From nobody Mon Aug 17 12:10:22 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hNs9C0LDMz6pC5B for ; Mon, 17 Aug 2026 12:10:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hNs9B62P6z3F54 for ; Mon, 17 Aug 2026 12:10:22 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786968622; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=DD/m5846aEVTqEgZKXuJQ0f93dNniPxyvMkCgGZGO18=; b=lRzCoGn4WiZR/hqvrJGs/GtbagqnmMmvTRRwqnreH/iG3cYwiyHygspxPtNvvQgw1w4ord yPLPMYsGp3is5n9xUj/dE/iON2+oECn/IOmsczCtGdmI/nbFY3fOxyHTFkn2YwegA0ALfs CObvv+8YwmADuJV6bsDjFM7VVVmkjqAPONt5kMeS+I8akYGbVG2N1qkuiwo5bfIxvD/fgP N8vLpaW3bx1kqS32ZKpndbY7hP6fPP78295yfjW5OocsDIiQepI/cNl5mBtrldZ2ynxW69 JgSybRlILAc9VggPjGnaoIk6AvfzEWYmEdXLI/zQQM1JHYlSZ+uUUzDs11Uz+A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1786968622; a=rsa-sha256; cv=none; b=NfwZf0ES42J8RB/tG2roXLIYAbxFfAkekvUWjB9PmY1kwhD7EAGND04WYZ4vVEbHO4CN1Q sl4iGlkOQjAVw7ct1h99/Hql76ocUWwtYeCFeEOoYMDkv7HOG9rQBT7su3enktAKovvXKE r+DN97GC3igokYD3ZgxgsHwuQ3FM9/xVcO7qZAQWNrdjlXskP96xW4zBlQl12ChL+49c01 1TqWsumwLbAyHA7S3A3V1wcnwWeYa2On6fpnUz9KrPSbTvQxQMF3wLUVI1M3HKyDXN0TpP CSZSjty8ex3N6QBp5/sTAdKDsfes/fT04XfAQpbtZViuW/LMsM4ISiLZ2cb76w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786968622; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=DD/m5846aEVTqEgZKXuJQ0f93dNniPxyvMkCgGZGO18=; b=yPyhzpPXBaV2ELLXAY8YHVjl+Jv0mU7p2v1AcztJdX0EiYF+ltMaqw58TgOYryqGpOv1/G oafSMz557YxR5UKFkAnE2zYS0YUWUAQCq9M9rpnyU/Gp8/9aJ3kG8cWwQaaYFVeiFRAFfj 75iydJhvFbyz9OsBNkZ3v5qIRQShKpUgMeQ928AtPrYgsqG8MZ+p2CZaFf+wjtu+gCW8FO l2YMetwyj8AcZEsq1FOxBMtQMTVfN7MKD1cUkdChfuPd/Y02XaGUXI1hDhYRrD4en1c5mt fsV68qOyMpeLgHRruhwfHDUU18D+YZPVytjWpnC/B9VTg7Rgb4I2mHLD3PVv1Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hNs9B4qtPz1CZw for ; Mon, 17 Aug 2026 12:10:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3c774 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 17 Aug 2026 12:10:22 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: f2c99600cbdf - stable/15 - tests/libc: Fix fortify_source uio tests List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: f2c99600cbdfa9df93fd0566f49bb001495c91c8 Auto-Submitted: auto-generated Date: Mon, 17 Aug 2026 12:10:22 +0000 Message-Id: <6a82fa2e.3c774.5b7b0b86@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=f2c99600cbdfa9df93fd0566f49bb001495c91c8 commit f2c99600cbdfa9df93fd0566f49bb001495c91c8 Author: Mark Johnston AuthorDate: 2026-07-31 14:20:00 +0000 Commit: Mark Johnston CommitDate: 2026-08-17 12:07:41 +0000 tests/libc: Fix fortify_source uio tests Some of the preadv() and readv() tests were not initializing the iovecs they pass to the system call. When the system call is expected to fail, that's fine since the FORTIFY_SOURCE checks cause the process to be aborted. However, in the rest of the test cases, the (p)readv() call could cause spurious test failures, e.g., when an uninitialized iov entry points to the current stack frame and the canary gets overwritten. Modify the tests to explicitly initialize iov entries to avoid this. The "iov" variants don't have this problem, so leave them alone. Reviewed by: kevans MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58289 (cherry picked from commit 1719b754a9ec88fcf0f5f4b001b1b5d5d6db5819) --- lib/libc/tests/secure/fortify_uio_test.c | 100 ++++++++++++++++++----- lib/libc/tests/secure/generate-fortify-tests.lua | 27 ++++-- 2 files changed, 98 insertions(+), 29 deletions(-) diff --git a/lib/libc/tests/secure/fortify_uio_test.c b/lib/libc/tests/secure/fortify_uio_test.c index b1b51eff824c..45f63f3d0975 100644 --- a/lib/libc/tests/secure/fortify_uio_test.c +++ b/lib/libc/tests/secure/fortify_uio_test.c @@ -181,6 +181,11 @@ ATF_TC_BODY(readv_before_end, tc) replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + readv(STDIN_FILENO, __stack.__buf, __len); #undef BUF @@ -204,6 +209,11 @@ ATF_TC_BODY(readv_end, tc) replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + readv(STDIN_FILENO, __stack.__buf, __len); #undef BUF @@ -236,6 +246,11 @@ ATF_TC_BODY(readv_after_end, tc) disable_coredumps(); replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + readv(STDIN_FILENO, __stack.__buf, __len); _exit(EX_SOFTWARE); /* Should have aborted. */ @@ -282,6 +297,11 @@ ATF_TC_BODY(readv_heap_before_end, tc) __stack.__buf = malloc(__bufsz); replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + readv(STDIN_FILENO, __stack.__buf, __len); #undef BUF @@ -306,6 +326,11 @@ ATF_TC_BODY(readv_heap_end, tc) __stack.__buf = malloc(__bufsz); replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + readv(STDIN_FILENO, __stack.__buf, __len); #undef BUF @@ -339,6 +364,11 @@ ATF_TC_BODY(readv_heap_after_end, tc) __stack.__buf = malloc(__bufsz); replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + readv(STDIN_FILENO, __stack.__buf, __len); _exit(EX_SOFTWARE); /* Should have aborted. */ @@ -383,11 +413,11 @@ ATF_TC_BODY(readv_iov_before_end, tc) const size_t __idx __unused = __len - 1; struct iovec iov[1]; + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - readv(STDIN_FILENO, iov, nitems(iov)); #undef BUF @@ -410,11 +440,11 @@ ATF_TC_BODY(readv_iov_end, tc) const size_t __idx __unused = __len - 1; struct iovec iov[1]; + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - readv(STDIN_FILENO, iov, nitems(iov)); #undef BUF @@ -438,11 +468,11 @@ ATF_TC_BODY(readv_iov_heap_before_end, tc) struct iovec iov[1]; __stack.__buf = malloc(__bufsz); + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - readv(STDIN_FILENO, iov, nitems(iov)); #undef BUF @@ -466,11 +496,11 @@ ATF_TC_BODY(readv_iov_heap_end, tc) struct iovec iov[1]; __stack.__buf = malloc(__bufsz); + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - readv(STDIN_FILENO, iov, nitems(iov)); #undef BUF @@ -503,11 +533,11 @@ ATF_TC_BODY(readv_iov_heap_after_end, tc) /* Child */ disable_coredumps(); __stack.__buf = malloc(__bufsz); + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - readv(STDIN_FILENO, iov, nitems(iov)); _exit(EX_SOFTWARE); /* Should have aborted. */ @@ -553,6 +583,11 @@ ATF_TC_BODY(preadv_before_end, tc) replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + preadv(STDIN_FILENO, __stack.__buf, __len, 0); #undef BUF @@ -576,6 +611,11 @@ ATF_TC_BODY(preadv_end, tc) replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + preadv(STDIN_FILENO, __stack.__buf, __len, 0); #undef BUF @@ -608,6 +648,11 @@ ATF_TC_BODY(preadv_after_end, tc) disable_coredumps(); replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + preadv(STDIN_FILENO, __stack.__buf, __len, 0); _exit(EX_SOFTWARE); /* Should have aborted. */ @@ -654,6 +699,11 @@ ATF_TC_BODY(preadv_heap_before_end, tc) __stack.__buf = malloc(__bufsz); replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + preadv(STDIN_FILENO, __stack.__buf, __len, 0); #undef BUF @@ -678,6 +728,11 @@ ATF_TC_BODY(preadv_heap_end, tc) __stack.__buf = malloc(__bufsz); replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + preadv(STDIN_FILENO, __stack.__buf, __len, 0); #undef BUF @@ -711,6 +766,11 @@ ATF_TC_BODY(preadv_heap_after_end, tc) __stack.__buf = malloc(__bufsz); replace_stdin(); + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } + preadv(STDIN_FILENO, __stack.__buf, __len, 0); _exit(EX_SOFTWARE); /* Should have aborted. */ @@ -755,11 +815,11 @@ ATF_TC_BODY(preadv_iov_before_end, tc) const size_t __idx __unused = __len - 1; struct iovec iov[1]; + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - preadv(STDIN_FILENO, iov, nitems(iov), 0); #undef BUF @@ -782,11 +842,11 @@ ATF_TC_BODY(preadv_iov_end, tc) const size_t __idx __unused = __len - 1; struct iovec iov[1]; + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - preadv(STDIN_FILENO, iov, nitems(iov), 0); #undef BUF @@ -810,11 +870,11 @@ ATF_TC_BODY(preadv_iov_heap_before_end, tc) struct iovec iov[1]; __stack.__buf = malloc(__bufsz); + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - preadv(STDIN_FILENO, iov, nitems(iov), 0); #undef BUF @@ -838,11 +898,11 @@ ATF_TC_BODY(preadv_iov_heap_end, tc) struct iovec iov[1]; __stack.__buf = malloc(__bufsz); + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - preadv(STDIN_FILENO, iov, nitems(iov), 0); #undef BUF @@ -875,11 +935,11 @@ ATF_TC_BODY(preadv_iov_heap_after_end, tc) /* Child */ disable_coredumps(); __stack.__buf = malloc(__bufsz); + replace_stdin(); + iov[0].iov_base = __stack.__buf; iov[0].iov_len = __len; - replace_stdin(); - preadv(STDIN_FILENO, iov, nitems(iov), 0); _exit(EX_SOFTWARE); /* Should have aborted. */ diff --git a/lib/libc/tests/secure/generate-fortify-tests.lua b/lib/libc/tests/secure/generate-fortify-tests.lua index ef34fb8513c8..c1c455e84b56 100755 --- a/lib/libc/tests/secure/generate-fortify-tests.lua +++ b/lib/libc/tests/secure/generate-fortify-tests.lua @@ -113,12 +113,21 @@ local printf_init = [[ srcvar[sizeof(srcvar) - 1] = '\0'; ]] -local readv_stackvars = "\tstruct iovec iov[1];\n" local readv_init = [[ - iov[0].iov_base = __stack.__buf; - iov[0].iov_len = __len; + replace_stdin(); + + for (size_t __i = 0; __i < 2; __i++) { + __stack.__buf[__i].iov_base = &__stack.padding_l; + __stack.__buf[__i].iov_len = 1; + } +]] +local readv_iov_stackvars = "\tstruct iovec iov[1];\n" +local readv_iov_init = [[ replace_stdin(); + + iov[0].iov_base = __stack.__buf; + iov[0].iov_len = __len; ]] local socket_stackvars = "\tint sock[2] = { -1, -1 };\n" @@ -411,7 +420,7 @@ local all_tests = { "__buf", "__len", }, - init = stdio_init, + init = readv_init, }, { func = "readv", @@ -422,8 +431,8 @@ local all_tests = { "nitems(iov)", }, exclude = excludes_stack_overflow, - stackvars = readv_stackvars, - init = readv_init, + stackvars = readv_iov_stackvars, + init = readv_iov_init, uses_len = true, }, { @@ -436,7 +445,7 @@ local all_tests = { "__len", "0", }, - init = stdio_init, + init = readv_init, }, { func = "preadv", @@ -448,8 +457,8 @@ local all_tests = { "0", }, exclude = excludes_stack_overflow, - stackvars = readv_stackvars, - init = readv_init, + stackvars = readv_iov_stackvars, + init = readv_iov_init, uses_len = true, }, },