Re: thp04: Add ptrace support for CONFIG_PROC_MEM_FORCE_PTRACE=y

On Tue, Jul 07, 2026 at 04:43:04PM +0000, [email protected] wrote:
> Hi Jan,
>
> On Tue, 7 Jul 2026 18:00:22 +0200, Jan Polensky wrote:
> > thp04: Add ptrace support for CONFIG_PROC_MEM_FORCE_PTRACE=y
>
> > - Restores lapi/mmap.h for MADV_* fallback definitions
>
> The diff shows lapi/mmap.h was already present in the original file
> and was not removed or re-added by this patch. "Restores" is
> inaccurate here.
>
> > +static void setup_ptrace_tracee(void)
> > +{
> > +	int status;
> > +
> > +	/* Test-loop state is initialized once and read-only afterwards. */
> > +	child = SAFE_MMAP(NULL, sizeof(*child), PROT_READ | PROT_WRITE,
> > +		MAP_SHARED | MAP_ANONYMOUS, -1, 0);
> > +	memset(child, 0, sizeof(*child));
> > +	child->writefd = -1;
> > +	child->readfd = -1;
> > +
> > +	tracee_pid = SAFE_FORK();
> > +	if (!tracee_pid) {
> > +		tracee_main();
> > +		exit(0);
> > +	}
> > +
> > +	TST_CHECKPOINT_WAIT(0);
> > +
> > +	SAFE_PTRACE(PTRACE_SEIZE, tracee_pid, NULL, NULL);
> > +
> > +	/*
> > +	 * Tracee will run first iteration (madvise + check) and self-stop
> > +	 * with raise(SIGSTOP). Wait for that SIGSTOP - this is iteration 0.
> > +	 */
> > +	SAFE_WAITPID(tracee_pid, &status, 0);
>
> There is a race here. After TST_CHECKPOINT_WAKE(0) the tracee runs the
> for(;;) body immediately and calls raise(SIGSTOP). If that raise()
> fires before PTRACE_SEIZE executes in the parent, the SIGSTOP causes a
> job-control stop (T state), not a ptrace-stop. PTRACE_SEIZE on an
> already-T-stopped process does not generate a new ptrace event.
>
> SAFE_WAITPID(..., 0) without WUNTRACED cannot see a job-control stop,
> so the parent hangs indefinitely.
>
> The comment "Parent will PTRACE_CONT us when ready - no checkpoint
> needed" assumes PTRACE_SEIZE always wins the race, which is not
> guaranteed, especially on a loaded system.
>
> A second checkpoint (wake from parent after PTRACE_SEIZE completes,
> wait in tracee before the first loop iteration) would close the window.
>
> > +/*
> >   * CVE-2017-1000405
> >   *
> > [...]
> > + * Test Modes:
> > + *
> > + * PROC_MEM_ALWAYS: Direct writes to /proc/self/mem ...
>
> The patch modifies this description block. The required opening for an
> LTP high-level description block is /*\ (with a backslash), not /*.
> The block is exported to the test catalog and must use the /*\ form.
>
> Verdict - Needs revision
>
> ---
> Note:
>
> The agent can sometimes produce false positives although often its
> findings are genuine. If you find issues with the review, please
> comment this email or ignore the suggestions.
>
> Regards,
> LTP AI Reviewer
Send v5 soon.
Thanks

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp