Linux Test Project
 help / color / mirror / Atom feed
From: linuxtestproject.agent@gmail.com
To: Andrea Cervesato <andrea.cervesato@suse.de>
Cc: ltp@lists.linux.it
Subject: Re: [LTP] sched_setattr01: Convert to new API
Date: Fri,  4 Sep 2026 08:20:49 +0000	[thread overview]
Message-ID: <20260904082049.8988-1-linuxtestproject.agent@gmail.com> (raw)
In-Reply-To: <20260904-cve-ghostlock-v8-1-bd999083c7fb@suse.com>

Hi Andrea,

On Sep 4, 2026, Andrea Cervesato wrote:
> sched_setattr01: Convert to new API

--- [PATCH 1/5] ---

> Rewrite the test to use the modern LTP API (tst_test.h) with a
> struct tcase array and TST_EXP_* macros.

The body only restates how the test was converted. Please explain why the
conversion is needed.

--- [PATCH 2/5] ---

> Rewrite the test to use the modern LTP API (tst_test.h) with
> TST_EXP_* macros and cleanup callback.

The body only restates how the test was converted. Please explain why the
conversion is needed.

--- [PATCH 3/5] ---

> Add a safe variant of sched_setattr() that breaks the test with TBROK
> on failure and use it in sched_setattr01 and sched_getattr01.

The body describes the wrapper and its callers, but not why the shared
wrapper is needed. Please add the motivation.

> +	if (ret == -1) {
> +		tst_brk_(file, lineno, TBROK | TERRNO,
> +			"sched_setattr(%i) failed", pid);
> +	}

This body contains one statement. Please remove the braces as required by
LTP C style.

--- [PATCH 5/5] ---

> +	TST_CHECKPOINT_WAKE(CP_SPRAYED);
> +
> +	while (!tst_atomic_load(&stop_spray)) {
> +		prctl(PR_SET_MM, PR_SET_MM_MAP, (unsigned long)&mm_map,
> +		      sizeof(mm_map), 0);
> +	}

> +	TST_CHECKPOINT_WAIT2(CP_SPRAYED, 18000);
> +
> +	SAFE_SCHED_SETATTR(waiter_tid, &attr, 0);

CP_SPRAYED is signaled before the waiter enters PR_SET_MM_MAP, so nothing
ensures that sched_setattr() overlaps the controlled kernel-stack buffer.
Use the PoC's page-boundary and hole-punch mechanism, or an equivalent
mechanism that guarantees a usable overlap; otherwise a vulnerable kernel
can complete all attempts and incorrectly report TPASS.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

  reply	other threads:[~2026-09-04  8:21 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-04  7:41 [LTP] [PATCH v8 0/5] Reproducer for ghostlock Andrea Cervesato
2026-09-04  7:41 ` [LTP] [PATCH v8 1/5] sched_setattr01: Convert to new API Andrea Cervesato
2026-09-04  8:20   ` linuxtestproject.agent [this message]
2026-09-04  8:23     ` [LTP] " Andrea Cervesato via ltp
2026-09-10 10:40   ` [LTP] [PATCH v8 1/5] " Cyril Hrubis
2026-09-10 11:58     ` Andrea Cervesato via ltp
2026-09-04  7:41 ` [LTP] [PATCH v8 2/5] sched_getattr01: " Andrea Cervesato
2026-09-10 10:48   ` Cyril Hrubis
2026-09-04  7:41 ` [LTP] [PATCH v8 3/5] lapi/sched: add SAFE_SCHED_SETATTR() Andrea Cervesato
2026-09-10 10:52   ` Cyril Hrubis
2026-09-04  7:41 ` [LTP] [PATCH v8 4/5] lapi/prctl: add more fallback definitions Andrea Cervesato
2026-09-10 10:57   ` Cyril Hrubis
2026-09-04  7:41 ` [LTP] [PATCH v8 5/5] cve: add CVE-2026-43499 reproducer Andrea Cervesato
2026-09-10 11:08   ` Cyril Hrubis
  -- strict thread matches above, loose matches on Subject: below --
2026-09-03 12:51 [LTP] [PATCH v7 1/5] sched_setattr01: Convert to new API Andrea Cervesato
2026-09-03 16:04 ` [LTP] " linuxtestproject.agent
2026-09-04  7:35   ` Andrea Cervesato via ltp

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260904082049.8988-1-linuxtestproject.agent@gmail.com \
    --to=linuxtestproject.agent@gmail.com \
    --cc=andrea.cervesato@suse.de \
    --cc=ltp@lists.linux.it \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox