linux-stable.git/tools/testing, branch v7.1.5

selftests/landlock: Fix screwed up pointers in the scoped_signal_test

2026-07-24T14:21:21+00:00

commit d793186aa3bb833c878ae6826c87e62c843afaa3 upstream.

The scoped_signal_test uses pthread_join(..., (void **)&ret)) in
a couple of places, i.e. the return value of the thread is stored
in the shape of a "void *" into the memory location of &ret.
Pointers are 64-bit on modern computers, but the ret variable is
declared as a simple "enum thread_return" which is only 32 bits.
So the pthread_join() will overflow the ret variable by 4 byte.

The problem is very visible on big endian systems like s390x
where the test is failing: The least significant byte that carries
the return code of the thread is not written into the ret variable
here, but somewhere else in the stack frame, so the comparison
for the right return code is failing here.

Fix it by getting rid of the enum and defining the THREAD_* constants
and "ret" variables as proper "void *" pointers. This way we can
also get rid of some ugly (void *) castings in a couple of spots.

Signed-off-by: Thomas Huth 
Link: https://patch.msgid.link/20260709164340.339656-1-thuth@redhat.com
Cc: stable@vger.kernel.org
Fixes: c8994965013e ("selftests/landlock: Test signal scoping for threads")
[mic: Add clang-format markups]
Signed-off-by: Mickaël Salaün 
Signed-off-by: Greg Kroah-Hartman

selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not available

2026-07-24T14:21:21+00:00

commit 5ab1dc6d110db6bee167a32fd94c53ea0e7ad6d2 upstream.

MSG_OOB might be disabled in the kernel for unix sockets (by not
selecting CONFIG_AF_UNIX_OOB), and in this case the related tests
of the scoped_signal_test are currently failing.  Add a runtime
probe using socketpair() to detect MSG_OOB support and skip the
test gracefully if it is unavailable.

Signed-off-by: Thomas Huth 
Link: https://patch.msgid.link/20260710081642.405916-1-thuth@redhat.com
Cc: stable@vger.kernel.org
Fixes: f34e9ce5f479 ("selftests/landlock: Test signal created by out-of-bound message")
Signed-off-by: Mickaël Salaün 
Signed-off-by: Greg Kroah-Hartman

selftests/rseq: Fix a building error for riscv arch

2026-07-24T14:21:20+00:00

commit a2ac823d8a228e392bc6a79ea63b550ab84a55b2 upstream.

RISC-V rseq selftests include asm/fence.h from tools/arch/riscv,
but the rseq Makefile only adds tools/include in the CFLAGS, this
results in the building failure both for native and cross build:

    In file included from rseq.h:131,
                     from rseq.c:37:
    rseq-riscv.h:11:10: fatal error: asm/fence.h: No such file or directory

To fix it, add the matching tools/arch/$(ARCH)/include path in the
CFLAGS and derive ARCH from SUBARCH for standalone native builds where
ARCH is not set.

Fixes: c92786e179e0 ("KVM: riscv: selftests: Use the existing RISCV_FENCE macro in `rseq-riscv.h`")
Cc: stable@vger.kernel.org
Signed-off-by: Hui Wang 
Link: https://patch.msgid.link/20260707082348.36896-1-hui.wang@canonical.com
Signed-off-by: Paul Walmsley 
Signed-off-by: Greg Kroah-Hartman

selftests: net: make busywait timeout clock portable

2026-07-24T14:21:19+00:00

commit dd6a23bac306b7aa322e0aaccb60c6e32a198fb3 upstream.

loopy_wait() expects millisecond timestamps. However, Ubuntu Resolute
can use uutils date, where `date -u +%s%3N` returns seconds plus full
nanoseconds instead of a 3-digit millisecond field. This makes
busywait expire too early and can make vlan_bridge_binding.sh read a
stale operstate.

Fixes: 25ae948b4478 ("selftests/net: add lib.sh")
Cc: stable@vger.kernel.org # 6.8+
Link: https://github.com/uutils/coreutils/issues/11658
Signed-off-by: Nirmoy Das 
Link: https://patch.msgid.link/20260630165157.3814871-1-nirmoyd@nvidia.com
Signed-off-by: Paolo Abeni 
Signed-off-by: Greg Kroah-Hartman

selftests: net: fix file owner for broadcast_ether_dst test

2026-07-24T14:21:15+00:00

commit b8613e9792002add3bf77122868cc06ce142e953 upstream.

Ensure the output file is always owned by root (even if tcpdump was
compiled with `--with-user`), by passing the `-Z root` argument when
invoking it.

Cc: stable@vger.kernel.org
Reported-by: Edoardo Canepa 
Closes: https://bugs.launchpad.net/ubuntu-kernel-tests/+bug/2129815
Fixes: bf59028ea8d4 ("selftests: net: add test for destination in broadcast packets")
Suggested-by: Edoardo Canepa 
Tested-by: Ross Porter 
Signed-off-by: Ross Porter 
Link: https://patch.msgid.link/20260617061039.79717-2-ross.porter@canonical.com
Signed-off-by: Jakub Kicinski 
Signed-off-by: Greg Kroah-Hartman

selftests/ftrace: Drop invalid top-level local in test_ownership

2026-07-24T14:21:14+00:00

commit 808c447df2fe234eb7d9e08ecf53159d291c104c upstream.

test_ownership.tc is sourced by ftracetest under /bin/sh.

The script currently declares mount_point with local at file scope,
which makes /bin/sh abort with "local: not in a function" before the
test can reach the eventfs ownership checks.

Replace the top-level local declaration with a normal shell variable so
kernels that support the gid= tracefs mount option can run the test at
all.

Link: https://lore.kernel.org/r/20260407102613.81419-1-create0818@163.com
Fixes: 8b55572e51805 ("tracing/selftests: Add tracefs mount options test")
Signed-off-by: Cao Ruichuang 
Reviewed-by: Steven Rostedt (Google) 
Acked-by: Masami Hiramatsu (Google) 
Cc: stable@vger.kernel.org
Signed-off-by: Shuah Khan 
Signed-off-by: Greg Kroah-Hartman

selftests/bpf: Cover negative buffer pointer offsets

2026-07-24T14:21:09+00:00

commit 6f59deb32efa4673fc3b1fef9f3a0da48e9d8494 upstream.

Add verifier coverage for constant negative offsets on PTR_TO_TP_BUFFER
and PTR_TO_BUF pointers. Both programs adjust the buffer pointer by -8
and access it at offset zero, so the negative effective start must be
rejected at load time.

Switch the raw tracepoint writable attach checks from nbd_send_request
to bpf_testmod_test_writable_bare_tp, avoiding a dependency on the NBD
tracepoint. Keep the existing past-end case and add a case with a
negative var_off compensated by a positive instruction offset. The
effective start remains non-negative, so the program loads, but its
access end exceeds the writable context size and
bpf_raw_tracepoint_open() must return -EINVAL.

Cc: stable@vger.kernel.org # 5.2.0
Signed-off-by: Sun Jian 
Acked-by: Shung-Hsi Yu 
Link: https://patch.msgid.link/20260714093846.18159-3-sun.jian.kdev@gmail.com
Signed-off-by: Eduard Zingerman 
Signed-off-by: Greg Kroah-Hartman

selftests/landlock: Test SCOPE_SIGNAL on the SIGIO/fowner pgid path

2026-07-24T14:21:01+00:00

commit 76579d09beedaffe7fe76e9c05644f73983e1ceb upstream.

Add regression tests for the LANDLOCK_SCOPE_SIGNAL handling of the
asynchronous SIGIO delivery path (fcntl(F_SETOWN)) with a process-group
owner.

sigio_to_pgid_members covers the bypass: a sandboxed process at the head
of its process group's PGID hlist (the default after fork()) arms
F_SETOWN(-pgrp) + O_ASYNC and triggers the fan-out; the in-domain owner
must be signaled (proving the trigger fired) while the non-sandboxed
member of the group, outside the domain, must not.

sigio_to_pgid_self covers the same-process guarantee: the owner is
registered from a sandboxed non-leader thread, whose domain differs from
the thread-group leader the kernel signals for a process-group owner.
That leader belongs to the owner's own process and must still be
signaled.

Without the fix the first test sees the out-of-domain member signaled
and the second sees the owner's own leader denied.

Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas 
Reviewed-by: Günther Noack 
Link: https://patch.msgid.link/43370e89f7a896a583bf33d1cd171d02630e61bf.1780614610.git.hexlabsecurity@proton.me
[mic: Fix comment]
Signed-off-by: Mickaël Salaün 
Signed-off-by: Greg Kroah-Hartman

selftests/net: fix EVP_MD_CTX leak in tcp_mmap

2026-07-24T14:20:46+00:00

[ Upstream commit f4ef35efbb49527293309f668ea73ec5de9b8e7a ]

In tcp_mmap.c, both child_thread() and main() allocate an EVP_MD_CTX
via EVP_MD_CTX_new() when integrity checking is enabled, but neither
function releases the context.  child_thread() misses the free in its
common cleanup block, and main() returns without freeing the context.

This results in a SHA256 context leak on every run that uses the
‑i (integrity) option.  Add the missing EVP_MD_CTX_free() calls to
the appropriate cleanup paths to fix the leak.

Fixes: 5c5945dc695c ("selftests/net: Add SHA256 computation over data sent in tcp_mmap")
Signed-off-by: Wang Yan 
Link: https://patch.msgid.link/20260702025949.442523-1-wangyan01@kylinos.cn
Signed-off-by: Paolo Abeni 
Signed-off-by: Sasha Levin

selftests: gpio: add gpio-cdev-uaf to .gitignore

2026-07-24T14:20:44+00:00

[ Upstream commit 4ad805f0e41acf56ac54855c666d34c59ad66fe7 ]

Commit c7f92042d3f3 ("selftests: gpio: Add gpio-cdev-uaf tests") added
the gpio-cdev-uaf binary to TEST_GEN_PROGS_EXTENDED but never added it
to .gitignore. Building it with:

    make -C tools/testing/selftests/gpio TARGETS=gpio

leaves gpio-cdev-uaf as an untracked file.

Fixes: c7f92042d3f3 ("selftests: gpio: Add gpio-cdev-uaf tests")
Signed-off-by: Cihan Karadag 
Reviewed-by: Tzung-Bi Shih 
Link: https://patch.msgid.link/20260707235707.1349969-1-cihan.cihan@gmail.com
Signed-off-by: Bartosz Golaszewski 
Signed-off-by: Sasha Levin