a stack address before the test starts. Preserve the real break with
sbrk(0), as waiter_fn() does, and supply valid current values for the other
memory-map fields.

> +	if (i == ARRAY_SIZE(try_sizes))
> +		tst_brk(TBROK | TERRNO, "PR_SET_MM_MAP failed for all auxv sizes");

PR_SET_MM_MAP was added in Linux 3.18, while the CVE predates it. Add
`.min_kver = "3.18"` or report TCONF when this required operation is
unavailable instead of reporting TBROK.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

  reply	other threads:[~2026-09-03 16:04 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-03 12:51 [LTP] [PATCH v7 0/5] Reproducer for ghostlock Andrea Cervesato
2026-09-03 12:51 ` [LTP] [PATCH v7 1/5] sched_setattr01: Convert to new API Andrea Cervesato
2026-09-03 16:04   ` linuxtestproject.agent [this message]
2026-09-04  7:35     ` [LTP] " Andrea Cervesato via ltp
2026-09-03 12:51 ` [LTP] [PATCH v7 2/5] sched_getattr01: " Andrea Cervesato
2026-09-03 12:51 ` [LTP] [PATCH v7 3/5] lapi/sched: add SAFE_SCHED_SETATTR() Andrea Cervesato
2026-09-03 12:51 ` [LTP] [PATCH v7 4/5] lapi/prctl: add more fallback definitions Andrea Cervesato
2026-09-03 12:51 ` [LTP] [PATCH v7 5/5] cve: add CVE-2026-43499 reproducer Andrea Cervesato
  -- strict thread matches above, loose matches on Subject: below --
2026-09-04  7:41 [LTP] [PATCH v8 1/5] sched_setattr01: Convert to new API Andrea Cervesato
2026-09-04  8:20 ` [LTP] " linuxtestproject.agent
2026-09-04  8:23   ` Andrea Cervesato via ltp

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260903160411.9148-1-linuxtestproject.agent@gmail.com \
    --to=linuxtestproject.agent@gmail.com \
    --cc=andrea.cervesato@suse.de \
    --cc=ltp@lists.linux.it \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox