[LTP] [PATCH] cve/cve-2015-3290: Correct the length parameter for perf munmap

Tengda Wu stavewu@gmail.com
Sat Sep 6 06:22:07 CEST 2025


Since commit b024d7b56c77 in the Linux kernel, the perf munmap operation
no longer allows VMA splits. However, in the cve-2015-3290 test case, the
length parameters passed to mmap and munmap were different:

* The length for mmap was event_mlock_kb * 1024, where event_mlock_kb is
  typically 516.
* The length for munmap was hardcoded to 512 * 1024.

This discrepancy caused the munmap operation to attempt to split a VMA due
to unaligned range boundaries, which resulted in it returning -EINVAL and
consequently caused the test case to fail.

Fix this by correcting the length parameter for the perf munmap call to
event_mlock_kb * 1024.

Signed-off-by: Tengda Wu <stavewu@gmail.com>
---
 testcases/cve/cve-2015-3290.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testcases/cve/cve-2015-3290.c b/testcases/cve/cve-2015-3290.c
index e70742acc..cb60582b4 100644
--- a/testcases/cve/cve-2015-3290.c
+++ b/testcases/cve/cve-2015-3290.c
@@ -415,7 +415,7 @@ static void *child_thread(void *arg)
 
 	for (i = 0; i < ARRAY_SIZE(perf_events); i++)
 		if (perf_mmaps[i] != MAP_FAILED)
-			SAFE_MUNMAP(perf_mmaps[i], 512 * 1024);
+			SAFE_MUNMAP(perf_mmaps[i], event_mlock_kb * 1024);
 
 	return (void *)niter;
 }
-- 
2.34.1



More information about the ltp mailing list