[Devel] [PATCH hci-8.1 0/2] selftests/futex: correct validation logic in waitv

[Devel] [PATCH hci-8.1 0/2] selftests/futex: correct validation logic in waitv

[Eva Kurchatova]

Patchset for task https://virtuozzo.atlassian.net/browse/VSTOR-152660

Eva Kurchatova (1):
  selftests/futex: run futex_waitv argument checks with a valid waitv

Wake Liu (1):
  ms/selftests/futex: Correct validation logic in waitv

 .../selftests/futex/functional/futex_waitv.c  | 81 ++++++++++++-------
 1 file changed, 54 insertions(+), 27 deletions(-)

-- 
2.56.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH hci-8.1 1/2] selftests/futex: run futex_waitv argument checks with a valid waitv

[Eva Kurchatova]

The argument checks reuse the waitv[] the shared subtest leaves behind,
whose entries point into detached memory, and the invalid clockid
check passes NULL waiters. So the kernel can reject a call for a
reason other than the one tested. This goes unnoticed while the checks
accept any result.

Reset waitv[] to valid private futexes before the checks and pass it to
the clockid check.

Fixes: 5e59c1d1c78c ("selftests: futex: Add sys_futex_waitv() test")
https://virtuozzo.atlassian.net/browse/VSTOR-152660
Feature: fix selftests

Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 .../selftests/futex/functional/futex_waitv.c  | 26 ++++++++++++++-----
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/tools/testing/selftests/futex/functional/futex_waitv.c b/tools/testing/selftests/futex/functional/futex_waitv.c
index 3706a32102c6..98edb25690d9 100644
--- a/tools/testing/selftests/futex/functional/futex_waitv.c
+++ b/tools/testing/selftests/futex/functional/futex_waitv.c
@@ -69,6 +69,18 @@ static int join_waiter(pthread_t waiter)
 	return failed != NULL;
 }
 
+static void set_private_waitv(void)
+{
+	int i;
+
+	for (i = 0; i < NR_FUTEXES; i++) {
+		waitv[i].uaddr = (uintptr_t)&futexes[i];
+		waitv[i].flags = FUTEX_32 | FUTEX_PRIVATE_FLAG;
+		waitv[i].val = 0;
+		waitv[i].__reserved = 0;
+	}
+}
+
 int main(int argc, char *argv[])
 {
 	pthread_t waiter;
@@ -98,12 +110,7 @@ int main(int argc, char *argv[])
 	ksft_print_msg("%s: Test FUTEX_WAITV\n",
 		       basename(argv[0]));
 
-	for (i = 0; i < NR_FUTEXES; i++) {
-		waitv[i].uaddr = (uintptr_t)&futexes[i];
-		waitv[i].flags = FUTEX_32 | FUTEX_PRIVATE_FLAG;
-		waitv[i].val = 0;
-		waitv[i].__reserved = 0;
-	}
+	set_private_waitv();
 
 	/* Private waitv */
 	if (pthread_create(&waiter, NULL, waiterfn, NULL))
@@ -165,6 +172,9 @@ int main(int argc, char *argv[])
 	for (i = 0; i < NR_FUTEXES; i++)
 		shmdt(u64_to_ptr(waitv[i].uaddr));
 
+	/* Each check below breaks one argument of an otherwise valid call */
+	set_private_waitv();
+
 	/* Testing a waiter without FUTEX_32 flag */
 	waitv[0].flags = FUTEX_PRIVATE_FLAG;
 
@@ -237,12 +247,14 @@ int main(int argc, char *argv[])
 	}
 
 	/* Testing an invalid clockid */
+	waitv[0].uaddr = (uintptr_t)&futexes[0];
+
 	if (clock_gettime(CLOCK_MONOTONIC, &to))
 		error("gettime64 failed\n", errno);
 
 	to.tv_sec++;
 
-	res = futex_waitv(NULL, NR_FUTEXES, 0, &to, CLOCK_TAI);
+	res = futex_waitv(waitv, NR_FUTEXES, 0, &to, CLOCK_TAI);
 	if (res == EINVAL) {
 		ksft_test_result_fail("futex_waitv private returned: %d %s\n",
 				      res ? errno : res,
-- 
2.56.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

[Devel] [PATCH hci-8.1 2/2] ms/selftests/futex: Correct validation logic in waitv

[Eva Kurchatova]

From: Wake Liu <wakel@google.com>

In futex_waitv negative tests (invalid_flag, unaligned_address, etc.), test
results are evaluated as:

        if (res == EINVAL)

Since sys_futex_waitv returns -1 on error and sets errno, direct positive
comparisons against res are always false, causing tests to silently pass
regardless of real errors.

Correct these validations to assert EXPECT_EQ(res, -1) and compare errno
directly against expected constants.

[ tglx: Fixup coding style ]

Signed-off-by: Wake Liu <wakel@google.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260526010635.23980-3-wakel@google.com
(cherry picked from commit a894f6f403320c65b26816be00d9b694e606cae1)

Rebase note: mainline moved futex_waitv.c to kselftest_harness in
commit a91e8e372e4f ("selftests/futex: Refactor futex_waitv with
kselftest_harness.h"), which this tree lacks, so the checks keep the
ksft_test_result_*() form: a result other than -1 or an errno other
than the expected one fails the subtest. The NULL waitv.uaddr check
expects EFAULT: here it runs on an otherwise valid waitv[], and a NULL
futex address is answered with EFAULT; in mainline it gets EINVAL
only from the zeroed flags of the other entries.

https://virtuozzo.atlassian.net/browse/VSTOR-152660
Feature: fix selftests

Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 .../selftests/futex/functional/futex_waitv.c  | 55 ++++++++++++-------
 1 file changed, 35 insertions(+), 20 deletions(-)

diff --git a/tools/testing/selftests/futex/functional/futex_waitv.c b/tools/testing/selftests/futex/functional/futex_waitv.c
index 98edb25690d9..f58f3fa8f0e0 100644
--- a/tools/testing/selftests/futex/functional/futex_waitv.c
+++ b/tools/testing/selftests/futex/functional/futex_waitv.c
@@ -184,10 +184,13 @@ int main(int argc, char *argv[])
 	to.tv_sec++;
 
 	res = futex_waitv(waitv, NR_FUTEXES, 0, &to, CLOCK_MONOTONIC);
-	if (res == EINVAL) {
-		ksft_test_result_fail("futex_waitv private returned: %d %s\n",
-				      res ? errno : res,
-				      res ? strerror(errno) : "");
+	if (res != -1) {
+		ksft_test_result_fail("futex_waitv without FUTEX_32: unexpected result: %d\n",
+				      res);
+		ret = RET_FAIL;
+	} else if (errno != EINVAL) {
+		ksft_test_result_fail("futex_waitv without FUTEX_32: unexpected errno: %d\n",
+				      errno);
 		ret = RET_FAIL;
 	} else {
 		ksft_test_result_pass("futex_waitv without FUTEX_32\n");
@@ -203,10 +206,13 @@ int main(int argc, char *argv[])
 	to.tv_sec++;
 
 	res = futex_waitv(waitv, NR_FUTEXES, 0, &to, CLOCK_MONOTONIC);
-	if (res == EINVAL) {
-		ksft_test_result_fail("futex_wake private returned: %d %s\n",
-				      res ? errno : res,
-				      res ? strerror(errno) : "");
+	if (res != -1) {
+		ksft_test_result_fail("futex_waitv with an unaligned address: unexpected result: %d\n",
+				      res);
+		ret = RET_FAIL;
+	} else if (errno != EINVAL) {
+		ksft_test_result_fail("futex_waitv with an unaligned address: unexpected errno: %d\n",
+				      errno);
 		ret = RET_FAIL;
 	} else {
 		ksft_test_result_pass("futex_waitv with an unaligned address\n");
@@ -221,10 +227,13 @@ int main(int argc, char *argv[])
 	to.tv_sec++;
 
 	res = futex_waitv(waitv, NR_FUTEXES, 0, &to, CLOCK_MONOTONIC);
-	if (res == EINVAL) {
-		ksft_test_result_fail("futex_waitv private returned: %d %s\n",
-				      res ? errno : res,
-				      res ? strerror(errno) : "");
+	if (res != -1) {
+		ksft_test_result_fail("futex_waitv NULL address in waitv.uaddr: unexpected result: %d\n",
+				      res);
+		ret = RET_FAIL;
+	} else if (errno != EFAULT) {
+		ksft_test_result_fail("futex_waitv NULL address in waitv.uaddr: unexpected errno: %d\n",
+				      errno);
 		ret = RET_FAIL;
 	} else {
 		ksft_test_result_pass("futex_waitv NULL address in waitv.uaddr\n");
@@ -237,10 +246,13 @@ int main(int argc, char *argv[])
 	to.tv_sec++;
 
 	res = futex_waitv(NULL, NR_FUTEXES, 0, &to, CLOCK_MONOTONIC);
-	if (res == EINVAL) {
-		ksft_test_result_fail("futex_waitv private returned: %d %s\n",
-				      res ? errno : res,
-				      res ? strerror(errno) : "");
+	if (res != -1) {
+		ksft_test_result_fail("futex_waitv NULL address in *waiters: unexpected result: %d\n",
+				      res);
+		ret = RET_FAIL;
+	} else if (errno != EINVAL) {
+		ksft_test_result_fail("futex_waitv NULL address in *waiters: unexpected errno: %d\n",
+				      errno);
 		ret = RET_FAIL;
 	} else {
 		ksft_test_result_pass("futex_waitv NULL address in *waiters\n");
@@ -255,10 +267,13 @@ int main(int argc, char *argv[])
 	to.tv_sec++;
 
 	res = futex_waitv(waitv, NR_FUTEXES, 0, &to, CLOCK_TAI);
-	if (res == EINVAL) {
-		ksft_test_result_fail("futex_waitv private returned: %d %s\n",
-				      res ? errno : res,
-				      res ? strerror(errno) : "");
+	if (res != -1) {
+		ksft_test_result_fail("futex_waitv invalid clockid: unexpected result: %d\n",
+				      res);
+		ret = RET_FAIL;
+	} else if (errno != EINVAL) {
+		ksft_test_result_fail("futex_waitv invalid clockid: unexpected errno: %d\n",
+				      errno);
 		ret = RET_FAIL;
 	} else {
 		ksft_test_result_pass("futex_waitv invalid clockid\n");
-- 
2.56.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 1/2] selftests/futex: run futex_waitv argument checks with a valid waitv

[no-reply]

> The argument checks reuse the waitv[] the shared subtest leaves behind,
> whose entries point into detached memory, and the invalid clockid
> check passes NULL waiters. So the kernel can reject a call for a
> reason other than the one tested. This goes unnoticed while the checks
> accept any result.
> 
> Reset waitv[] to valid private futexes before the checks and pass it to
> the clockid check.
> 
> Fixes: 5e59c1d1c78c ("selftests: futex: Add sys_futex_waitv() test")
> https://virtuozzo.atlassian.net/browse/VSTOR-152660
> Feature: fix selftests
> 
> Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261102200610.2414832-1-eva.kurchatova@virtuozzo.com?part=1


_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 2/2] ms/selftests/futex: Correct validation logic in waitv

[no-reply]

> From: Wake Liu <wakel@google.com>
> 
> In futex_waitv negative tests (invalid_flag, unaligned_address, etc.), test
> results are evaluated as:
> 
>         if (res == EINVAL)
> 
> Since sys_futex_waitv returns -1 on error and sets errno, direct positive
> comparisons against res are always false, causing tests to silently pass
> regardless of real errors.
> 
> Correct these validations to assert EXPECT_EQ(res, -1) and compare errno
> directly against expected constants.
> 
> [ tglx: Fixup coding style ]
> [ ... ]
> 
> https://virtuozzo.atlassian.net/browse/VSTOR-152660
> Feature: fix selftests
> 
> Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261102200610.2414832-1-eva.kurchatova@virtuozzo.com?part=2


_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 0/2] selftests/futex: correct validation logic in waitv

[Konstantin Khorenko]

Applying the series as is.

On 11/2/26 22:04, Eva Kurchatova wrote:
> Patchset for task https://virtuozzo.atlassian.net/browse/VSTOR-152660

Thanks, both patches are fine. One follow-up for patch 1 is in my reply
to it.

-- 
Konstantin Khorenko,
Virtuozzo Linux Kernel Team

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 1/2] selftests/futex: run futex_waitv argument checks with a valid waitv

[Konstantin Khorenko]

Applying as is.

On 11/2/26 22:04, Eva Kurchatova wrote:
> Reset waitv[] to valid private futexes before the checks and pass it to
> the clockid check.

- Please send the same fix upstream, on top of a894f6f40332. I created
  a task for that, it is assigned to you:
  https://virtuozzo.atlassian.net/browse/VSTOR-153196

Mainline still has both problems in the harness version. Each TEST runs
with a zeroed waitv[], so unaligned_address and null_address get EINVAL
from the zero flags of waitv[1..], and invalid_clockid passes NULL
waiters. Those tests pass whatever the kernel does with the argument
under test. There null_address would then expect EFAULT, as here.

-- 
Konstantin Khorenko,
Virtuozzo Linux Kernel Team

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel

Re: [Devel] [PATCH hci-8.1 0/2] selftests/futex: correct validation logic in waitv

[Konstantin Khorenko]

On Mon, 02 Nov 2026 22:04:36 +0200, Eva Kurchatova wrote:
> selftests/futex: correct validation logic in waitv
> 
> Patchset for task https://virtuozzo.atlassian.net/browse/VSTOR-152660
> 
> Eva Kurchatova (1):
>   selftests/futex: run futex_waitv argument checks with a valid waitv
> 
> [...]

Applied to branch-rh10-6.12.0-211.52.1.22.x.vz10-ovz, will be released in rh10-6.12.0-211.52.1.22.17.vz10, thanks!

[1/2] selftests/futex: run futex_waitv argument checks with a valid waitv
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/ac4bc4f928a0
[2/2] ms/selftests/futex: Correct validation logic in waitv
      https://bitbucket.org/virtuozzocore/vzkernel.vzs/commits/9737bba906ba

-- 
Konstantin Khorenko,
Virtuozzo Linux Kernel Team


_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel