From nobody Fri Jul 31 14:22:30 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hBSvW051lz6mtg0 for ; Fri, 31 Jul 2026 14:22:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hBSvV51rHz3fqW for ; Fri, 31 Jul 2026 14:22:30 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785507750; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hctilC319klOcVZJhTxuGhVjdizyIgC02g8W09lyRaQ=; b=ozQCrmFWPtItNervJVTgRGVQccN6/FmuKrP6SMN/36NvCT1DfIAUIEl9XMCfUiuf7kwch+ PAf88JNXQq0xC2VMxueT75D65iRSTT1jR9KOGVygVLGMFFCoBW1M49F4rDXr2Yhy9vBrzC C+PiM7419s5CH/3WttJQ30BSmp6axjp5f4viaqYPK+km43Dyx0yAiKEIi4t/fM05KND/zH liJlQVRhxlxl8HuMabRLIhigA0P3UYdCgToUkzXaD9LxbCXZsDARBsdE/O7AALr5z2JSFW 4o7/Nwaskz8/r9DDPNl2lyaO90borYE88CG94bYXT12r8ui3oagscP3QcgjY6Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785507750; a=rsa-sha256; cv=none; b=YH7QiC2YGp8HNKEDYCR+3CxGwswgoi4KpYvlLgHuFp7twhSs7tmAsEuknN4jFo11InJoQA 7qiAQf+WKKMlLSoRts+0b1ZhpH/95PoizdJSoL8r1UW8/OAk448rKcJEA/PZWKye0lAxeC 384dK8/5sVHLkiPWXize6pxhX+mbgEpmbMlazXf11OzxQ3e/PXEseY9cKfdSXbjhz8SrRr spQ6MvyfHyaxxOQRz0r06OArdIGSvd+OGShWcA0kThBjmk+EtOzWMAZfrSQRh2wmU8iq8s 3Z0sUDZgzEiSIEZfaGDvH+Sd5r5qIWW30gUTlzKVnXZn/zEhiTr8dk3MHRGVKQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785507750; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=hctilC319klOcVZJhTxuGhVjdizyIgC02g8W09lyRaQ=; b=WZKJgCGgjNOIOFuBvfC4LVM01r9xhvQuF2CdNfiB1j2HY3vj+XpW9E3mO9jzoWJ2z/W1jq 0/tz3s8WUFXBTkHi/1pz/wb0lUEwZyDls15mj29v+O6UpGKupVv40vL1S5MxVGMQqpi2vL JP91a9tIfZnbgdw/7+1A8wLPbIG6kzcqJ0XxgMxlAt7SEZn7oiWjMkhqEmTn8B18DlATsC SSVX6YvCznfKiFXk5LxF2pBqBBgNzkzTn3QpUoFu9rq7nmHrDeyY/uv5hatN2mLt1QZ4i2 1bens0Q+O6QoLZ/4E38RbX5N7tSJ1StTx712+igN4XVIBrACXp79N21b8XDJiw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hBSvV3sWwz13db for ; Fri, 31 Jul 2026 14:22:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1f4fe by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 31 Jul 2026 14:22:30 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 1719b754a9ec - main - tests/libc: Fix fortify_source uio tests List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 1719b754a9ec88fcf0f5f4b001b1b5d5d6db5819 Auto-Submitted: auto-generated Date: Fri, 31 Jul 2026 14:22:30 +0000 Message-Id: <6a6cafa6.1f4fe.491ec150@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=1719b754a9ec88fcf0f5f4b001b1b5d5d6db5819 commit 1719b754a9ec88fcf0f5f4b001b1b5d5d6db5819 Author: Mark Johnston AuthorDate: 2026-07-31 14:20:00 +0000 Commit: Mark Johnston CommitDate: 2026-07-31 14:20:00 +0000 tests/libc: Fix fortify_source uio tests Some of the preadv() and readv() tests were not initializing the iovecs they pass to the system call. When the system call is expected to fail, that's fine since the FORTIFY_SOURCE checks cause the process to be aborted. However, in the rest of the test cases, the (p)readv() call could cause spurious test failures, e.g., when an uninitialized iov entry points to the current stack frame and the canary gets overwritten. Modify the tests to explicitly initialize iov entries to avoid this. The "iov" variants don't have this problem, so leave them alone. Reviewed by: kevans MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58289 --- lib/libc/tests/secure/fortify_uio_test.c | 100 ++++++++++++++++++----- lib/libc/tests/secure/generate-fortify-tests.lua | 27 ++++-- 2 files changed, 98 insertions(+), 29 deletions(-) diff --git a/lib/libc/tests/secure/fortify_uio_test.c b/lib/libc/tests/secure/fortify_uio_test.c index b1b51eff824c..45f63f3d0975 100644 --- a/lib/libc/tests/secure/fortify_uio_test.c +++ b/lib/libc/tests/secure/fortify_uio_test.c @@ -181,6 +181,11 @@ ATF_TC_BODY(readv_before_end, tc) replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + readv(STDIN_FILENO, __stack.__buf, __len); #undef BUF @@ -204,6 +209,11 @@ ATF_TC_BODY(readv_end, tc) replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + readv(STDIN_FILENO, __stack.__buf, __len); #undef BUF @@ -236,6 +246,11 @@ ATF_TC_BODY(readv_after_end, tc) disable_coredumps(); replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + readv(STDIN_FILENO, __stack.__buf, __len); _exit(EX_SOFTWARE); /* Should have aborted. */ @@ -282,6 +297,11 @@ ATF_TC_BODY(readv_heap_before_end, tc) __stack.__buf = malloc(__bufsz); replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + readv(STDIN_FILENO, __stack.__buf, __len); #undef BUF @@ -306,6 +326,11 @@ ATF_TC_BODY(readv_heap_end, tc) __stack.__buf = malloc(__bufsz); replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + readv(STDIN_FILENO, __stack.__buf, __len); #undef BUF @@ -339,6 +364,11 @@ ATF_TC_BODY(readv_heap_after_end, tc) __stack.__buf = malloc(__bufsz); replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + readv(STDIN_FILENO, __stack.__buf, __len); _exit(EX_SOFTWARE); /* Should have aborted. */ @@ -383,11 +413,11 @@ ATF_TC_BODY(readv_iov_before_end, tc) const size_t __idx __unused = __len - 1; struct iovec iov[1]; + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - readv(STDIN_FILENO, iov, nitems(iov)); #undef BUF @@ -410,11 +440,11 @@ ATF_TC_BODY(readv_iov_end, tc) const size_t __idx __unused = __len - 1; struct iovec iov[1]; + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - readv(STDIN_FILENO, iov, nitems(iov)); #undef BUF @@ -438,11 +468,11 @@ ATF_TC_BODY(readv_iov_heap_before_end, tc) struct iovec iov[1]; __stack.__buf = malloc(__bufsz); + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - readv(STDIN_FILENO, iov, nitems(iov)); #undef BUF @@ -466,11 +496,11 @@ ATF_TC_BODY(readv_iov_heap_end, tc) struct iovec iov[1]; __stack.__buf = malloc(__bufsz); + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - readv(STDIN_FILENO, iov, nitems(iov)); #undef BUF @@ -503,11 +533,11 @@ ATF_TC_BODY(readv_iov_heap_after_end, tc) /* Child */ disable_coredumps(); __stack.__buf = malloc(__bufsz); + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - readv(STDIN_FILENO, iov, nitems(iov)); _exit(EX_SOFTWARE); /* Should have aborted. */ @@ -553,6 +583,11 @@ ATF_TC_BODY(preadv_before_end, tc) replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + preadv(STDIN_FILENO, __stack.__buf, __len, 0); #undef BUF @@ -576,6 +611,11 @@ ATF_TC_BODY(preadv_end, tc) replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + preadv(STDIN_FILENO, __stack.__buf, __len, 0); #undef BUF @@ -608,6 +648,11 @@ ATF_TC_BODY(preadv_after_end, tc) disable_coredumps(); replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + preadv(STDIN_FILENO, __stack.__buf, __len, 0); _exit(EX_SOFTWARE); /* Should have aborted. */ @@ -654,6 +699,11 @@ ATF_TC_BODY(preadv_heap_before_end, tc) __stack.__buf = malloc(__bufsz); replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + preadv(STDIN_FILENO, __stack.__buf, __len, 0); #undef BUF @@ -678,6 +728,11 @@ ATF_TC_BODY(preadv_heap_end, tc) __stack.__buf = malloc(__bufsz); replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + preadv(STDIN_FILENO, __stack.__buf, __len, 0); #undef BUF @@ -711,6 +766,11 @@ ATF_TC_BODY(preadv_heap_after_end, tc) __stack.__buf = malloc(__bufsz); replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + preadv(STDIN_FILENO, __stack.__buf, __len, 0); _exit(EX_SOFTWARE); /* Should have aborted. */ @@ -755,11 +815,11 @@ ATF_TC_BODY(preadv_iov_before_end, tc) const size_t __idx __unused = __len - 1; struct iovec iov[1]; + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - preadv(STDIN_FILENO, iov, nitems(iov), 0); #undef BUF @@ -782,11 +842,11 @@ ATF_TC_BODY(preadv_iov_end, tc) const size_t __idx __unused = __len - 1; struct iovec iov[1]; + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - preadv(STDIN_FILENO, iov, nitems(iov), 0); #undef BUF @@ -810,11 +870,11 @@ ATF_TC_BODY(preadv_iov_heap_before_end, tc) struct iovec iov[1]; __stack.__buf = malloc(__bufsz); + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - preadv(STDIN_FILENO, iov, nitems(iov), 0); #undef BUF @@ -838,11 +898,11 @@ ATF_TC_BODY(preadv_iov_heap_end, tc) struct iovec iov[1]; __stack.__buf = malloc(__bufsz); + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - preadv(STDIN_FILENO, iov, nitems(iov), 0); #undef BUF @@ -875,11 +935,11 @@ ATF_TC_BODY(preadv_iov_heap_after_end, tc) /* Child */ disable_coredumps(); __stack.__buf = malloc(__bufsz); + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - preadv(STDIN_FILENO, iov, nitems(iov), 0); _exit(EX_SOFTWARE); /* Should have aborted. */ diff --git a/lib/libc/tests/secure/generate-fortify-tests.lua b/lib/libc/tests/secure/generate-fortify-tests.lua index ef34fb8513c8..c1c455e84b56 100755 --- a/lib/libc/tests/secure/generate-fortify-tests.lua +++ b/lib/libc/tests/secure/generate-fortify-tests.lua @@ -113,12 +113,21 @@ local printf_init = [[ srcvar[sizeof(srcvar) - 1] = '\0'; ]] -local readv_stackvars = "\tstruct iovec iov[1];\n" local readv_init = [[ - iov[0].iov_base = __stack.__buf; - iov[0].iov_len = __len; + replace_stdin(); + + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } +]] +local readv_iov_stackvars = "\tstruct iovec iov[1];\n" +local readv_iov_init = [[ replace_stdin(); + + iov[0].iov_base = __stack.__buf; + iov[0].iov_len = __len; ]] local socket_stackvars = "\tint sock[2] = { -1, -1 };\n" @@ -411,7 +420,7 @@ local all_tests = { "__buf", "__len", }, - init = stdio_init, + init = readv_init, }, { func = "readv", @@ -422,8 +431,8 @@ local all_tests = { "nitems(iov)", }, exclude = excludes_stack_overflow, - stackvars = readv_stackvars, - init = readv_init, + stackvars = readv_iov_stackvars, + init = readv_iov_init, uses_len = true, }, { @@ -436,7 +445,7 @@ local all_tests = { "__len", "0", }, - init = stdio_init, + init = readv_init, }, { func = "preadv", @@ -448,8 +457,8 @@ local all_tests = { "0", }, exclude = excludes_stack_overflow, - stackvars = readv_stackvars, - init = readv_init, + stackvars = readv_iov_stackvars, + init = readv_iov_init, uses_len = true, }, },