[LTP] [PATCH v6 0/3] Handle FORCE_PTRACE in thp04 and add ptrace coverage

[Jan Polensky]

thp04 is a CVE-2017-1000405 regression test. If direct
/proc/self/mem writes are blocked by CONFIG_PROC_MEM_FORCE_PTRACE=y,
the CVE cannot be triggered and thp04 should report TCONF.

Add separate ptrace tests for the CONFIG_PROC_MEM_FORCE_PTRACE behavior
instead:

- ptrace12 checks that writing to /proc/self/mem is rejected with EIO.
- ptrace13 checks that a parent can write to a traced child's memory via
  /proc/pid/mem.

Both ptrace tests use read-only mappings, so the writes require
FOLL_FORCE and exercise the CONFIG_PROC_MEM_FORCE_PTRACE enforcement.

Tested on s390x with CONFIG_PROC_MEM_FORCE_PTRACE=y:

- thp04: TCONF (direct /proc/self/mem writes blocked)
- ptrace12: TPASS
- ptrace13: TPASS, 100 iterations

Follow-up to the previous thp04 ptrace mode discussion:
https://lore.kernel.org/all/20260709175927.268677-1-japo@linux.ibm.com/

Changes in v6:
- thp04: probe /proc/self/mem on a separate anonymous mapping to avoid
  COW-polluting the huge zero page before the race test starts
- thp04/ptrace12/ptrace13: fix SPLIT_STRING checkpatch warnings
- ptrace12/ptrace13: move runtest entries before the pwrite blank line
- ptrace13: skip raise(SIGSTOP) on last iteration so child exits via exit(0)

Changes in v5:
- thp04: use != -1 instead of >= 0 for fd validity checks in thp_cleanup()
- thp04: cast TST_RET to (ssize_t) before comparing with sizeof()
- ptrace12: use != -1 instead of >= 0 for memfd validity check in cleanup()
- ptrace12: cast TST_RET to (ssize_t) before comparing with sizeof()
- ptrace13: fix race between PTRACE_INTERRUPT and child's first raise(SIGSTOP);
  replace PTRACE_INTERRUPT with an explicit initial raise(SIGSTOP) in the child
- ptrace13: cast TST_RET to (ssize_t) before comparing with sizeof()
- ptrace13: remove redundant #include "tst_checkpoint.h" (already in tst_test.h)
- ptrace13: update doc-comment to reflect the new stop flow

Changes in v4:
- thp04: prove the /proc/self/mem probe changes memory before running the race
- thp04: tighten direct-write result handling and document blocked-write behavior
- ptrace12: gate the test on CONFIG_PROC_MEM_FORCE_PTRACE=y
- ptrace12: treat successful /proc/self/mem writes as TFAIL under the required config
- ptrace13: use a tracer-controlled PTRACE_INTERRUPT initial stop
- ptrace13: fix the iteration diagnostic and clean up wait-status handling
- ptrace13: use PTRACE_KILL for normal termination

v5: https://lore.kernel.org/all/20260908111332.150323-1-japo@linux.ibm.com/
v4: https://lore.kernel.org/all/20260722135926.359462-1-japo@linux.ibm.com/
v3: https://lore.kernel.org/all/20260721202452.315581-1-japo@linux.ibm.com/
v2: https://lore.kernel.org/all/20260716095004.92793-1-japo@linux.ibm.com/
v1: https://lore.kernel.org/all/20260714150631.250972-1-japo@linux.ibm.com/

Jan Polensky (3):
  thp04: group runtime state and skip when /proc/self/mem writes are
    blocked
  ptrace: add test for /proc/self/mem write rejection
  ptrace: add test for /proc/pid/mem writes under ptrace

 runtest/syscalls                            |   2 +
 testcases/kernel/mem/thp/thp04.c            | 172 ++++++++++-----
 testcases/kernel/syscalls/ptrace/.gitignore |   2 +
 testcases/kernel/syscalls/ptrace/ptrace12.c |  95 +++++++++
 testcases/kernel/syscalls/ptrace/ptrace13.c | 220 ++++++++++++++++++++
 5 files changed, 439 insertions(+), 52 deletions(-)
 create mode 100644 testcases/kernel/syscalls/ptrace/ptrace12.c
 create mode 100644 testcases/kernel/syscalls/ptrace/ptrace13.c


base-commit: 352f9134942933efcfa608b87ae814db603b3228
--
2.55.0