Re: lapi/prctl: add more fallback definitions

Hi Andrea,

On Mon, 3 Aug 2026, Andrea Cervesato wrote:
> lapi/prctl: add more fallback definitions

--- [PATCH 1/2] ---

> +#ifndef PR_SET_MM_MAP_SIZE
> +# define PR_SET_MM_MAP_SIZE	15
> +#endif
> +
> +#if !defined(HAVE_STRUCT_PRCTL_MM_MAP) && !defined(PR_SET_MM_MAP_SIZE)

Could this declaration be gated only on HAVE_STRUCT_PRCTL_MM_MAP?
PR_SET_MM_MAP_SIZE is defined immediately above, so the second condition is
always false. On systems where configure finds no struct prctl_mm_map, the
fallback is therefore never declared and the test fails to compile.

--- [PATCH 2/2] ---

> +	run_spray();
> +
> +	TST_CHECKPOINT_WAKE(CP_SPRAYED);
> +	TST_CHECKPOINT_WAIT(CP_SETATTR_DONE);

Could sched_setattr() run while PR_SET_MM_MAP is still copying the controlled
auxv? Here all prctl calls return before the checkpoint wake, and the waiter
then executes checkpoint futex syscalls before the main thread starts the
chain walk. The controlled user_auxv stack array is no longer live and can be
overwritten, allowing a vulnerable kernel to survive and be reported as
TPASS. The referenced PoC keeps the prctl copy active while sched_setattr()
runs so that the forged waiter remains live during the chain walk.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp