[LTP] [PATCH v4 0/4] futex: Add error coverage tests for wait, wake and cmp_requeue

[LTP] [PATCH v4 0/4] futex: Add error coverage tests for wait, wake and cmp_requeue

[Michael Menasherov via ltp]

Improve error handling coverage for futex syscalls by adding tests
for missing error conditions that were previously untested.

futex_wait06 verifies EFAULT is returned when uaddr or timeout
points to unmapped memory.

futex_wait07 verifies EINTR is returned when futex_wait() is
interrupted by a signal.

futex_wake05 verifies EFAULT is returned when uaddr points to
unmapped or PROT_NONE memory.

futex_cmp_requeue03 verifies EFAULT is returned when uaddr or
uaddr2 points to unmapped or inaccessible (PROT_NONE) memory.

v4:
 - Add commit body and Signed-off-by to all patches
 - Remove incorrect EACCES/kernel-version check from futex_cmp_requeue03;
   get_futex_key() always returns EFAULT for inaccessible pages
 - Fix misleading comment in futex_wake05
 - Shorten overlong comment in futex_wait07

Michael Menasherov (4):
  futex_wait06: Add EFAULT error coverage test
  futex_wait07: Add EINTR error coverage test
  futex_wake05: Add EFAULT error coverage test
  futex_cmp_requeue03: Add EFAULT error coverage test

 runtest/syscalls                              |  4 +
 testcases/kernel/syscalls/futex/.gitignore    |  4 +
 .../syscalls/futex/futex_cmp_requeue03.c      | 94 +++++++++++++++++++
 .../kernel/syscalls/futex/futex_wait06.c      | 73 ++++++++++++++
 .../kernel/syscalls/futex/futex_wait07.c      | 88 +++++++++++++++++
 .../kernel/syscalls/futex/futex_wake05.c      | 85 +++++++++++++++++
 6 files changed, 348 insertions(+)
 create mode 100644 testcases/kernel/syscalls/futex/futex_cmp_requeue03.c
 create mode 100644 testcases/kernel/syscalls/futex/futex_wait06.c
 create mode 100644 testcases/kernel/syscalls/futex/futex_wait07.c
 create mode 100644 testcases/kernel/syscalls/futex/futex_wake05.c

-- 
2.53.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v4 1/4] futex_wait06: Add EFAULT error coverage test

[Michael Menasherov via ltp]

futex(FUTEX_WAIT) has no existing test for EFAULT. Add coverage for
the cases where uaddr points to unmapped memory and where the timeout
pointer is invalid.

Signed-off-by: Michael Menasherov <mmenashe@redhat.com>
---
 runtest/syscalls                              |  1 +
 testcases/kernel/syscalls/futex/.gitignore    |  1 +
 .../kernel/syscalls/futex/futex_wait06.c      | 73 +++++++++++++++++++
 3 files changed, 75 insertions(+)
 create mode 100644 testcases/kernel/syscalls/futex/futex_wait06.c

diff --git a/runtest/syscalls b/runtest/syscalls
index df5dc02b5..621355e04 100644
--- a/runtest/syscalls
+++ b/runtest/syscalls
@@ -1905,3 +1905,4 @@ io_uring03 io_uring03
 
 # Tests below may cause kernel memory leak
 perf_event_open03 perf_event_open03
+futex_wait06 futex_wait06
diff --git a/testcases/kernel/syscalls/futex/.gitignore b/testcases/kernel/syscalls/futex/.gitignore
index 9d08ba7d3..56596dcb4 100644
--- a/testcases/kernel/syscalls/futex/.gitignore
+++ b/testcases/kernel/syscalls/futex/.gitignore
@@ -13,3 +13,4 @@
 /futex_waitv01
 /futex_waitv02
 /futex_waitv03
+/futex_wait06
diff --git a/testcases/kernel/syscalls/futex/futex_wait06.c b/testcases/kernel/syscalls/futex/futex_wait06.c
new file mode 100644
index 000000000..8bb563fb2
--- /dev/null
+++ b/testcases/kernel/syscalls/futex/futex_wait06.c
@@ -0,0 +1,73 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2026 Red Hat, Inc.
+ */
+
+/*\
+ * Check that futex(FUTEX_WAIT) returns EFAULT when:
+ *
+ * 1) uaddr points to unmapped memory
+ * 2) timeout points to unmapped memory
+ */
+#include <errno.h>
+#include <sys/mman.h>
+
+#include "futextest.h"
+
+static futex_t futex = FUTEX_INITIALIZER;
+
+static struct futex_test_variants variants[] = {
+#if (__NR_futex != __LTP__NR_INVALID_SYSCALL)
+	{ .fntype = FUTEX_FN_FUTEX, .tstype = TST_KERN_OLD_TIMESPEC, .desc = "syscall with old kernel spec"},
+#endif
+
+#if (__NR_futex_time64 != __LTP__NR_INVALID_SYSCALL)
+	{ .fntype = FUTEX_FN_FUTEX64, .tstype = TST_KERN_TIMESPEC, .desc = "syscall time64 with kernel spec"},
+#endif
+};
+
+static struct testcase {
+	const char *desc;
+	futex_t *uaddr;
+	void *timeout;
+} testcases[2];
+
+static void run(unsigned int n)
+{
+	struct futex_test_variants *tv = &variants[tst_variant];
+	struct testcase *tc = &testcases[n];
+
+	TST_EXP_FAIL(futex_syscall(tv->fntype, tc->uaddr, FUTEX_WAIT, futex,
+		tc->timeout, NULL, 0, 0), EFAULT, "%s", tc->desc);
+}
+
+static void setup(void)
+{
+	struct futex_test_variants *tv = &variants[tst_variant];
+	void *bad;
+
+	tst_res(TINFO, "Testing variant: %s", tv->desc);
+	futex_supported_by_kernel(tv->fntype);
+
+	bad = SAFE_MMAP(NULL, getpagesize(), PROT_READ | PROT_WRITE,
+		MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+	SAFE_MUNMAP(bad, getpagesize());
+
+	testcases[0] = (struct testcase){
+		.desc = "uaddr points to unmapped memory",
+		.uaddr = bad,
+		.timeout = NULL,
+	};
+	testcases[1] = (struct testcase){
+		.desc = "timeout points to unmapped memory",
+		.uaddr = &futex,
+		.timeout = bad,
+	};
+}
+
+static struct tst_test test = {
+	.setup = setup,
+	.test = run,
+	.tcnt = ARRAY_SIZE(testcases),
+	.test_variants = ARRAY_SIZE(variants),
+};
-- 
2.53.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] futex_wait06: Add EFAULT error coverage test

[linuxtestproject.agent]

Hi Michael,

On Thu, 7 May 2026, Michael Menasherov wrote:
> [PATCH 1/4] futex_wait06: Add EFAULT error coverage test
> [PATCH 2/4] futex_wait07: Add EINTR error coverage test
> [PATCH 3/4] futex_wake05: Add EFAULT error coverage test
> [PATCH 4/4] futex_cmp_requeue03: Add EFAULT error coverage test

Reviewed-by: LTP AI Reviewer <ltp-ai@noreply.github.com>

---
Note:

Our agent completed the review of the patch. The full review can be
found at: (not available)

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] futex_wait06: Add EFAULT error coverage test

[Michael Menasherov via ltp]

  Hi,

  Just a kind reminder about this patch series sent on May 7th.
  The LTP AI Reviewer has already approved all four patches.

  Would appreciate it if someone could take a look when time permits.

  Thanks,
  Michael Menasherov

On Thu, May 7, 2026 at 3:01 PM <linuxtestproject.agent@gmail.com> wrote:

> Hi Michael,
>
> On Thu, 7 May 2026, Michael Menasherov wrote:
> > [PATCH 1/4] futex_wait06: Add EFAULT error coverage test
> > [PATCH 2/4] futex_wait07: Add EINTR error coverage test
> > [PATCH 3/4] futex_wake05: Add EFAULT error coverage test
> > [PATCH 4/4] futex_cmp_requeue03: Add EFAULT error coverage test
>
> Reviewed-by: LTP AI Reviewer <ltp-ai@noreply.github.com>
>
> ---
> Note:
>
> Our agent completed the review of the patch. The full review can be
> found at: (not available)
>
> The agent can sometimes produce false positives although often its
> findings are genuine. If you find issues with the review, please
> comment this email or ignore the suggestions.
>
> Regards,
> LTP AI Reviewer
>
>

-- 

Michael Menasherov

Software Quality Engineer - Automotive Kernel

Red Hat <https://www.redhat.com/>
<https://www.redhat.com/>

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] futex_wait06: Add EFAULT error coverage test

[Michael Menasherov via ltp]

  Hi,

  Following up again on this patch series originally sent on May 7th.
  The LTP AI Reviewer has already approved all four patches with no issues
found.

  Patch series:
    [LTP] [PATCH v4 1/4] futex_wait06: Add EFAULT error coverage test
    [LTP] [PATCH v4 2/4] futex_wait07: Add EINTR error coverage test
    [LTP] [PATCH v4 3/4] futex_wake05: Add EFAULT error coverage test
    [LTP] [PATCH v4 4/4] futex_cmp_requeue03: Add EFAULT error coverage test

  GitHub PR: https://github.com/linux-test-project/ltp/pull/1301

  Is there anything missing or anything I can improve to help move this
forward?

  Thanks.

On Wed, May 13, 2026 at 11:35 AM Michael Menasherov <mmenashe@redhat.com>
wrote:

>   Hi,
>
>   Just a kind reminder about this patch series sent on May 7th.
>   The LTP AI Reviewer has already approved all four patches.
>
>   Would appreciate it if someone could take a look when time permits.
>
>   Thanks,
>   Michael Menasherov
>
> On Thu, May 7, 2026 at 3:01 PM <linuxtestproject.agent@gmail.com> wrote:
>
>> Hi Michael,
>>
>> On Thu, 7 May 2026, Michael Menasherov wrote:
>> > [PATCH 1/4] futex_wait06: Add EFAULT error coverage test
>> > [PATCH 2/4] futex_wait07: Add EINTR error coverage test
>> > [PATCH 3/4] futex_wake05: Add EFAULT error coverage test
>> > [PATCH 4/4] futex_cmp_requeue03: Add EFAULT error coverage test
>>
>> Reviewed-by: LTP AI Reviewer <ltp-ai@noreply.github.com>
>>
>> ---
>> Note:
>>
>> Our agent completed the review of the patch. The full review can be
>> found at: (not available)
>>
>> The agent can sometimes produce false positives although often its
>> findings are genuine. If you find issues with the review, please
>> comment this email or ignore the suggestions.
>>
>> Regards,
>> LTP AI Reviewer
>>
>>
>
> --
>
> Michael Menasherov
>
> Software Quality Engineer - Automotive Kernel
>
> Red Hat <https://www.redhat.com/>
> <https://www.redhat.com/>
>


-- 

Michael Menasherov

Software Quality Engineer - Automotive Kernel

Red Hat <https://www.redhat.com/>
<https://www.redhat.com/>

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] futex_wait06: Add EFAULT error coverage test

[Andrea Cervesato via ltp]

Hi Michael,

>   Hi,
> 
>   Following up again on this patch series originally sent on May 7th.
>   The LTP AI Reviewer has already approved all four patches with no issues
> found.

Unfortunately we didn't have time to review the patch-set yet,
but keep in mind that LTP AI Reviewer approval is not a certainty
that patches will be merged. This only means that agent didn't spot
major issues :-)

At the end, one of the maintainer will need to approve the review
of the agent and sending new feedbacks.

Regards,
--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v4 1/4] futex_wait06: Add EFAULT error coverage test

[Andrea Cervesato via ltp]

Hi Michael,

> +	SAFE_MUNMAP(bad, getpagesize());
> +
> +	testcases[0] = (struct testcase){
> +		.desc = "uaddr points to unmapped memory",
> +		.uaddr = bad,
> +		.timeout = NULL,
> +	};
> +	testcases[1] = (struct testcase){
> +		.desc = "timeout points to unmapped memory",
> +		.uaddr = &futex,
> +		.timeout = bad,
> +	};

This is not the standard approach. Test cases should be defined at
compile-time with a `uaddr` double pointer pointing to `&bad`.

static struct testcase {
  const char *desc;
  futex_t **uaddr;
  void *timeout;
} testcases[] = {
  {
		.desc = "uaddr points to unmapped memory",
  	.uaddr = &bad,
  	.timeout = NULL,
  },

 ..
};

And in the `setup()` we will only need to initialize `bad` memory
pointer.

Kind Regards,
--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v4 2/4] futex_wait07: Add EINTR error coverage test

[Michael Menasherov via ltp]

futex(FUTEX_WAIT) has no existing test for EINTR. Add coverage for
the case where the wait is interrupted by a signal before the futex
word changes.

Signed-off-by: Michael Menasherov <mmenashe@redhat.com>
---
 runtest/syscalls                              |  1 +
 testcases/kernel/syscalls/futex/.gitignore    |  1 +
 .../kernel/syscalls/futex/futex_wait07.c      | 88 +++++++++++++++++++
 3 files changed, 90 insertions(+)
 create mode 100644 testcases/kernel/syscalls/futex/futex_wait07.c

diff --git a/runtest/syscalls b/runtest/syscalls
index 621355e04..75b7754db 100644
--- a/runtest/syscalls
+++ b/runtest/syscalls
@@ -1906,3 +1906,4 @@ io_uring03 io_uring03
 # Tests below may cause kernel memory leak
 perf_event_open03 perf_event_open03
 futex_wait06 futex_wait06
+futex_wait07 futex_wait07
diff --git a/testcases/kernel/syscalls/futex/.gitignore b/testcases/kernel/syscalls/futex/.gitignore
index 56596dcb4..74ac9a926 100644
--- a/testcases/kernel/syscalls/futex/.gitignore
+++ b/testcases/kernel/syscalls/futex/.gitignore
@@ -14,3 +14,4 @@
 /futex_waitv02
 /futex_waitv03
 /futex_wait06
+/futex_wait07
diff --git a/testcases/kernel/syscalls/futex/futex_wait07.c b/testcases/kernel/syscalls/futex/futex_wait07.c
new file mode 100644
index 000000000..9bf35e506
--- /dev/null
+++ b/testcases/kernel/syscalls/futex/futex_wait07.c
@@ -0,0 +1,88 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2026 Red Hat, Inc.
+ */
+
+/*\
+ * Check that futex(FUTEX_WAIT) returns EINTR when interrupted by a signal.
+ * A child process blocks on futex_wait() with a long timeout. The parent
+ * waits for the child to enter sleep state, then sends SIGUSR1 to it.
+ * The child verifies it received EINTR and exits accordingly.
+ */
+
+#include <errno.h>
+#include <signal.h>
+
+#include "futextest.h"
+
+static futex_t *futex;
+
+static struct futex_test_variants variants[] = {
+#if (__NR_futex != __LTP__NR_INVALID_SYSCALL)
+	{ .fntype = FUTEX_FN_FUTEX, .tstype = TST_KERN_OLD_TIMESPEC, .desc = "syscall with old kernel spec"},
+#endif
+
+#if (__NR_futex_time64 != __LTP__NR_INVALID_SYSCALL)
+	{ .fntype = FUTEX_FN_FUTEX64, .tstype = TST_KERN_TIMESPEC, .desc = "syscall time64 with kernel spec"},
+#endif
+};
+
+/* Empty handler: receiving the signal is sufficient to interrupt futex_wait(). */
+static void sigusr1_handler(int sig LTP_ATTRIBUTE_UNUSED)
+{
+}
+
+static void do_child(void)
+{
+	struct futex_test_variants *tv = &variants[tst_variant];
+	struct sigaction sa;
+	struct tst_ts timeout;
+
+	sa.sa_handler = sigusr1_handler;
+	sa.sa_flags = 0;
+	SAFE_SIGEMPTYSET(&sa.sa_mask);
+	SAFE_SIGACTION(SIGUSR1, &sa, NULL);
+
+	timeout = tst_ts_from_ms(tv->tstype, 5000);
+	TST_EXP_FAIL(futex_wait(tv->fntype, futex, *futex, &timeout, 0), EINTR);
+	exit(0);
+}
+
+static void run(void)
+{
+	pid_t child;
+
+	child = SAFE_FORK();
+
+	if (child == 0)
+		do_child();
+
+	TST_PROCESS_STATE_WAIT(child, 'S', 0);
+	SAFE_KILL(child, SIGUSR1);
+}
+
+static void setup(void)
+{
+	struct futex_test_variants *tv = &variants[tst_variant];
+
+	tst_res(TINFO, "Testing variant: %s", tv->desc);
+	futex_supported_by_kernel(tv->fntype);
+
+	futex = SAFE_MMAP(NULL, sizeof(*futex), PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_SHARED, -1, 0);
+	*futex = FUTEX_INITIALIZER;
+}
+
+static void cleanup(void)
+{
+	if (futex) {
+		SAFE_MUNMAP((void *)futex, sizeof(*futex));
+	}
+}
+
+static struct tst_test test = {
+	.setup = setup,
+	.cleanup = cleanup,
+	.test_all = run,
+	.test_variants = ARRAY_SIZE(variants),
+	.forks_child = 1,
+};
-- 
2.53.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v4 2/4] futex_wait07: Add EINTR error coverage test

[Andrea Cervesato via ltp]

Hi Michael,

> +{
> +	if (futex) {
> +		SAFE_MUNMAP((void *)futex, sizeof(*futex));
> +	}
> +}

Please run `make check` on patches because this is supposed to be
an error: 1 line statement doesn't require parenthesis.

Kind regards,
--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v4 3/4] futex_wake05: Add EFAULT error coverage test

[Michael Menasherov via ltp]

futex(FUTEX_WAKE) has no existing test for EFAULT. Add coverage for
the cases where uaddr points to unmapped or PROT_NONE memory.

Signed-off-by: Michael Menasherov <mmenashe@redhat.com>
---
 runtest/syscalls                              |  1 +
 testcases/kernel/syscalls/futex/.gitignore    |  1 +
 .../kernel/syscalls/futex/futex_wake05.c      | 85 +++++++++++++++++++
 3 files changed, 87 insertions(+)
 create mode 100644 testcases/kernel/syscalls/futex/futex_wake05.c

diff --git a/runtest/syscalls b/runtest/syscalls
index 75b7754db..4d85a1d26 100644
--- a/runtest/syscalls
+++ b/runtest/syscalls
@@ -1907,3 +1907,4 @@ io_uring03 io_uring03
 perf_event_open03 perf_event_open03
 futex_wait06 futex_wait06
 futex_wait07 futex_wait07
+futex_wake05 futex_wake05
diff --git a/testcases/kernel/syscalls/futex/.gitignore b/testcases/kernel/syscalls/futex/.gitignore
index 74ac9a926..c11546e07 100644
--- a/testcases/kernel/syscalls/futex/.gitignore
+++ b/testcases/kernel/syscalls/futex/.gitignore
@@ -15,3 +15,4 @@
 /futex_waitv03
 /futex_wait06
 /futex_wait07
+/futex_wake05
diff --git a/testcases/kernel/syscalls/futex/futex_wake05.c b/testcases/kernel/syscalls/futex/futex_wake05.c
new file mode 100644
index 000000000..654bf96b5
--- /dev/null
+++ b/testcases/kernel/syscalls/futex/futex_wake05.c
@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2026 Red Hat, Inc.
+ */
+
+/*\
+ * Check that futex(FUTEX_WAKE) returns EFAULT when uaddr points to
+ * unmapped or PROT_NONE memory.
+ *
+ * PROT_NONE memory triggers EFAULT because the kernel cannot look up
+ * the futex key for an inaccessible page.
+ */
+
+#include <errno.h>
+#include <sys/mman.h>
+#include "futextest.h"
+
+static futex_t *prot_none_addr;
+
+static struct futex_test_variants variants[] = {
+#if (__NR_futex != __LTP__NR_INVALID_SYSCALL)
+	{ .fntype = FUTEX_FN_FUTEX, .desc = "syscall with old kernel spec"},
+#endif
+
+#if (__NR_futex_time64 != __LTP__NR_INVALID_SYSCALL)
+	{ .fntype = FUTEX_FN_FUTEX64, .desc = "syscall time64 with kernel spec"},
+#endif
+};
+
+static struct testcase {
+	const char *desc;
+	futex_t *addr;
+	int exp_errno;
+} testcases[2];
+
+static void run(unsigned int n)
+{
+	struct futex_test_variants *tv = &variants[tst_variant];
+	struct testcase *tc = &testcases[n];
+
+	TST_EXP_FAIL(futex_wake(tv->fntype, tc->addr, 1, 0),
+		tc->exp_errno, "%s", tc->desc);
+}
+
+static void setup(void)
+{
+	struct futex_test_variants *tv = &variants[tst_variant];
+	size_t pagesize = getpagesize();
+	futex_t *unmapped;
+
+	tst_res(TINFO, "Testing variant: %s", tv->desc);
+	futex_supported_by_kernel(tv->fntype);
+
+	unmapped = SAFE_MMAP(NULL, pagesize, PROT_READ | PROT_WRITE,
+		MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+	SAFE_MUNMAP(unmapped, pagesize);
+
+	prot_none_addr = SAFE_MMAP(NULL, pagesize, PROT_NONE,
+		MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+
+	testcases[0] = (struct testcase){
+		.desc = "uaddr unmapped",
+		.addr = unmapped,
+		.exp_errno = EFAULT,
+	};
+	testcases[1] = (struct testcase){
+		.desc = "uaddr PROT_NONE",
+		.addr = prot_none_addr,
+		.exp_errno = EFAULT,
+	};
+}
+
+static void cleanup(void)
+{
+	if (prot_none_addr)
+		SAFE_MUNMAP(prot_none_addr, getpagesize());
+}
+
+static struct tst_test test = {
+	.setup = setup,
+	.cleanup = cleanup,
+	.test = run,
+	.tcnt = ARRAY_SIZE(testcases),
+	.test_variants = ARRAY_SIZE(variants),
+};
-- 
2.53.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v4 3/4] futex_wake05: Add EFAULT error coverage test

[Andrea Cervesato via ltp]

Hi Michael,

Same comments of 1/4

Kind Regards,
--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v4 4/4] futex_cmp_requeue03: Add EFAULT error coverage test

[Michael Menasherov via ltp]

futex(FUTEX_CMP_REQUEUE) has no existing test for EFAULT. Add coverage
for the cases where uaddr or uaddr2 points to unmapped or inaccessible
(PROT_NONE) memory.

Signed-off-by: Michael Menasherov <mmenashe@redhat.com>
---
 runtest/syscalls                              |  1 +
 testcases/kernel/syscalls/futex/.gitignore    |  1 +
 .../syscalls/futex/futex_cmp_requeue03.c      | 94 +++++++++++++++++++
 3 files changed, 96 insertions(+)
 create mode 100644 testcases/kernel/syscalls/futex/futex_cmp_requeue03.c

diff --git a/runtest/syscalls b/runtest/syscalls
index 4d85a1d26..65baa44dc 100644
--- a/runtest/syscalls
+++ b/runtest/syscalls
@@ -1908,3 +1908,4 @@ perf_event_open03 perf_event_open03
 futex_wait06 futex_wait06
 futex_wait07 futex_wait07
 futex_wake05 futex_wake05
+futex_cmp_requeue03 futex_cmp_requeue03
diff --git a/testcases/kernel/syscalls/futex/.gitignore b/testcases/kernel/syscalls/futex/.gitignore
index c11546e07..231b6bd25 100644
--- a/testcases/kernel/syscalls/futex/.gitignore
+++ b/testcases/kernel/syscalls/futex/.gitignore
@@ -16,3 +16,4 @@
 /futex_wait06
 /futex_wait07
 /futex_wake05
+/futex_cmp_requeue03
diff --git a/testcases/kernel/syscalls/futex/futex_cmp_requeue03.c b/testcases/kernel/syscalls/futex/futex_cmp_requeue03.c
new file mode 100644
index 000000000..4c3c6e358
--- /dev/null
+++ b/testcases/kernel/syscalls/futex/futex_cmp_requeue03.c
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2026 Red Hat, Inc.
+ */
+
+/*\
+ * Check that futex(FUTEX_CMP_REQUEUE) returns EFAULT when uaddr or
+ * uaddr2 points to unmapped memory, or when uaddr points to memory
+ * without read permission (PROT_NONE).
+ */
+
+#include <errno.h>
+#include <sys/mman.h>
+
+#include "futextest.h"
+
+static futex_t futex_var = FUTEX_INITIALIZER;
+static futex_t *prot_none_addr;
+
+static struct futex_test_variants variants[] = {
+#if (__NR_futex != __LTP__NR_INVALID_SYSCALL)
+	{ .fntype = FUTEX_FN_FUTEX, .desc = "syscall with old kernel spec"},
+#endif
+
+#if (__NR_futex_time64 != __LTP__NR_INVALID_SYSCALL)
+	{ .fntype = FUTEX_FN_FUTEX64, .desc = "syscall time64 with kernel spec"},
+#endif
+};
+
+static struct testcase {
+	const char *desc;
+	futex_t *uaddr;
+	futex_t *uaddr2;
+	int exp_errno;
+} testcases[3];
+
+static void run(unsigned int n)
+{
+	struct futex_test_variants *tv = &variants[tst_variant];
+	struct testcase *tc = &testcases[n];
+
+	TST_EXP_FAIL(futex_cmp_requeue(tv->fntype, tc->uaddr, futex_var,
+		tc->uaddr2, 1, 1, 0), tc->exp_errno, "%s", tc->desc);
+}
+
+static void setup(void)
+{
+	struct futex_test_variants *tv = &variants[tst_variant];
+	size_t pagesize = getpagesize();
+	futex_t *unmapped;
+
+	tst_res(TINFO, "Testing variant: %s", tv->desc);
+	futex_supported_by_kernel(tv->fntype);
+
+	unmapped = SAFE_MMAP(NULL, pagesize, PROT_READ | PROT_WRITE,
+		MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+	SAFE_MUNMAP(unmapped, pagesize);
+
+	prot_none_addr = SAFE_MMAP(NULL, pagesize, PROT_NONE,
+		MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+
+	testcases[0] = (struct testcase){
+		.desc = "uaddr unmapped",
+		.uaddr = unmapped,
+		.uaddr2 = &futex_var,
+		.exp_errno = EFAULT,
+	};
+	testcases[1] = (struct testcase){
+		.desc = "uaddr2 unmapped",
+		.uaddr = &futex_var,
+		.uaddr2 = unmapped,
+		.exp_errno = EFAULT,
+	};
+	testcases[2] = (struct testcase){
+		.desc = "uaddr PROT_NONE",
+		.uaddr = prot_none_addr,
+		.uaddr2 = &futex_var,
+		.exp_errno = EFAULT,
+	};
+}
+
+static void cleanup(void)
+{
+	if (prot_none_addr)
+		SAFE_MUNMAP(prot_none_addr, getpagesize());
+}
+
+static struct tst_test test = {
+	.setup = setup,
+	.cleanup = cleanup,
+	.test = run,
+	.tcnt = ARRAY_SIZE(testcases),
+	.test_variants = ARRAY_SIZE(variants),
+};
-- 
2.53.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v4 4/4] futex_cmp_requeue03: Add EFAULT error coverage test

[Michael Menasherov via ltp]

  Hi,

  Following up again on this patch series originally sent on May 7th.
  The LTP AI Reviewer has already approved all four patches with no issues
found.

  Patch series:
    [LTP] [PATCH v4 1/4] futex_wait06: Add EFAULT error coverage test
    [LTP] [PATCH v4 2/4] futex_wait07: Add EINTR error coverage test
    [LTP] [PATCH v4 3/4] futex_wake05: Add EFAULT error coverage test
    [LTP] [PATCH v4 4/4] futex_cmp_requeue03: Add EFAULT error coverage test

  GitHub PR: https://github.com/linux-test-project/ltp/pull/1301

  Is there anything missing or anything I can improve to help move this
forward?

  Thanks. Regards.

On Thu, May 7, 2026 at 2:18 PM Michael Menasherov <mmenashe@redhat.com>
wrote:

> futex(FUTEX_CMP_REQUEUE) has no existing test for EFAULT. Add coverage
> for the cases where uaddr or uaddr2 points to unmapped or inaccessible
> (PROT_NONE) memory.
>
> Signed-off-by: Michael Menasherov <mmenashe@redhat.com>
> ---
>  runtest/syscalls                              |  1 +
>  testcases/kernel/syscalls/futex/.gitignore    |  1 +
>  .../syscalls/futex/futex_cmp_requeue03.c      | 94 +++++++++++++++++++
>  3 files changed, 96 insertions(+)
>  create mode 100644 testcases/kernel/syscalls/futex/futex_cmp_requeue03.c
>
> diff --git a/runtest/syscalls b/runtest/syscalls
> index 4d85a1d26..65baa44dc 100644
> --- a/runtest/syscalls
> +++ b/runtest/syscalls
> @@ -1908,3 +1908,4 @@ perf_event_open03 perf_event_open03
>  futex_wait06 futex_wait06
>  futex_wait07 futex_wait07
>  futex_wake05 futex_wake05
> +futex_cmp_requeue03 futex_cmp_requeue03
> diff --git a/testcases/kernel/syscalls/futex/.gitignore
> b/testcases/kernel/syscalls/futex/.gitignore
> index c11546e07..231b6bd25 100644
> --- a/testcases/kernel/syscalls/futex/.gitignore
> +++ b/testcases/kernel/syscalls/futex/.gitignore
> @@ -16,3 +16,4 @@
>  /futex_wait06
>  /futex_wait07
>  /futex_wake05
> +/futex_cmp_requeue03
> diff --git a/testcases/kernel/syscalls/futex/futex_cmp_requeue03.c
> b/testcases/kernel/syscalls/futex/futex_cmp_requeue03.c
> new file mode 100644
> index 000000000..4c3c6e358
> --- /dev/null
> +++ b/testcases/kernel/syscalls/futex/futex_cmp_requeue03.c
> @@ -0,0 +1,94 @@
> +// SPDX-License-Identifier: GPL-2.0-or-later
> +/*
> + * Copyright (C) 2026 Red Hat, Inc.
> + */
> +
> +/*\
> + * Check that futex(FUTEX_CMP_REQUEUE) returns EFAULT when uaddr or
> + * uaddr2 points to unmapped memory, or when uaddr points to memory
> + * without read permission (PROT_NONE).
> + */
> +
> +#include <errno.h>
> +#include <sys/mman.h>
> +
> +#include "futextest.h"
> +
> +static futex_t futex_var = FUTEX_INITIALIZER;
> +static futex_t *prot_none_addr;
> +
> +static struct futex_test_variants variants[] = {
> +#if (__NR_futex != __LTP__NR_INVALID_SYSCALL)
> +       { .fntype = FUTEX_FN_FUTEX, .desc = "syscall with old kernel
> spec"},
> +#endif
> +
> +#if (__NR_futex_time64 != __LTP__NR_INVALID_SYSCALL)
> +       { .fntype = FUTEX_FN_FUTEX64, .desc = "syscall time64 with kernel
> spec"},
> +#endif
> +};
> +
> +static struct testcase {
> +       const char *desc;
> +       futex_t *uaddr;
> +       futex_t *uaddr2;
> +       int exp_errno;
> +} testcases[3];
> +
> +static void run(unsigned int n)
> +{
> +       struct futex_test_variants *tv = &variants[tst_variant];
> +       struct testcase *tc = &testcases[n];
> +
> +       TST_EXP_FAIL(futex_cmp_requeue(tv->fntype, tc->uaddr, futex_var,
> +               tc->uaddr2, 1, 1, 0), tc->exp_errno, "%s", tc->desc);
> +}
> +
> +static void setup(void)
> +{
> +       struct futex_test_variants *tv = &variants[tst_variant];
> +       size_t pagesize = getpagesize();
> +       futex_t *unmapped;
> +
> +       tst_res(TINFO, "Testing variant: %s", tv->desc);
> +       futex_supported_by_kernel(tv->fntype);
> +
> +       unmapped = SAFE_MMAP(NULL, pagesize, PROT_READ | PROT_WRITE,
> +               MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
> +       SAFE_MUNMAP(unmapped, pagesize);
> +
> +       prot_none_addr = SAFE_MMAP(NULL, pagesize, PROT_NONE,
> +               MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
> +
> +       testcases[0] = (struct testcase){
> +               .desc = "uaddr unmapped",
> +               .uaddr = unmapped,
> +               .uaddr2 = &futex_var,
> +               .exp_errno = EFAULT,
> +       };
> +       testcases[1] = (struct testcase){
> +               .desc = "uaddr2 unmapped",
> +               .uaddr = &futex_var,
> +               .uaddr2 = unmapped,
> +               .exp_errno = EFAULT,
> +       };
> +       testcases[2] = (struct testcase){
> +               .desc = "uaddr PROT_NONE",
> +               .uaddr = prot_none_addr,
> +               .uaddr2 = &futex_var,
> +               .exp_errno = EFAULT,
> +       };
> +}
> +
> +static void cleanup(void)
> +{
> +       if (prot_none_addr)
> +               SAFE_MUNMAP(prot_none_addr, getpagesize());
> +}
> +
> +static struct tst_test test = {
> +       .setup = setup,
> +       .cleanup = cleanup,
> +       .test = run,
> +       .tcnt = ARRAY_SIZE(testcases),
> +       .test_variants = ARRAY_SIZE(variants),
> +};
> --
> 2.53.0
>
>

-- 

Michael Menasherov

Software Quality Engineer - Automotive Kernel

Red Hat <https://www.redhat.com/>
<https://www.redhat.com/>

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v4 4/4] futex_cmp_requeue03: Add EFAULT error coverage test

[Andrea Cervesato via ltp]

Hi Michael,

same comments of 1/4

Kind regards,
--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp