[LTP] [PATCH 0/3] Fix various minor bugs in core library

[LTP] [PATCH 0/3] Fix various minor bugs in core library

[Andrea Cervesato]

This series fixes three small bugs discovered in the LTP core library:

1. tst_timer_test: Check array bounds before accessing samples array in
   do_timer_test(), avoiding heap out-of-bounds reads when all samples
   are outliers or early wakeups.
2. tst_memutils: Use proper half-open interval overlap check in
   tst_mapping_in_range(), correctly identifying enclosed mappings and
   avoiding false positives on adjacent mappings.
3. tst_kconfig: Stop scanning at string termination in
   kconfig_parse_line(), avoiding stack buffer overreads when config
   lines do not end with whitespace.

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
Andrea Cervesato (3):
      tst_timer_test: Fix out-of-bounds array access
      tst_memutils: Fix mapping overlap predicate
      tst_kconfig: Prevent stack buffer overread

 lib/tst_kconfig.c    | 2 +-
 lib/tst_memutils.c   | 6 +-----
 lib/tst_timer_test.c | 5 +++--
 3 files changed, 5 insertions(+), 8 deletions(-)
---
base-commit: 78e6353fdff663b2fc2f77704ceec6c3ca786b96
change-id: 20261006-fix_simple_bugs_core_lib-2c7d8af4a72d

Best regards,
--  
Andrea Cervesato <andrea.cervesato@suse.com>


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH 1/3] tst_timer_test: Fix out-of-bounds array access

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

Both outlier and early-wake loops in do_timer_test() evaluate
samples[i] before verifying that index i is within bounds.
When all samples are outliers or early, this causes heap buffer
overreads at samples[nsamples] or samples[-1].

Check index bounds before indexing the samples array.

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 lib/tst_timer_test.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/tst_timer_test.c b/lib/tst_timer_test.c
index b5a088a14..8f9ec12f6 100644
--- a/lib/tst_timer_test.c
+++ b/lib/tst_timer_test.c
@@ -276,7 +276,7 @@ void do_timer_test(long long usec, unsigned int nsamples)
 
 	write_to_file();
 
-	for (i = 0; samples[i] > 10 * usec && i < (int)nsamples; i++) {
+	for (i = 0; i < (int)nsamples && samples[i] > 10 * usec; i++) {
 		if (samples[i] <= 3 * monotonic_resolution)
 			break;
 	}
@@ -286,7 +286,8 @@ void do_timer_test(long long usec, unsigned int nsamples)
 			i, samples[0], samples[i-1]);
 	}
 
-	for (i = nsamples - 1; samples[i] < usec && i > -1; i--);
+	for (i = nsamples - 1; i >= 0 && samples[i] < usec; i--)
+		;
 
 	if (i < (int)nsamples - 1) {
 		tst_res(TFAIL, "%s woken up early %u times range: [%lli,%lli]",

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] tst_timer_test: Fix out-of-bounds array access

[linuxtestproject.agent]

Hi Andrea,

On Tue, 6 Oct 2026, Andrea Cervesato wrote:
> tst_timer_test: Fix out-of-bounds array access

Verdict - Reviewed

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH 1/3] tst_timer_test: Fix out-of-bounds array access

[Li Wang]

On Tue, Oct 06, 2026 at 03:02:37PM +0200, Andrea Cervesato wrote:
> From: Andrea Cervesato <andrea.cervesato@suse.com>
> 
> Both outlier and early-wake loops in do_timer_test() evaluate
> samples[i] before verifying that index i is within bounds.
> When all samples are outliers or early, this causes heap buffer
> overreads at samples[nsamples] or samples[-1].
> 
> Check index bounds before indexing the samples array.
> 
> Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>

Reviewed-by: Li Wang <li.wang@linux.dev>

-- 
Regards,
Li Wang

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH 2/3] tst_memutils: Fix mapping overlap predicate

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

tst_mapping_in_range() checks whether either mapping endpoint falls
inside [low, high). This misses existing mappings that completely
enclose the requested range, and falsely treats an adjacent mapping
ending exactly at low as an overlap.

Use the standard half-open interval overlap check
(start < high && end > low).

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 lib/tst_memutils.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/lib/tst_memutils.c b/lib/tst_memutils.c
index e49684ba1..81467fef7 100644
--- a/lib/tst_memutils.c
+++ b/lib/tst_memutils.c
@@ -202,11 +202,7 @@ int tst_mapping_in_range(unsigned long low, unsigned long high)
 			tst_brk(TBROK | TERRNO, "Couldn't parse /proc/self/maps line.");
 		}
 
-		if ((start >= low) && (start < high)) {
-			fclose(fp);
-			return 1;
-		}
-		if ((end >= low) && (end < high)) {
+		if (start < high && end > low) {
 			fclose(fp);
 			return 1;
 		}

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH 2/3] tst_memutils: Fix mapping overlap predicate

[Li Wang]

On Tue, Oct 06, 2026 at 03:02:38PM +0200, Andrea Cervesato wrote:
> From: Andrea Cervesato <andrea.cervesato@suse.com>
> 
> tst_mapping_in_range() checks whether either mapping endpoint falls
> inside [low, high). This misses existing mappings that completely
> enclose the requested range, and falsely treats an adjacent mapping
> ending exactly at low as an overlap.
> 
> Use the standard half-open interval overlap check
> (start < high && end > low).
> 
> Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>

Reviewed-by: Li Wang <li.wang@linux.dev>

> ---
>  lib/tst_memutils.c | 6 +-----
>  1 file changed, 1 insertion(+), 5 deletions(-)
> 
> diff --git a/lib/tst_memutils.c b/lib/tst_memutils.c
> index e49684ba1..81467fef7 100644
> --- a/lib/tst_memutils.c
> +++ b/lib/tst_memutils.c
> @@ -202,11 +202,7 @@ int tst_mapping_in_range(unsigned long low, unsigned long high)
>  			tst_brk(TBROK | TERRNO, "Couldn't parse /proc/self/maps line.");
>  		}
>  
> -		if ((start >= low) && (start < high)) {
> -			fclose(fp);
> -			return 1;
> -		}
> -		if ((end >= low) && (end < high)) {
> +		if (start < high && end > low) {
>  			fclose(fp);
>  			return 1;
>  		}
> 
> -- 
> 2.51.0

This is a nice fix!

But after looking at tst_mapping_in_range(), I think there are still
places that need improvement:

1. feof() only returns true after a read attempt has failed.
   Using while (!feof(fp)) causes the last read to be processed twice.

2. If the end of file is reached, fscanf() returns EOF (-1),
   which is not a parsing error.

3. If the caller passes low > high, the function should report an error.
   Currently, it silently returns 0.

Something maybe better like:

int tst_mapping_in_range(unsigned long low, unsigned long high)
{
	FILE *fp;
	unsigned long start, end;
	int ret = 0;

	if (low >= high)
		tst_brk(TBROK, "invalid range [%lu, %lu)", low, high);

	fp = SAFE_FOPEN("/proc/self/maps", "r");

	while (fscanf(fp, "%lx-%lx %*[^\n]\n", &start, &end) == 2) {
		/*
		 * Standard half-open interval overlap check:
		 *   [start, end) intersects [low, high)
		 *     <=> start < high && end > low
		 */
		if (start < high && end > low) {
			ret = 1;
			break;
		}
	}

	fclose(fp);
	return ret;
}

-- 
Regards,
Li Wang

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH 3/3] tst_kconfig: Prevent stack buffer overread

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

kconfig_parse_line() stops scanning value characters only at
whitespace. Because isspace('\0') is false, lines without trailing
whitespace cause an out-of-bounds stack read past the terminating
NUL byte.

Stop scanning when reaching NUL or whitespace.

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 lib/tst_kconfig.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/tst_kconfig.c b/lib/tst_kconfig.c
index 49957e28d..f055c2e5f 100644
--- a/lib/tst_kconfig.c
+++ b/lib/tst_kconfig.c
@@ -255,7 +255,7 @@ out:
 		while (isspace(*val))
 			val++;
 
-		while (!isspace(val[val_len]))
+		while (val[val_len] && !isspace(val[val_len]))
 			val_len++;
 
 		if (val_len == 1) {

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH 3/3] tst_kconfig: Prevent stack buffer overread

[Li Wang]

On Tue, Oct 06, 2026 at 03:02:39PM +0200, Andrea Cervesato wrote:
> From: Andrea Cervesato <andrea.cervesato@suse.com>
> 
> kconfig_parse_line() stops scanning value characters only at
> whitespace. Because isspace('\0') is false, lines without trailing
> whitespace cause an out-of-bounds stack read past the terminating
> NUL byte.
> 
> Stop scanning when reaching NUL or whitespace.
> 
> Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>

Reviewed-by: Li Wang <li.wang@linux.dev>

-- 
Regards,
Li Wang

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp