* [Devel] [PATCH hci-8.1 1/2] selftests/futex: run futex_waitv argument checks with a valid waitv
2026-11-02 20:04 [Devel] [PATCH hci-8.1 0/2] selftests/futex: correct validation logic in waitv Eva Kurchatova
@ 2026-11-02 20:04 ` Eva Kurchatova
2026-11-02 20:09 ` no-reply
2026-11-03 15:13 ` Konstantin Khorenko
2026-11-02 20:04 ` [Devel] [PATCH hci-8.1 2/2] ms/selftests/futex: Correct validation logic in waitv Eva Kurchatova
` (2 subsequent siblings)
3 siblings, 2 replies; 8+ messages in thread
From: Eva Kurchatova @ 2026-11-02 20:04 UTC (permalink / raw)
To: khorenko; +Cc: devel
The argument checks reuse the waitv[] the shared subtest leaves behind,
whose entries point into detached memory, and the invalid clockid
check passes NULL waiters. So the kernel can reject a call for a
reason other than the one tested. This goes unnoticed while the checks
accept any result.
Reset waitv[] to valid private futexes before the checks and pass it to
the clockid check.
Fixes: 5e59c1d1c78c ("selftests: futex: Add sys_futex_waitv() test")
https://virtuozzo.atlassian.net/browse/VSTOR-152660
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
.../selftests/futex/functional/futex_waitv.c | 26 ++++++++++++++-----
1 file changed, 19 insertions(+), 7 deletions(-)
diff --git a/tools/testing/selftests/futex/functional/futex_waitv.c b/tools/testing/selftests/futex/functional/futex_waitv.c
index 3706a32102c6..98edb25690d9 100644
--- a/tools/testing/selftests/futex/functional/futex_waitv.c
+++ b/tools/testing/selftests/futex/functional/futex_waitv.c
@@ -69,6 +69,18 @@ static int join_waiter(pthread_t waiter)
return failed != NULL;
}
+static void set_private_waitv(void)
+{
+ int i;
+
+ for (i = 0; i < NR_FUTEXES; i++) {
+ waitv[i].uaddr = (uintptr_t)&futexes[i];
+ waitv[i].flags = FUTEX_32 | FUTEX_PRIVATE_FLAG;
+ waitv[i].val = 0;
+ waitv[i].__reserved = 0;
+ }
+}
+
int main(int argc, char *argv[])
{
pthread_t waiter;
@@ -98,12 +110,7 @@ int main(int argc, char *argv[])
ksft_print_msg("%s: Test FUTEX_WAITV\n",
basename(argv[0]));
- for (i = 0; i < NR_FUTEXES; i++) {
- waitv[i].uaddr = (uintptr_t)&futexes[i];
- waitv[i].flags = FUTEX_32 | FUTEX_PRIVATE_FLAG;
- waitv[i].val = 0;
- waitv[i].__reserved = 0;
- }
+ set_private_waitv();
/* Private waitv */
if (pthread_create(&waiter, NULL, waiterfn, NULL))
@@ -165,6 +172,9 @@ int main(int argc, char *argv[])
for (i = 0; i < NR_FUTEXES; i++)
shmdt(u64_to_ptr(waitv[i].uaddr));
+ /* Each check below breaks one argument of an otherwise valid call */
+ set_private_waitv();
+
/* Testing a waiter without FUTEX_32 flag */
waitv[0].flags = FUTEX_PRIVATE_FLAG;
@@ -237,12 +247,14 @@ int main(int argc, char *argv[])
}
/* Testing an invalid clockid */
+ waitv[0].uaddr = (uintptr_t)&futexes[0];
+
if (clock_gettime(CLOCK_MONOTONIC, &to))
error("gettime64 failed\n", errno);
to.tv_sec++;
- res = futex_waitv(NULL, NR_FUTEXES, 0, &to, CLOCK_TAI);
+ res = futex_waitv(waitv, NR_FUTEXES, 0, &to, CLOCK_TAI);
if (res == EINVAL) {
ksft_test_result_fail("futex_waitv private returned: %d %s\n",
res ? errno : res,
--
2.56.0
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
^ permalink raw reply [flat|nested] 8+ messages in thread* [Devel] [PATCH hci-8.1 2/2] ms/selftests/futex: Correct validation logic in waitv
2026-11-02 20:04 [Devel] [PATCH hci-8.1 0/2] selftests/futex: correct validation logic in waitv Eva Kurchatova
2026-11-02 20:04 ` [Devel] [PATCH hci-8.1 1/2] selftests/futex: run futex_waitv argument checks with a valid waitv Eva Kurchatova
@ 2026-11-02 20:04 ` Eva Kurchatova
2026-11-02 20:10 ` no-reply
2026-11-03 15:13 ` [Devel] [PATCH hci-8.1 0/2] selftests/futex: correct " Konstantin Khorenko
2026-11-03 15:14 ` Konstantin Khorenko
3 siblings, 1 reply; 8+ messages in thread
From: Eva Kurchatova @ 2026-11-02 20:04 UTC (permalink / raw)
To: khorenko; +Cc: devel
From: Wake Liu <wakel@google.com>
In futex_waitv negative tests (invalid_flag, unaligned_address, etc.), test
results are evaluated as:
if (res == EINVAL)
Since sys_futex_waitv returns -1 on error and sets errno, direct positive
comparisons against res are always false, causing tests to silently pass
regardless of real errors.
Correct these validations to assert EXPECT_EQ(res, -1) and compare errno
directly against expected constants.
[ tglx: Fixup coding style ]
Signed-off-by: Wake Liu <wakel@google.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260526010635.23980-3-wakel@google.com
(cherry picked from commit a894f6f403320c65b26816be00d9b694e606cae1)
Rebase note: mainline moved futex_waitv.c to kselftest_harness in
commit a91e8e372e4f ("selftests/futex: Refactor futex_waitv with
kselftest_harness.h"), which this tree lacks, so the checks keep the
ksft_test_result_*() form: a result other than -1 or an errno other
than the expected one fails the subtest. The NULL waitv.uaddr check
expects EFAULT: here it runs on an otherwise valid waitv[], and a NULL
futex address is answered with EFAULT; in mainline it gets EINVAL
only from the zeroed flags of the other entries.
https://virtuozzo.atlassian.net/browse/VSTOR-152660
Feature: fix selftests
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
.../selftests/futex/functional/futex_waitv.c | 55 ++++++++++++-------
1 file changed, 35 insertions(+), 20 deletions(-)
diff --git a/tools/testing/selftests/futex/functional/futex_waitv.c b/tools/testing/selftests/futex/functional/futex_waitv.c
index 98edb25690d9..f58f3fa8f0e0 100644
--- a/tools/testing/selftests/futex/functional/futex_waitv.c
+++ b/tools/testing/selftests/futex/functional/futex_waitv.c
@@ -184,10 +184,13 @@ int main(int argc, char *argv[])
to.tv_sec++;
res = futex_waitv(waitv, NR_FUTEXES, 0, &to, CLOCK_MONOTONIC);
- if (res == EINVAL) {
- ksft_test_result_fail("futex_waitv private returned: %d %s\n",
- res ? errno : res,
- res ? strerror(errno) : "");
+ if (res != -1) {
+ ksft_test_result_fail("futex_waitv without FUTEX_32: unexpected result: %d\n",
+ res);
+ ret = RET_FAIL;
+ } else if (errno != EINVAL) {
+ ksft_test_result_fail("futex_waitv without FUTEX_32: unexpected errno: %d\n",
+ errno);
ret = RET_FAIL;
} else {
ksft_test_result_pass("futex_waitv without FUTEX_32\n");
@@ -203,10 +206,13 @@ int main(int argc, char *argv[])
to.tv_sec++;
res = futex_waitv(waitv, NR_FUTEXES, 0, &to, CLOCK_MONOTONIC);
- if (res == EINVAL) {
- ksft_test_result_fail("futex_wake private returned: %d %s\n",
- res ? errno : res,
- res ? strerror(errno) : "");
+ if (res != -1) {
+ ksft_test_result_fail("futex_waitv with an unaligned address: unexpected result: %d\n",
+ res);
+ ret = RET_FAIL;
+ } else if (errno != EINVAL) {
+ ksft_test_result_fail("futex_waitv with an unaligned address: unexpected errno: %d\n",
+ errno);
ret = RET_FAIL;
} else {
ksft_test_result_pass("futex_waitv with an unaligned address\n");
@@ -221,10 +227,13 @@ int main(int argc, char *argv[])
to.tv_sec++;
res = futex_waitv(waitv, NR_FUTEXES, 0, &to, CLOCK_MONOTONIC);
- if (res == EINVAL) {
- ksft_test_result_fail("futex_waitv private returned: %d %s\n",
- res ? errno : res,
- res ? strerror(errno) : "");
+ if (res != -1) {
+ ksft_test_result_fail("futex_waitv NULL address in waitv.uaddr: unexpected result: %d\n",
+ res);
+ ret = RET_FAIL;
+ } else if (errno != EFAULT) {
+ ksft_test_result_fail("futex_waitv NULL address in waitv.uaddr: unexpected errno: %d\n",
+ errno);
ret = RET_FAIL;
} else {
ksft_test_result_pass("futex_waitv NULL address in waitv.uaddr\n");
@@ -237,10 +246,13 @@ int main(int argc, char *argv[])
to.tv_sec++;
res = futex_waitv(NULL, NR_FUTEXES, 0, &to, CLOCK_MONOTONIC);
- if (res == EINVAL) {
- ksft_test_result_fail("futex_waitv private returned: %d %s\n",
- res ? errno : res,
- res ? strerror(errno) : "");
+ if (res != -1) {
+ ksft_test_result_fail("futex_waitv NULL address in *waiters: unexpected result: %d\n",
+ res);
+ ret = RET_FAIL;
+ } else if (errno != EINVAL) {
+ ksft_test_result_fail("futex_waitv NULL address in *waiters: unexpected errno: %d\n",
+ errno);
ret = RET_FAIL;
} else {
ksft_test_result_pass("futex_waitv NULL address in *waiters\n");
@@ -255,10 +267,13 @@ int main(int argc, char *argv[])
to.tv_sec++;
res = futex_waitv(waitv, NR_FUTEXES, 0, &to, CLOCK_TAI);
- if (res == EINVAL) {
- ksft_test_result_fail("futex_waitv private returned: %d %s\n",
- res ? errno : res,
- res ? strerror(errno) : "");
+ if (res != -1) {
+ ksft_test_result_fail("futex_waitv invalid clockid: unexpected result: %d\n",
+ res);
+ ret = RET_FAIL;
+ } else if (errno != EINVAL) {
+ ksft_test_result_fail("futex_waitv invalid clockid: unexpected errno: %d\n",
+ errno);
ret = RET_FAIL;
} else {
ksft_test_result_pass("futex_waitv invalid clockid\n");
--
2.56.0
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
^ permalink raw reply [flat|nested] 8+ messages in thread