LTP test catalog
Test filtered by used flags
.all_filesystems
Tests containing .all_filesystems flag.
fallocate04 fallocate05 fallocate06 fanotify13 fanotify14 fanotify15 fanotify16 fanotify20 fanotify21 fdatasync03 fgetxattr01 fremovexattr01 fremovexattr02 fs_fill fsconfig01 fsetxattr01 fsmount01 fsmount02 fsopen01 fspick01 fspick02 fsync01 fsync04
.child_needs_reinit
Tests containing .child_needs_reinit flag.
.forks_child
Tests containing .forks_child flag.
abort01 access01 access02 access03 access04 add_key04 add_key05 af_alg04 aiodio_append aiodio_sparse alarm03 alarm07 autogroup01
capset04 cfs_bandwidth01 cgroup_core01 chroot02 clock_gettime03 clock_nanosleep01 clock_nanosleep03 clone01 clone08 close_range01 close_range02 cpuset01 creat04 creat07 crypto_user02 cve-2015-3290 cve-2017-17052 cve-2017-17053 cve-2017-2618
endian_switch01 epoll_pwait01 event_generator execl01 execle01 execlp01 execv01 execve01 execve02 execve04 execve05 execve06 execveat01 execveat02 execveat03 execvp01 exit02
fanotify03 fanotify07 fanotify10 fanotify12 fanotify17 fanotify19 fanotify21 fcntl12 fcntl15 fcntl33 fcntl35 flock03 flock04 fork01 fork07 fork08 fork13 fstat03 fstatfs02 ftruncate04 futex_cmp_requeue01 futex_wait02 futex_wake02 futex_wake03
madvise07 madvise08 madvise09 madvise10 max_map_count mbind04 membarrier01 memcg_test_3 memcontrol02 memcontrol03 memcontrol04 mesgq_nstest migrate_pages02 min_free_kbytes mincore04 mmap16 mmap18 mmapstress01 mount03 move_pages12 mq_timedreceive01 mq_timedsend01 msgget02 msgrcv02 msgrcv05 msgrcv06 msgsnd02 msgsnd05 msgsnd06 mtest01
pause01 pidfd_getfd01 pidfd_getfd02 pidfd_open03 pidfd_open04 pidfd_send_signal03 pidns13 pipe02 pipe11 pipe13 pipe2_02 pipe2_04 pivot_root01 pkey01 ppoll01 prctl03 prctl04 prctl06 prctl08 prctl10 process_vm01 process_vm_readv02 process_vm_readv03 process_vm_writev02 ptrace01 ptrace02 ptrace03 ptrace07 ptrace08 ptrace09 ptrace10 pty04
sched_getparam01 sched_setaffinity01 sched_setparam03 sched_setparam05 sched_setscheduler02 sched_setscheduler03 sctp_big_chunk select03 sem_nstest semctl01 semctl04 semop03 semtest_2ns set_mempolicy01 set_mempolicy02 set_mempolicy03 set_mempolicy04 setitimer01 setpgid03 setpriority01 setpriority02 setregid03 setreuid05 setrlimit04 setrlimit05 setrlimit06 setsockopt08 setuid04 shmat01 shmat02 shmctl01 shmem_2nstest shmget02 shmnstest sighold02 signal01 sigtimedwait01 sigwait01 sigwaitinfo01 splice02 stack_clash statfs02 swapon03 swapping01 sysctl03 sysinfo03
.format_device
Tests containing .format_device flag.
fallocate04 fallocate05 fallocate06 fanotify01 fanotify03 fanotify05 fanotify06 fanotify09 fanotify10 fanotify13 fanotify14 fanotify15 fanotify16 fanotify17 fanotify18 fanotify19 fanotify22 fanotify23 fdatasync03 fgetxattr01 fremovexattr01 fremovexattr02 fs_fill fsconfig01 fsetxattr01 fsmount01 fsmount02 fsopen01 fspick01 fspick02 fsync01 fsync04 ftruncate04
memcontrol02 memcontrol03 memcontrol04 mkdir09 mmap16 mount03 mount_setattr01 move_mount01 move_mount02 msync04
.hugepages
Tests containing .hugepages flag.
.min_kver
Tests containing .min_kver flag.
io_pgetevents01 io_pgetevents02 ioctl08 ioctl_ns01 ioctl_ns02 ioctl_ns03 ioctl_ns04 ioctl_ns05 ioctl_ns06 ioctl_ns07
madvise05 madvise06 madvise07 madvise08 meltdown membarrier01 memcg_test_3 memfd_create03 memfd_create04 migrate_pages03 mlock201 mlock202 mlock203 mmap12 mmap17 move_pages12 msgrcv03 msync04
.mount_device
Tests containing .mount_device flag.
fallocate04 fallocate05 fallocate06 fanotify01 fanotify03 fanotify05 fanotify06 fanotify09 fanotify10 fanotify13 fanotify14 fanotify15 fanotify16 fanotify17 fanotify18 fanotify19 fanotify22 fanotify23 fdatasync03 fgetxattr01 fremovexattr01 fremovexattr02 fs_fill fsetxattr01 fspick01 fspick02 fsync01 fsync04 ftruncate04
.needs_checkpoints
Tests containing .needs_checkpoints flag.
mallocstress memcontrol03 memcontrol04 migrate_pages02 mincore04 mmap16 mountns01 mountns02 mountns03 msg_comm
pause01 pidfd_getfd01 pidfd_getfd02 pidfd_open03 pidfd_open04 pidfd_send_signal01 pidfd_send_signal03 pidns12 pidns13 pidns20 pipe02 pipe13 prctl03 process_vm_readv02 process_vm_readv03 process_vm_writev02 ptrace07 pty04
.needs_device
Tests containing .needs_device flag.
fallocate04 fallocate05 fallocate06 fanotify01 fanotify03 fanotify05 fanotify06 fanotify09 fanotify10 fanotify13 fanotify14 fanotify15 fanotify16 fanotify17 fanotify18 fanotify19 fanotify20 fanotify21 fanotify22 fanotify23 fdatasync03 fgetxattr01 fremovexattr01 fremovexattr02 fs_fill fsconfig01 fsconfig02 fsetxattr01 fsmount01 fsmount02 fsopen01 fsopen02 fspick01 fspick02 fsync01 fsync04 ftruncate04
memcontrol02 memcontrol03 memcontrol04 mkdir09 mmap16 mount03 mount_setattr01 move_mount01 move_mount02 msync04
readahead02 rename01 rename03 rename04 rename05 rename06 rename07 rename08 rename10 rename12 rename13
.needs_drivers
Tests containing .needs_drivers flag.
.needs_kconfigs
Tests containing .needs_kconfigs flag.
icmp_rate_limit01 io_cancel01 io_cancel02 io_destroy02 io_getevents01 io_getevents02 io_setup02 io_submit02 io_submit03
.needs_root
Tests containing .needs_root flag.
access01 access02 access03 access04 acct01 acct02 add_key01 add_key03 add_key05 adjtimex01 adjtimex02 aiocp autogroup01
can_bcm01 capset02 capset03 cgroup_core01 chdir01 chmod03 chmod05 chmod06 chmod07 chown02 chown03 chown04 chown05 chroot01 chroot02 chroot04 clock_adjtime01 clock_adjtime02 clock_gettime01 clock_gettime02 clock_gettime03 clock_nanosleep03 clock_settime01 clock_settime02 clock_settime03 clone09 clone301 close_range01 copy_file_range02 cpuset01 creat04 creat06 creat08 creat09 crypto_user02 cve-2015-3290 cve-2017-2671
fallocate04 fallocate05 fallocate06 fanotify01 fanotify02 fanotify03 fanotify04 fanotify05 fanotify06 fanotify07 fanotify08 fanotify09 fanotify10 fanotify11 fanotify12 fanotify13 fanotify14 fanotify15 fanotify16 fanotify17 fanotify18 fanotify19 fanotify20 fanotify21 fanotify22 fanotify23 fanout01 fchdir03 fchmod02 fchmod03 fchmod04 fchmod05 fchmod06 fchown02 fchown03 fchown04 fchown05 fcntl33 fcntl35 fdatasync03 fgetxattr01 fgetxattr02 finit_module01 finit_module02 flistxattr01 flistxattr02 flistxattr03 fork13 fremovexattr01 fremovexattr02 fs_fill fsconfig01 fsconfig02 fsetxattr01 fsetxattr02 fsmount01 fsmount02 fsopen01 fsopen02 fspick01 fspick02 fsync01 fsync04 ftruncate04 futex_wake04
hugemmap01 hugemmap02 hugemmap04 hugemmap05 hugemmap06 hugemmap07 hugemmap08 hugemmap09 hugeshmat01 hugeshmat02 hugeshmat03 hugeshmat04 hugeshmat05 hugeshmctl01 hugeshmctl02 hugeshmctl03 hugeshmdt01 hugeshmget01 hugeshmget02 hugeshmget03 hugeshmget05
ima_boot_aggregate init_module01 init_module02 inotify03 inotify06 inotify07 inotify08 ioctl01 ioctl03 ioctl04 ioctl05 ioctl06 ioctl08 ioctl09 ioctl_loop01 ioctl_loop02 ioctl_loop03 ioctl_loop04 ioctl_loop05 ioctl_loop06 ioctl_loop07 ioctl_ns01 ioctl_ns05 ioctl_ns06 ioperm01 ioperm02 iopl01 iopl02
leapsec01 lgetxattr01 lgetxattr02 link04 link08 listxattr01 listxattr02 listxattr03 llistxattr01 llistxattr02 llistxattr03 lremovexattr01
madvise01 madvise02 madvise06 madvise07 madvise08 madvise09 max_map_count mbind03 meltdown memcg_test_3 memcontrol02 memcontrol03 memcontrol04 memfd_create03 mesgq_nstest migrate_pages02 migrate_pages03 min_free_kbytes mkdir02 mkdir03 mkdir04 mkdir05 mkdir09 mkdirat02 mlock201 mlock202 mlock203 mmap16 mount03 mount_setattr01 mountns01 mountns02 mountns03 mountns04 move_mount01 move_mount02 move_pages12 mq_open01 mq_unlink01 msg_comm msgctl04 msgctl06 msgget02 msgget04 msgget05 msgrcv02 msgrcv03 msgsnd02 msgsnd05 msgsnd06 msync04
oom01 oom02 oom03 oom04 oom05 open02 open08 open10 open11 open_by_handle_at01 open_by_handle_at02 open_tree01 open_tree02 openat04 overcommit_memory
pcrypt_aead01 perf_event_open02 perf_event_open03 pidfd_getfd01 pidfd_getfd02 pidfd_open04 pidfd_send_signal03 pidns01 pidns02 pidns03 pidns12 pidns13 pidns20 pidns32 pipe2_02 pivot_root01 pkey01 prctl04 prctl06 prctl07 preadv203 process_vm01 pt_test ptrace02 ptrace11 pty03 pty04 pty06 pty07
readahead02 readlink01 readlink03 realpath01 reboot01 reboot02 rename01 rename03 rename04 rename05 rename06 rename07 rename08 rename09 rename10 rename12 rename13 rmdir02 rmdir03 route-change-netlink rtc02
sched_getscheduler01 sched_rr_get_interval01 sched_rr_get_interval02 sched_rr_get_interval03 sched_setaffinity01 sched_setparam02 sched_setparam03 sched_setparam05 sched_setscheduler02 sched_setscheduler03 sctp_big_chunk sem_comm sem_nstest semctl02 semctl04 semctl09 semop02 semtest_2ns set_mempolicy03 set_mempolicy04 setdomainname01 setdomainname02 setdomainname03 setegid01 setegid02 setfsgid01 setfsgid02 setfsuid01 setfsuid03 setgid02 setgid03 setns01 setns02 setpriority01 setpriority02 setregid02 setregid03 setregid04 setresgid02 setresgid03 setresuid01 setresuid02 setresuid03 setreuid02 setreuid03 setreuid05 setrlimit02 setrlimit03 setrlimit04 setsockopt02 setsockopt03 setsockopt04 settimeofday01 setuid03 setuid04 setxattr01 setxattr02 setxattr03 shm_comm shmat01 shmat02 shmat03 shmctl02 shmctl04 shmdt01 shmem_2nstest shmget02 shmget04 shmget05 shmget06 shmnstest socketcall01 squashfs01 stack_clash stat01 stat03 statx01 statx04 statx05 statx06 statx07 statx08 statx09 stime01 stime02 swapoff01 swapoff02 swapon02 swapon03 swapping01 sync01 sync_file_range02 syncfs01 sysctl03 sysinfo03 syslog11 syslog12
thp01 thp03 timens01 timer_create01 timer_delete01 timer_settime01 timer_settime02 timerfd04 truncate03
.needs_tmpdir
Tests containing .needs_tmpdir flag.
abort01 accept02 access01 access02 acct02 af_alg02 af_alg07 aio02 aiocp aiodio_append aiodio_sparse autogroup01
cfs_bandwidth01 chdir01 chdir04 chmod01 chmod03 chmod05 chmod07 chown01 chown02 chown03 chown05 chroot01 chroot02 chroot03 chroot04 clone301 clone302 close01 close_range01 copy_file_range01 copy_file_range02 copy_file_range03 creat01 creat03 creat04 creat05 creat07 creat08 creat09 cve-2015-3290
dio_append dio_read dio_sparse dio_truncate dirtyc0w dirtypipe dup01 dup03 dup04 dup05 dup202 dup203 dup205 dup206 dup207
fallocate04 fallocate05 fallocate06 fanotify01 fanotify02 fanotify03 fanotify04 fanotify05 fanotify06 fanotify07 fanotify09 fanotify10 fanotify11 fanotify12 fanotify13 fanotify14 fanotify15 fanotify16 fanotify17 fanotify18 fanotify19 fanotify20 fanotify21 fanotify22 fanotify23 fchdir01 fchdir03 fchmod01 fchmod02 fchmod03 fchmod04 fchmod05 fchmodat01 fchown01 fchown02 fchown03 fchown05 fcntl02 fcntl03 fcntl04 fcntl05 fcntl12 fcntl15 fcntl33 fcntl34 fcntl36 fcntl38 fcntl39 fdatasync03 fgetxattr01 fgetxattr03 finit_module02 flistxattr01 flistxattr02 flistxattr03 flock01 flock02 flock03 flock04 flock06 fork01 fork07 fork08 fremovexattr01 fremovexattr02 fs_fill fsconfig01 fsconfig02 fsetxattr01 fsmount01 fsmount02 fsopen01 fsopen02 fspick01 fspick02 fstat02 fstat03 fstatfs02 fsync01 fsync02 fsync03 fsync04 ftruncate01 ftruncate03 ftruncate04 futex_wake04
getaddrinfo_01 getcwd03 getcwd04 getdents01 getdents02 getrusage03 getsockopt02 getxattr04 getxattr05
hugemmap01 hugemmap02 hugemmap04 hugemmap05 hugemmap06 hugeshmat01 hugeshmat02 hugeshmat03 hugeshmat04 hugeshmat05 hugeshmctl01 hugeshmctl02 hugeshmctl03
inotify01 inotify02 inotify03 inotify04 inotify05 inotify06 inotify07 inotify08 inotify09 inotify10 inotify11 inotify12 io_control01 io_pgetevents01 io_pgetevents02 io_submit01 io_submit02 io_submit03 io_uring01 io_uring02 ioctl01 ioctl04 ioctl05 ioctl06 ioctl08 ioctl09 ioctl_loop01 ioctl_loop02 ioctl_loop03 ioctl_loop04 ioctl_loop05 ioctl_loop06 ioctl_loop07 ioctl_ns05 ioctl_ns06 ioctl_ns07
lftest lgetxattr01 lgetxattr02 link02 link04 link05 listxattr01 listxattr02 listxattr03 llistxattr01 llistxattr02 llistxattr03 llseek01 llseek02 llseek03 lremovexattr01 lseek01 lseek02 lseek07 lseek11 lstat01 lstat02
madvise01 madvise02 madvise06 madvise08 mallocstress memcontrol02 memcontrol03 memcontrol04 migrate_pages02 mincore04 mkdir02 mkdir04 mkdir05 mkdir09 mmap1 mmap12 mmap16 mmap17 mmap19 mmap3 mmapstress01 mmapstress04 mount03 mount_setattr01 mountns01 mountns02 mountns03 mountns04 move_mount01 move_mount02 msg_comm msgctl01 msgctl02 msgctl03 msgctl04 msgctl05 msgget01 msgget02 msgget03 msgrcv01 msgrcv02 msgrcv03 msgrcv05 msgrcv06 msgrcv07 msgrcv08 msgsnd01 msgsnd02 msgsnd05 msgsnd06 msync04
open01 open02 open03 open04 open06 open08 open10 open_by_handle_at01 open_by_handle_at02 open_tree01 open_tree02 openat01 openat04 openat201 openat202 openat203
pause01 pidfd_getfd01 pidfd_getfd02 pidfd_open03 pidfd_open04 pidfd_send_signal01 pidfd_send_signal02 pidfd_send_signal03 pidns03 pidns12 pidns13 pidns20 pipe02 pipe13 pipe2_02 pivot_root01 pkey01 ppoll01 prctl03 prctl04 prctl06 pread01 pread02 preadv01 preadv02 preadv03 preadv201 preadv202 preadv203 process_vm_readv02 process_vm_readv03 process_vm_writev02 pselect02 pselect03 ptrace07 pty04 pwrite01 pwrite02 pwrite03 pwrite04 pwritev01 pwritev02 pwritev03 pwritev201 pwritev202
read01 read02 read03 read04 readahead01 readahead02 readdir01 readdir21 readlink01 readlink03 readv01 readv02 realpath01 recvmsg03 remap_file_pages02 rename01 rename03 rename04 rename05 rename06 rename07 rename08 rename09 rename10 rename12 rename13 rmdir01 rmdir03 rt_sigqueueinfo01 rt_tgsigqueueinfo01
sched_setaffinity01 select01 select03 select04 sem_comm semctl08 semop01 semop02 semop03 semtest_2ns sendfile02 sendfile03 sendfile04 sendfile05 sendfile06 sendfile07 sendfile08 sendfile09 set_mempolicy01 set_mempolicy02 set_mempolicy03 set_mempolicy04 setns01 setpgid03 setpriority01 setuid04 setxattr01 setxattr02 setxattr03 shm_comm shmctl06 shmdt01 shmem_2nstest shmget02 shmget03 shmget04 shmget05 shmget06 shmnstest sighold02 splice01 splice02 splice03 squashfs01 stat01 stat02 stat03 statfs02 statx02 statx03 statx04 statx05 statx06 statx07 statx08 statx09 swapoff01 swapoff02 swapon01 swapon02 swapon03 sync01 sync_file_range01 sync_file_range02 syncfs01
tee01 tee02 tgkill01 tgkill02 tgkill03 timer_gettime01 timerfd_gettime01 timerfd_settime01 tkill01 tkill02 truncate02 truncate03
uevent01 uevent02 uevent03 umask01 umount01 umount02 umount03 umount2_02 unlink05 unlink07 unlink08 unlinkat01 unshare01 unshare02 userns02 userns03 userns04 userns05 userns06 userns07 userns08 utime01 utime02 utime03 utime04 utime05 utime06 utimensat01
.options
Tests containing .options flag.
.tags
CVE
Tests containing .tags CVE flag.
can_bcm01 cgroup_core01 connect02 creat09 crypto_user01 cve-2014-0196 cve-2015-3290 cve-2016-10044 cve-2016-7042 cve-2016-7117 cve-2017-16939 cve-2017-17052 cve-2017-17053 cve-2017-2618 cve-2017-2671
linux-git
Tests containing .tags linux-git flag.
accept02 acct02 add_key02 add_key03 add_key04 add_key05 adjtimex03 af_alg01 af_alg02 af_alg03 af_alg04 af_alg05 af_alg06 af_alg07 autogroup01
can_bcm01 cfs_bandwidth01 cgroup_core01 clock_gettime04 close_range01 connect02 creat09 crypto_user01 crypto_user02 cve-2014-0196 cve-2015-3290 cve-2016-10044 cve-2016-7042 cve-2016-7117 cve-2017-16939 cve-2017-17052 cve-2017-17053 cve-2017-2618 cve-2017-2671
fallocate06 fanotify06 fanotify09 fanotify10 fanotify13 fanotify14 fanotify15 fanotify19 fanotify22 fanout01 fcntl35 finit_module02 fork13 futex_cmp_requeue02
icmp_rate_limit01 inotify09 inotify10 inotify11 inotify12 io_uring02 ioctl_loop01 ioctl_loop07 ioctl_sg01
pcrypt_aead01 perf_event_open03 pipe13 ptrace07 ptrace08 ptrace09 ptrace10 pty02 pty03 pty04 pty05 pty06 pty07
sbrk03 sched_rr_get_interval01 sctp_big_chunk sendfile08 sendfile09 sendmsg03 sendto02 sendto03 set_mempolicy05 setrlimit06 setsockopt03 setsockopt04 setsockopt05 setsockopt06 setsockopt07 setsockopt08 setsockopt09 shmat03 shmctl05 snd_seq01 snd_timer01 squashfs01 statx04 swapping01 sysinfo03
.test_variants
Tests containing .test_variants flag.
chmod01 clock_adjtime01 clock_adjtime02 clock_getres01 clock_gettime01 clock_gettime02 clock_gettime03 clock_nanosleep01 clock_nanosleep03 clock_nanosleep04 clock_settime01 clock_settime02 clock_settime03 copy_file_range01 copy_file_range02 copy_file_range03
fanotify10 futex_cmp_requeue01 futex_cmp_requeue02 futex_wait01 futex_wait02 futex_wait03 futex_wait04 futex_wait_bitset01 futex_waitv02 futex_waitv03 futex_wake01 futex_wake02 futex_wake03 futex_wake04
sched_getparam01 sched_getparam03 sched_getscheduler01 sched_getscheduler02 sched_rr_get_interval01 sched_rr_get_interval02 sched_rr_get_interval03 sched_setparam01 sched_setparam02 sched_setparam03 sched_setparam04 sched_setparam05 sched_setscheduler01 sched_setscheduler02 sched_setscheduler03 select01 select02 select03 select04 semctl03 semctl09 semop01 semop02 semop03 sendmmsg01 sendmmsg02 setdomainname01 setdomainname02 setdomainname03 shmctl02 sigpending02 stime01 stime02
All tests
Total 1079 tests.
abort01 accept01 accept02 accept4_01 access01 access02 access03 access04 acct01 acct02 add_key01 add_key02 add_key03 add_key04 add_key05 adjtimex01 adjtimex02 adjtimex03 af_alg01 af_alg02 af_alg03 af_alg04 af_alg05 af_alg06 af_alg07 aio02 aiocp aiodio_append aiodio_sparse alarm02 alarm03 alarm05 alarm06 alarm07 autogroup01
bind01 bind02 bind03 bind04 bind05 bind06 bpf_map01 bpf_prog01 bpf_prog02 bpf_prog03 bpf_prog04 bpf_prog05 bpf_prog06 bpf_prog07 brk01 brk02
cacheflush01 can_bcm01 can_filter can_rcv_own_msgs capget01 capget02 capset01 capset02 capset03 capset04 cfs_bandwidth01 cgroup_core01 chdir01 chdir04 chmod01 chmod03 chmod05 chmod06 chmod07 chown01 chown02 chown03 chown04 chown05 chroot01 chroot02 chroot03 chroot04 clock_adjtime01 clock_adjtime02 clock_getres01 clock_gettime01 clock_gettime02 clock_gettime03 clock_gettime04 clock_nanosleep01 clock_nanosleep02 clock_nanosleep03 clock_nanosleep04 clock_settime01 clock_settime02 clock_settime03 clone01 clone03 clone04 clone05 clone06 clone07 clone08 clone09 clone301 clone302 close01 close02 close_range01 close_range02 confstr01 connect02 copy_file_range01 copy_file_range02 copy_file_range03 cpuset01 creat01 creat03 creat04 creat05 creat06 creat07 creat08 creat09 crypto_user01 crypto_user02 cve-2014-0196 cve-2015-3290 cve-2016-10044 cve-2016-7042 cve-2016-7117 cve-2017-16939 cve-2017-17052 cve-2017-17053 cve-2017-2618 cve-2017-2671
delete_module01 delete_module02 delete_module03 dio_append dio_read dio_sparse dio_truncate dirtyc0w dirtypipe dup01 dup02 dup03 dup04 dup05 dup201 dup202 dup203 dup204 dup205 dup206 dup207 dup3_01 dup3_02
endian_switch01 epoll_create01 epoll_create02 epoll_create1_01 epoll_create1_02 epoll_ctl01 epoll_ctl02 epoll_ctl03 epoll_ctl04 epoll_ctl05 epoll_pwait01 epoll_pwait02 epoll_pwait03 epoll_pwait04 epoll_pwait05 epoll_wait01 epoll_wait02 epoll_wait03 epoll_wait04 event_generator execl01 execle01 execlp01 execv01 execve01 execve02 execve03 execve04 execve05 execve06 execveat01 execveat02 execveat03 execvp01 exit02
fallocate04 fallocate05 fallocate06 fanotify01 fanotify02 fanotify03 fanotify04 fanotify05 fanotify06 fanotify07 fanotify08 fanotify09 fanotify10 fanotify11 fanotify12 fanotify13 fanotify14 fanotify15 fanotify16 fanotify17 fanotify18 fanotify19 fanotify20 fanotify21 fanotify22 fanotify23 fanout01 fchdir01 fchdir02 fchdir03 fchmod01 fchmod02 fchmod03 fchmod04 fchmod05 fchmod06 fchmodat01 fchown01 fchown02 fchown03 fchown04 fchown05 fcntl02 fcntl03 fcntl04 fcntl05 fcntl12 fcntl13 fcntl15 fcntl33 fcntl34 fcntl35 fcntl36 fcntl37 fcntl38 fcntl39 fdatasync03 fgetxattr01 fgetxattr02 fgetxattr03 finit_module01 finit_module02 flistxattr01 flistxattr02 flistxattr03 flock01 flock02 flock03 flock04 flock06 fork01 fork07 fork08 fork13 fremovexattr01 fremovexattr02 fs_fill fsconfig01 fsconfig02 fsetxattr01 fsetxattr02 fsmount01 fsmount02 fsopen01 fsopen02 fspick01 fspick02 fstat02 fstat03 fstatfs02 fsync01 fsync02 fsync03 fsync04 ftruncate01 ftruncate03 ftruncate04 futex_cmp_requeue01 futex_cmp_requeue02 futex_wait01 futex_wait02 futex_wait03 futex_wait04 futex_wait05 futex_wait_bitset01 futex_waitv01 futex_waitv02 futex_waitv03 futex_wake01 futex_wake02 futex_wake03 futex_wake04
get_mempolicy01 get_mempolicy02 getaddrinfo_01 getcontext01 getcpu01 getcwd01 getcwd02 getcwd03 getcwd04 getdents01 getdents02 getdomainname01 getgid01 getgid03 gethostid01 getitimer01 getitimer02 getpagesize01 getpid01 getpid02 getppid01 getppid02 getpriority01 getpriority02 getrandom01 getrandom02 getrandom03 getrandom04 getrlimit01 getrlimit02 getrlimit03 getrusage01 getrusage02 getrusage03 getrusage03_child getsid01 getsid02 getsockopt02 gettimeofday02 getuid01 getuid03 getxattr04 getxattr05
hugemmap01 hugemmap02 hugemmap04 hugemmap05 hugemmap06 hugemmap07 hugemmap08 hugemmap09 hugeshmat01 hugeshmat02 hugeshmat03 hugeshmat04 hugeshmat05 hugeshmctl01 hugeshmctl02 hugeshmctl03 hugeshmdt01 hugeshmget01 hugeshmget02 hugeshmget03 hugeshmget05
icmp_rate_limit01 ima_boot_aggregate ima_mmap in6_01 in6_02 init_module01 init_module02 inotify01 inotify02 inotify03 inotify04 inotify05 inotify06 inotify07 inotify08 inotify09 inotify10 inotify11 inotify12 inotify_init1_01 inotify_init1_02 io_cancel01 io_cancel02 io_control01 io_destroy01 io_destroy02 io_getevents01 io_getevents02 io_pgetevents01 io_pgetevents02 io_setup01 io_setup02 io_submit01 io_submit02 io_submit03 io_uring01 io_uring02 ioctl01 ioctl03 ioctl04 ioctl05 ioctl06 ioctl07 ioctl08 ioctl09 ioctl_loop01 ioctl_loop02 ioctl_loop03 ioctl_loop04 ioctl_loop05 ioctl_loop06 ioctl_loop07 ioctl_ns01 ioctl_ns02 ioctl_ns03 ioctl_ns04 ioctl_ns05 ioctl_ns06 ioctl_ns07 ioctl_sg01 ioperm01 ioperm02 iopl01 iopl02 ioprio_get01 ioprio_set01 ioprio_set02 ioprio_set03 irqbalance01
kcmp01 kcmp02 kcmp03 keyctl01 keyctl02 keyctl03 keyctl04 keyctl05 keyctl06 keyctl07 keyctl08 keyctl09 kill03 kill05 kill06 kill11 kill13 kmsg01 ksm01 ksm02 ksm03 ksm04 ksm05 ksm06 kvm_pagefault01
leapsec01 lftest lgetxattr01 lgetxattr02 link02 link04 link05 link08 listxattr01 listxattr02 listxattr03 llistxattr01 llistxattr02 llistxattr03 llseek01 llseek02 llseek03 lremovexattr01 lseek01 lseek02 lseek07 lseek11 lstat01 lstat02
madvise01 madvise02 madvise03 madvise05 madvise06 madvise07 madvise08 madvise09 madvise10 mallinfo01 mallinfo02 mallinfo2_01 mallocstress mallopt01 matrix_mult max_map_count mbind01 mbind02 mbind03 mbind04 meltdown membarrier01 memcg_test_3 memcmp01 memcontrol01 memcontrol02 memcontrol03 memcontrol04 memcpy01 memfd_create01 memfd_create02 memfd_create03 memfd_create04 memset01 mesgq_nstest migrate_pages02 migrate_pages03 min_free_kbytes mincore03 mincore04 mkdir02 mkdir03 mkdir04 mkdir05 mkdir09 mkdirat02 mlock201 mlock202 mlock203 mmap1 mmap12 mmap16 mmap17 mmap18 mmap19 mmap3 mmapstress01 mmapstress04 mount03 mount_setattr01 mountns01 mountns02 mountns03 mountns04 move_mount01 move_mount02 move_pages12 mq_notify01 mq_open01 mq_timedreceive01 mq_timedsend01 mq_unlink01 msg_comm msgctl01 msgctl02 msgctl03 msgctl04 msgctl05 msgctl06 msgctl12 msgget01 msgget02 msgget03 msgget04 msgget05 msgrcv01 msgrcv02 msgrcv03 msgrcv05 msgrcv06 msgrcv07 msgrcv08 msgsnd01 msgsnd02 msgsnd05 msgsnd06 msync04 mtest01
name_to_handle_at01 name_to_handle_at02 nanosleep01 nanosleep02 nanosleep04 netns_netlink netstress nfs05_make_tree nice01 nice02 nice03 nice04 nice05
oom01 oom02 oom03 oom04 oom05 open01 open02 open03 open04 open06 open08 open10 open11 open_by_handle_at01 open_by_handle_at02 open_tree01 open_tree02 openat01 openat04 openat201 openat202 openat203 overcommit_memory
pause01 pcrypt_aead01 perf_event_open02 perf_event_open03 pidfd_getfd01 pidfd_getfd02 pidfd_open01 pidfd_open02 pidfd_open03 pidfd_open04 pidfd_send_signal01 pidfd_send_signal02 pidfd_send_signal03 pidns01 pidns02 pidns03 pidns12 pidns13 pidns20 pidns32 pipe01 pipe02 pipe03 pipe11 pipe12 pipe13 pipe2_01 pipe2_02 pipe2_04 pivot_root01 pkey01 poll01 poll02 posix_fadvise01 posix_fadvise02 posix_fadvise03 posix_fadvise04 ppoll01 prctl01 prctl02 prctl03 prctl04 prctl05 prctl06 prctl07 prctl08 prctl09 prctl10 pread01 pread02 preadv01 preadv02 preadv03 preadv201 preadv202 preadv203 process_vm01 process_vm_readv02 process_vm_readv03 process_vm_writev02 pselect01 pselect02 pselect03 pt_test ptrace01 ptrace02 ptrace03 ptrace07 ptrace08 ptrace09 ptrace10 ptrace11 pty02 pty03 pty04 pty05 pty06 pty07 pwrite01 pwrite02 pwrite03 pwrite04 pwritev01 pwritev02 pwritev03 pwritev201 pwritev202
read01 read02 read03 read04 read_all readahead01 readahead02 readdir01 readdir21 readlink01 readlink03 readv01 readv02 realpath01 reboot01 reboot02 recvmmsg01 recvmsg02 recvmsg03 remap_file_pages02 rename01 rename03 rename04 rename05 rename06 rename07 rename08 rename09 rename10 rename12 rename13 request_key01 request_key02 request_key03 request_key04 request_key05 rmdir01 rmdir02 rmdir03 route-change-netlink rt_sigqueueinfo01 rt_sigsuspend01 rt_sigtimedwait01 rt_tgsigqueueinfo01 rtc02
sbrk03 sched_get_priority_max01 sched_get_priority_max02 sched_get_priority_min01 sched_get_priority_min02 sched_getaffinity01 sched_getparam01 sched_getparam03 sched_getscheduler01 sched_getscheduler02 sched_rr_get_interval01 sched_rr_get_interval02 sched_rr_get_interval03 sched_setaffinity01 sched_setparam01 sched_setparam02 sched_setparam03 sched_setparam04 sched_setparam05 sched_setscheduler01 sched_setscheduler02 sched_setscheduler03 sctp_big_chunk select01 select02 select03 select04 sem_comm sem_nstest semctl01 semctl02 semctl03 semctl04 semctl05 semctl07 semctl08 semctl09 semop01 semop02 semop03 semtest_2ns send02 sendfile02 sendfile03 sendfile04 sendfile05 sendfile06 sendfile07 sendfile08 sendfile09 sendmmsg01 sendmmsg02 sendmsg03 sendto02 sendto03 set_mempolicy01 set_mempolicy02 set_mempolicy03 set_mempolicy04 set_mempolicy05 setdomainname01 setdomainname02 setdomainname03 setegid01 setegid02 setfsgid01 setfsgid02 setfsuid01 setfsuid02 setfsuid03 setgid01 setgid02 setgid03 setitimer01 setitimer02 setns01 setns02 setpgid02 setpgid03 setpriority01 setpriority02 setregid01 setregid02 setregid03 setregid04 setresgid02 setresgid03 setresuid01 setresuid02 setresuid03 setreuid02 setreuid03 setreuid05 setrlimit02 setrlimit03 setrlimit04 setrlimit05 setrlimit06 setsockopt01 setsockopt02 setsockopt03 setsockopt04 setsockopt05 setsockopt06 setsockopt07 setsockopt08 setsockopt09 settimeofday01 settimeofday02 setuid01 setuid03 setuid04 setxattr01 setxattr02 setxattr03 shm_comm shmat01 shmat02 shmat03 shmctl01 shmctl02 shmctl03 shmctl04 shmctl05 shmctl06 shmctl07 shmctl08 shmdt01 shmdt02 shmem_2nstest shmget02 shmget03 shmget04 shmget05 shmget06 shmnstest sighold02 signal01 signal02 signal03 signal04 signal05 sigpending02 sigsuspend01 sigtimedwait01 sigwait01 sigwaitinfo01 snd_seq01 snd_timer01 socket01 socket02 socketcall01 socketcall02 socketcall03 socketpair01 socketpair02 splice01 splice02 splice03 splice04 splice05 squashfs01 stack_clash stat01 stat02 stat03 statfs02 statx01 statx02 statx03 statx04 statx05 statx06 statx07 statx08 statx09 stime01 stime02 swapoff01 swapoff02 swapon01 swapon02 swapon03 swapping01 sync01 sync_file_range01 sync_file_range02 syncfs01 syscall01 sysctl01 sysctl03 sysctl04 sysfs01 sysfs02 sysfs03 sysfs04 sysfs05 sysinfo03 syslog11 syslog12
tee01 tee02 tgkill01 tgkill02 tgkill03 thp01 thp02 thp03 thp04 time01 timens01 timer_create01 timer_create02 timer_create03 timer_delete01 timer_delete02 timer_gettime01 timer_settime01 timer_settime02 timer_settime03 timerfd01 timerfd04 timerfd_gettime01 timerfd_settime01 timerfd_settime02 times01 times03 tkill01 tkill02 truncate02 truncate03 tst_device tst_get_free_pids
uevent01 uevent02 uevent03 umask01 umip_basic_test umount01 umount02 umount03 umount2_02 uname01 uname02 uname04 unlink05 unlink07 unlink08 unlinkat01 unshare01 unshare02 userfaultfd01 userns01 userns02 userns03 userns04 userns05 userns06 userns07 userns08 ustat01 ustat02 utime01 utime02 utime03 utime04 utime05 utime06 utimensat01 utimes01
wait01 wait02 wait401 wait403 waitid01 waitid02 waitid03 waitid04 waitid05 waitid06 waitid07 waitid08 waitid09 waitid10 waitid11 waitpid01 waitpid06 waitpid07 waitpid08 waitpid09 waitpid10 waitpid11 waitpid12 waitpid13 wqueue01 wqueue02 wqueue03 wqueue04 wqueue05 wqueue06 wqueue07 wqueue08 wqueue09 write01 write02 write03 write04 write05 write06 writev01 writev03 writev07
a
abort01
Description
Checks that process which called abort() gets killed by SIGIOT and dumps core.
Algorithm
-
Fork child.
-
Child calls abort.
-
Parent checks return status.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
accept01
Description
Verify that accept() returns the proper errno for various failure cases.
Test timeout defaults to 300 seconds
accept02
Description
Test for CVE-2017-8890
In Kernels up to 4.10.15 missing commit 657831ff the multicast group information of a socket gets copied over to a newly created socket when using the accept() syscall. This will cause a double free when closing the original and the cloned socket.
WARNING: There is a high chance that this test will cause an unstable system if it does not succeed!
For more information about this CVE see: https://www.suse.com/security/cve/CVE-2017-8890/
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
| Tag | Info |
|---|---|
acct01
Documentation
Verify that acct() returns proper errno on failure.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
acct02
Documentation
This tests if the kernel writes correct data to the process accounting file.
First, system-wide process accounting is turned on and the output gets directed to a defined file. After that a dummy program is run in order to generate data and the process accounting gets turned off again.
To verify the written data, the entries of the accounting file get parsed into the corresponding acct structure. Since it cannot be guaranteed that only the command issued by this test gets written into the accounting file, the contents get parsed until the correct entry is found, or EOF is reached.
This is also accidental regression test for: 4d9570158b626 kernel/acct.c: fix the acct→needcheck check in check_free_space()
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
CONFIG_BSD_PROCESS_ACCT |
|
1 |
|
1 |
| Tag | Info |
|---|---|
4d9570158b626 ("kernel/acct.c: fix the acct→needcheck check in check_free_space()") |
add_key02
Test timeout defaults to 300 seconds
| Tag | Info |
|---|---|
5649645d725c ("KEYS: fix dereferencing NULL payload with nonzero length") |
add_key03
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
| Tag | Info |
|---|---|
237bbd29f7a0 ("KEYS: prevent creating a different user’s keyrings") |
add_key04
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
| Tag | Info |
|---|---|
ea6789980fda ("assoc_array: Fix a buggy node-splitting case") |
add_key05
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
useradd, userdel, groupdel |
|
1 |
|
?/proc/sys/kernel/keys/gc_delay 1 ?/proc/sys/kernel/keys/maxkeys 200 ?/proc/sys/kernel/keys/maxbytes 20000 |
| Tag | Info |
|---|---|
a08bf91ce28 ("KEYS: allow reaching the keys quotas exactly") |
|
adjtimex02
Description
Tests for adjtimex() error conditions:
-
EPERM with SET_MODE as nobody
-
EFAULT with SET_MODE and invalid timex pointer
-
EINVAL with ADJ_TICK greater than max tick
-
EINVAL with ADJ_TICK smaller than min tick
On kernels older than 2.6.26:
-
EINVAL with AJD_OFFSET smaller than min offset
-
EINVAL with AJD_OFFSET greater than max offset
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
3 |
adjtimex03
Test timeout defaults to 300 seconds
| Tag | Info |
|---|---|
0a0b98734479 ("compat: fix 4-byte infoleak via uninitialized struct field") |
af_alg01
Test timeout defaults to 300 seconds
| Tag | Info |
|---|---|
af3ff8045bbf ("crypto: hmac - require that the underlying hash algorithm is unkeyed") |
af_alg02
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
20 |
|
1 |
|
1 |
| Tag | Info |
|---|---|
ecaaab564978 ("crypto: salsa20 - fix blkcipher_walk API usage") |
af_alg03
Test timeout defaults to 300 seconds
| Tag | Info |
|---|---|
e57121d08c38 ("crypto: chacha20poly1305 - validate the digest size") |
af_alg04
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
| Tag | Info |
|---|---|
bb2964810233 ("crypto: vmac - separate tfm and request context") |
af_alg05
Test timeout defaults to 300 seconds
af_alg06
Test timeout defaults to 300 seconds
| Tag | Info |
|---|---|
8f9c46934848 ("crypto: authenc - fix parsing key with misaligned rta_len") |
af_alg07
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
150 |
|
2 |
|
4.10.0 |
|
1 |
|
(1<<9)/awarninghasbeenissuedbykernel/ |
| Tag | Info |
|---|---|
ff7b11aa481f ("net: socket: set sock→sk to NULL after calling proto_ops::release()") |
|
9060cb719e61 ("net: crypto set sk to NULL when af_alg_release.") |
aiocp
Description
Copy file by using an async I/O state machine.
-
Start read request
-
When read completes turn it into a write request
-
When write completes decrement counter and free up resources
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1800 |
|
1 |
|
1 |
|
b: str_aio_blksize Size of writing blocks (default 1K) s: str_filesize Size of file (default 10M) n: str_aionum Number of Async IO blocks (default 16) f: str_oflag Open flag: SYNC | DIRECT (default O_CREAT only) |
aiodio_append
Description
Append zeroed data to a file using libaio while other processes are doing buffered reads and check if the buffer reads always see zero.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1800 |
|
1 |
|
n: str_numchildren Number of threads (default 16) s: str_writesize Size of the file to write (default 64K) c: str_appends Number of appends (default 1000) b: str_numaio Number of async IO blocks (default 16) |
|
tmpfs |
aiodio_sparse
Description
Create a sparse file and write zeroes to it using libaio while other processes are doing buffered reads and check if the buffer reads always see zero.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1800 |
|
1 |
|
n: str_numchildren Number of threads (default 16) w: str_writesize Size of writing blocks (default 1K) s: str_filesize Size of file (default 100M) o: str_numaio Number of AIO control blocks (default 16) |
|
tmpfs |
alarm02
Description
Verify that alarm() returns: - zero when there was no previously scheduled alarm - number of seconds remaining until any previously scheduled alarm
Test timeout defaults to 300 seconds
alarm03
Description
Verify that alarms created by alarm() are not inherited by children created via fork.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
alarm05
Description
The return value of the alarm system call should be equal to the amount previously remaining in the alarm clock. A SIGALRM signal should be received after the specified amount of time has elapsed.
Test timeout defaults to 300 seconds
alarm06
Description
Verify that any pending alarm() is canceled when seconds is zero.
Test timeout defaults to 300 seconds
b
bind06
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
300 |
|
CONFIG_USER_NS=y, CONFIG_NET_NS=y |
|
?/proc/sys/user/max_user_namespaces |
|
TST_TAINT_W |
| Tag | Info |
|---|---|
15fe076edea7 ("net/packet: fix a race in packet_bind() and packet_notifier()") |
bpf_prog02
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
TST_CAP, (, TST_CAP_DROP, CAP_SYS_ADMIN, ) |
|
3.18 |
| Tag | Info |
|---|---|
3612af783cf5 ("bpf: fix sanitation rewrite in case of non-pointers") |
bpf_prog03
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
TST_CAP, (, TST_CAP_DROP, CAP_SYS_ADMIN, ) |
|
3.18 |
| Tag | Info |
|---|---|
95a762e2c8c9 ("bpf: fix incorrect sign extension in check_alu_op()") |
bpf_prog04
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
TST_CAP, (, TST_CAP_DROP, CAP_SYS_ADMIN, ) |
|
3.18 |
|
TST_TAINT_W |
| Tag | Info |
|---|---|
b799207e1e18 ("bpf: 32-bit RSH verification must truncate input before the ALU op") |
bpf_prog05
Description
Compare the effects of 32-bit div/mod by zero with the "expected" behaviour.
The commit "bpf: fix subprog verifier bypass by div/mod by 0 exception", changed div/mod by zero from exiting the current program to setting the destination register to zero (div) or leaving it untouched (mod).
This solved one verfier bug which allowed dodgy pointer values, but it turned out that the source register was being 32-bit truncated when it should not be. Also the destination register for mod was not being truncated when it should be.
So then we have the following two fixes: "bpf: Fix 32 bit src register truncation on div/mod" "bpf: Fix truncation handling for mod32 dst reg wrt zero"
Testing for all of these issues is a problem. Not least because division by zero is undefined, so in theory any result is acceptable so long as the verifier and runtime behaviour match.
However to keep things simple we just check if the source and destination register runtime values match the current upstream behaviour at the time of writing.
If the test fails you may have one or more of the above patches missing. In this case it is possible that you are not vulnerable depending on what other backports and fixes have been applied. If upstream changes the behaviour of division by zero, then the test will need updating.
Note that we use r6 as the src register and r7 as the dst. w6 and w7 are the same registers treated as 32bit.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
TST_CAP, (, TST_CAP_DROP, CAP_SYS_ADMIN, ), TST_CAP, (, TST_CAP_DROP, CAP_BPF, ) |
|
3.18 |
|
TST_TAINT_W |
bpf_prog06
Description
ringbuf_submit takes a pointer to a ringbuf record, but not the size of this record. The verifier only validates offset ptrs[1] passed to functions if the function has a size parameter. So we can perform a wide range of ptr arithmetic on this record ptr.
ringbuf_submit updates some data (i.e. the length) in the ringbuf header which is calculated from the record ptr. So this can be used to corrupt memory.
This test does not try to cause a crash. Howver it does run the eBPF if it can. This will result in an instant crash or memory corruption which may later cause a crash.
This test is adapted from a full reproducer which can be found here: https://github.com/tr3ee/CVE-2021-4204
It’s recommended to disable unprivileged eBPF by setting /proc/sys/kernel/unprivileged_bpf_disabled. Also there is a specific fix for this issue:
commit 64620e0a1e712a778095bd35cbb277dc2259281f Author: Daniel Borkmann <daniel@iogearbox.net> Date: Tue Jan 11 14:43:41 2022 +0000
bpf: Fix out of bounds access for ringbuf helpers
[1]: Depending on the ptr/reg type
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
TST_CAP, (, TST_CAP_DROP, CAP_SYS_ADMIN, ), TST_CAP, (, TST_CAP_DROP, CAP_BPF, ) |
|
5.8 |
|
TST_TAINT_W |
| Tag | Info |
|---|---|
64620e0a1e71 ("bpf: Fix out of bounds access for ringbuf helpers") |
bpf_prog07
Description
The verifier did not properly restrict some *_OR_NULL pointer types. Including RET_PTR_TO_ALLOC_MEM_OR_NULL which is returned by ringbuf_reserve. Somehow this means they can be used to perform arbitrary pointer arithmetic.
The test tries to do some pointer arithmetic on the return value of ringbuf_reserve. Possibly with a trick to make the verifier believe the pointer (in r1) is NULL. The test will pass if the eBPF is rejected and will fail otherwise.
This test does not try to cause a crash. Howver it does run the eBPF if it can. This will result in an instant crash or memory corruption which may later cause a crash.
This test is adapted from a full reproducer which can be found here: https://github.com/tr3ee/CVE-2022-23222
It’s recommended to disable unprivileged eBPF by setting /proc/sys/kernel/unprivileged_bpf_disabled. Also there is a specific fix for this issue:
commit 64620e0a1e712a778095bd35cbb277dc2259281f Author: Daniel Borkmann <daniel@iogearbox.net> Date: Tue Jan 11 14:43:41 2022 +0000
bpf: Fix out of bounds access for ringbuf helpers
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
TST_CAP, (, TST_CAP_DROP, CAP_SYS_ADMIN, ), TST_CAP, (, TST_CAP_DROP, CAP_BPF, ) |
|
5.8 |
|
TST_TAINT_W |
| Tag | Info |
|---|---|
64620e0a1e71 ("bpf: Fix out of bounds access for ringbuf helpers") |
brk02
Description
Expand brk() by at least 2 pages to ensure there is a newly created VMA and not expanding the original due to multiple anon pages. mprotect() that new VMA then brk() back to the original address therefore causing a munmap of at least one full VMA.
Test timeout defaults to 300 seconds
c
can_bcm01
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
30 |
|
vcan, can-bcm |
|
1 |
|
1 |
|
TST_TAINT_W |
| Tag | Info |
|---|---|
d5f9023fa61e ("can: bcm: delay release of struct bcm_op after synchronize_rcu()") |
can_filter
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
TST_CAP, (, TST_CAP_REQ, CAP_NET_RAW, ), TST_CAP, (, TST_CAP_DROP, CAP_SYS_ADMIN, ) |
|
vcan, can-raw |
|
D: can_dev_name CAN device name |
can_rcv_own_msgs
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
TST_CAP, (, TST_CAP_REQ, CAP_NET_RAW, ), TST_CAP, (, TST_CAP_DROP, CAP_SYS_ADMIN, ) |
|
vcan, can-raw |
|
D: can_dev_name CAN device name |
cfs_bandwidth01
Description
Creates a multi-level CGroup hierarchy with the cpu controller enabled. The leaf groups are populated with "busy" processes which simulate intermittent cpu load. They spin for some time then sleep then repeat.
Both the trunk and leaf groups are set cpu bandwidth limits. The busy processes will intermittently exceed these limits. Causing them to be throttled. When they begin sleeping this will then cause them to be unthrottle.
The test is known to reproduce an issue with an update to SLE-15-SP1 (kernel 4.12.14-197.64, bsc#1179093).
Also as an reproducer for another bug:
commit fdaba61ef8a268d4136d0a113d153f7a89eb9984 Author: Rik van Riel <riel@surriel.com> Date: Mon Jun 21 19:43:30 2021 +0200
sched/fair: Ensure that the CFS parent is added after unthrottling
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
20 |
|
cpu |
|
1 |
|
CONFIG_CFS_BANDWIDTH |
|
1 |
|
TST_TAINT_W |
cgroup_core01
Description
When a task is writing to an fd opened by a different task, the perm check should use the credentials of the latter task.
It is copy from kernel selftests cgroup test_core test_cgcore_lesser_euid_open subcase. The difference is that kernel selftest only supports cgroup v2 but here we also support cgroup v1 and v2.
It is a regression test for
commit e57457641613fef0d147ede8bd6a3047df588b95 Author: Tejun Heo <tj@kernel.org> Date: Thu Jan 6 11:02:29 2022 -1000
cgroup: Use open-time cgroup namespace for process migration perm checks
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
memory |
|
1 |
| Tag | Info |
|---|---|
e57457641613 ("cgroup: Use open-time cgroup namespace for process migration perm checks") |
chdir04
Description
Testcase to test whether chdir(2) sets errno correctly.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
chmod01
Description
Verify that chmod(2) succeeds when used to change the mode permissions of a file or directory.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
2 |
chmod03
Description
Verify that, chmod(2) will succeed to change the mode of a file or directory and set the sticky bit on it if invoked by non-root (uid != 0) process with the following constraints:
-
the process is the owner of the file or directory.
-
the effective group ID or one of the supplementary group ID’s of the process is equal to the group ID of the file or directory.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
chown01
Description
Basic test for chown(). Calls chown() on a file and expects it to pass.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
chown02
Description
Verify that chown(2) invoked by super-user: - clears setuid and setgid bits set on an executable file - preserves setgid bit set on a non-group-executable file
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
chown03
Description
Verify that, chown(2) succeeds to change the group of a file specified by path when called by non-root user with the following constraints:
-
euid of the process is equal to the owner of the file.
-
the intended gid is either egid, or one of the supplementary gids of the process.
Also verify that chown() clears the setuid/setgid bits set on the file.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
chown04
Description
Verify that:
-
Chown() returns -1 and sets errno to EPERM if the effective user id of process does not match the owner of the file and the process is not super user.
-
Chown() returns -1 and sets errno to EACCES if search permission is denied on a component of the path prefix.
-
Chown() returns -1 and sets errno to EFAULT if pathname points outside user’s accessible address space.
-
Chown() returns -1 and sets errno to ENAMETOOLONG if the pathname component is too long.
-
Chown() returns -1 and sets errno to ENOENT if the specified file does not exists.
-
Chown() returns -1 and sets errno to ENOTDIR if the directory component in pathname is not a directory.
-
Chown() returns -1 and sets errno to ELOOP if too many symbolic links were encountered in resolving pathname.
-
Chown() returns -1 and sets errno to EROFS if the named file resides on a read-only filesystem.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
chown05
Description
Verify that, chown(2) succeeds to change the owner and group of a file specified by path to any numeric owner(uid)/group(gid) values when invoked by super-user.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
chroot01
Description
Testcase to check the whether chroot sets errno to EPERM.
As a non-root user attempt to perform chroot() to a directory. The chroot() call should fail with EPERM
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
chroot02
Description
Basic chroot() functionality test.
-
Create a file in the temporary directory
-
Change the root to this temporary directory
-
Check whether this file can be accessed in the new root directory
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
chroot03
Description
Testcase to test whether chroot(2) sets errno correctly.
-
to test whether chroot() is setting ENAMETOOLONG if the pathname is more than VFS_MAXNAMELEN.
-
to test whether chroot() is setting ENOTDIR if the argument is not a directory.
-
to test whether chroot() is setting ENOENT if the directory does not exist.
-
attempt to chroot to a path pointing to an invalid address and expect EFAULT as errno.
-
to test whether chroot() is setting ELOOP if the two symbolic directory who point to each other.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
chroot04
Description
Testcase to check that chroot sets errno to EACCES.
As a non-root user attempt to perform chroot() to a directory that the user does not have a search permission for. The chroot() call should fail with EACESS.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
clock_gettime04
Description
Check time difference between successive readings and report a bug if difference found to be over 5 ms.
This test reports a s390x BUG which has been fixed in:
commit 5b43bd184530af6b868d8273b0a743a138d37ee8 Author: Heiko Carstens <hca@linux.ibm.com> Date: Wed Mar 24 20:23:55 2021 +0100
s390/vdso: fix initializing and updating of vdso_data
Test timeout defaults to 300 seconds
| Tag | Info |
|---|---|
5b43bd184530 ("s390/vdso: fix initializing and updating of vdso_data") |
clock_nanosleep03
Description
Test that clock_nanosleep() adds correctly an offset with absolute timeout and CLOCK_MONOTONIC inside of a timer namespace.
After a call to unshare(CLONE_NEWTIME) a new timer namespace is created, the process that has called the unshare() can adjust offsets for CLOCK_MONOTONIC and CLOCK_BOOTTIME for its children by writing to the '/proc/self/timens_offsets'.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
CONFIG_TIME_NS=y |
|
1 |
|
4 |
clone01
Description
Basic clone() test.
Use clone() to create a child process, and wait for the child process to exit, verify that the child process pid is correct.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
clone03
Description
Check for equality of getpid() from a child and return value of clone(2)
Test timeout defaults to 300 seconds
clone04
Description
Verify that clone(2) fails with
-
EINVAL if child stack is set to NULL
Test timeout defaults to 300 seconds
clone05
Description
Call clone() with CLONE_VFORK flag set. verify that execution of parent is suspended until child finishes
Test timeout defaults to 300 seconds
clone06
Description
Test to verify inheritance of environment variables by child.
Test timeout defaults to 300 seconds
clone07
Description
Test for a libc bug where exiting child function by returning from it caused SIGSEGV.
Test timeout defaults to 300 seconds
clone302
Description
Basic clone3() test to check various failures.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
close01
Description
Test that closing a file/pipe/socket works correctly.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
close02
Description
Call close(-1) and expects it to return EBADF.
Test timeout defaults to 300 seconds
close_range01
Description
We check that close_range()
-
closes FDs
-
UNSHARES some FDs before closing them
-
it sets CLOEXEC (in both cloned process and parent)
-
combination of CLOEXEC and UNSHARE.
The final test is the actual bug reproducer. Note that we call clone directly to share the file table.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
TST_CAP, (, TST_CAP_DROP, CAP_SYS_ADMIN, ) |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
TST_TAINT_W |
| Tag | Info |
|---|---|
fec8a6a69103 ("close_range: unshare all fds for CLOSE_RANGE_UNSHARE | CLOSE_RANGE_CLOEXEC") |
close_range02
Description
-
First check close_range works on a valid range.
-
Then check close_range does not accept invalid paramters.
-
Then check it accepts a large lower fd.
-
Finally check CLOEXEC works
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
confstr01
Description
Test confstr(3) 700 (X/Open 7) functionality — POSIX 2008.
Test timeout defaults to 300 seconds
connect02
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
TST_TAINT_W |
| Tag | Info |
|---|---|
9d538fa60bad ("net: Set sk_prot_creator when cloning sockets to the right proto") |
|
creat08
Description
Verify that the group ID and setgid bit are set correctly when a new file is created.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
creat09
Description
CVE-2018-13405
Check for possible privilege escalation through creating files with setgid bit set inside a setgid directory owned by a group which the user does not belong to.
Fixed in:
commit 0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7 Author: Linus Torvalds <torvalds@linux-foundation.org> Date: Tue Jul 3 17:10:19 2018 -0700
Fix up non-directory creation in SGID directories
This fix is incomplete if file is on xfs filesystem.
Fixed in:
commit 01ea173e103edd5ec41acec65b9261b87e123fc2 Author: Christoph Hellwig <hch@lst.de> Date: Fri Jan 22 16:48:18 2021 -0800
xfs: fix up non-directory creation in SGID directories
When use acl or umask, it still has bug.
Fixed in:
commit 1639a49ccdce58ea248841ed9b23babcce6dbb0b Author: Yang Xu <xuyang2018.jy@fujitsu.com> Date: Thu July 14 14:11:27 2022 +0800
fs: move S_ISGID stripping into the vfs_*() helpers
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
exfat, ntfs, vfat |
crypto_user01
Test timeout defaults to 300 seconds
| Tag | Info |
|---|---|
f43f39958beb ("crypto: user - fix leaking uninitialized memory to userspace") |
crypto_user02
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
| Tag | Info |
|---|---|
21d4120ec6f5 ("crypto: user - prevent operating on larval algorithms") |
cve-2014-0196
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
60 |
| Tag | Info |
|---|---|
4291086b1f08 ("n_tty: Fix n_tty_write crash when echoing in raw mode") |
cve-2015-3290
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
180 |
|
1 |
|
1 |
|
1 |
| Tag | Info |
|---|---|
9b6e6a8334d5 ("x86/nmi/64: Switch stacks on userspace NMI entry") |
cve-2016-7042
Test timeout defaults to 300 seconds
| Tag | Info |
|---|---|
03dab869b7b2 ("KEYS: Fix short sprintf buffer in /proc/keys show function") |
cve-2017-17052
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
| Tag | Info |
|---|---|
2b7e8665b4ff ("fork: fix incorrect fput of →exe_file causing use-after-free") |
d
dio_append
Description
Appends zeroed data to a file using O_DIRECT while a child processes are doing buffered reads after seeking to the end of the file and checks if the buffer reads always see zero.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1800 |
|
1 |
|
n: str_numchildren Number of processes (default 16) w: str_writesize Write size for each append (default 64K) c: str_appends Number of appends (default 1000) |
|
tmpfs |
dio_read
Description
Create a file using buffered writes while other processes are doing O_DIRECT reads and check if the buffer reads always see zero.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1800 |
|
1 |
|
n: str_numchildren Number of threads (default 8) w: str_writesize Size of writing blocks (default 32M) r: str_readsize Size of reading blocks (default 32M) s: str_filesize File size (default 128M) |
|
tmpfs |
dio_sparse
Description
Create a sparse file using O_DIRECT while other processes are doing buffered reads and check if the buffer reads always see zero.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1800 |
|
1 |
|
n: str_numchildren Number of threads (default 16) w: str_writesize Size of writing blocks (default 1K) s: str_filesize Size of file (default 100M) o: str_offset File offset (default 0) |
|
tmpfs |
dio_truncate
Description
This test is mixing direct I/O and truncate operations checking if they can be used together at the same time. Multiple children are spawned to read a file that is written to using direct I/O and truncated in a loop.
Algorithm
-
Spawn multiple children which start to read on 'file'
-
Parent start to fill and truncate 'file' many times with zero char when children are reading
-
Parent start to fill and truncate a junk file many times with non-zero char
If no issues occur on direct IO/truncate operations and the file always contains zero characters, test PASS. Otherwise, test will FAIL.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1800 |
|
1 |
|
n: str_numchildren Number of threads (default 16) s: str_filesize Size of file (default 64K) a: str_numappends Number of appends (default 100) c: str_numwrites Number of append & truncate (default 100) |
|
tmpfs |
dirtyc0w
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
| Tag | Info |
|---|---|
19be0eaffa3a ("mm: remove gup_flags FOLL_WRITE games from __get_user_pages()") |
dirtypipe
Description
Proof-of-concept exploit for the Dirty Pipe vulnerability (CVE-2022-0847) caused by an uninitialized "pipe_buffer.flags" variable. It demonstrates how to overwrite any file contents in the page cache, even if the file is not permitted to be written, immutable or on a read-only mount.
This exploit requires Linux 5.8 or later; the code path was made reachable by commit f6dd975583bd ("pipe: merge anon_pipe_buf*_ops"). The commit did not introduce the bug, it was there before, it just provided an easy way to exploit it.
There are two major limitations of this exploit: the offset cannot be on a page boundary (it needs to write one byte before the offset to add a reference to this page to the pipe), and the write cannot cross a page boundary.
Example: ./write_anything /root/.ssh/authorized_keys 1 $'\nssh-ed25519 AAA……\n'
Further explanation: https://dirtypipe.cm4all.com/
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
| Tag | Info |
|---|---|
9d2231c5d74e ("lib/iov_iter: initialize "flags" in new pipe_buffer") |
dup02
Description
Negative test for dup(2) with bad fds.
Algorithm
Call dup(2) with invalid argument and make sure it returns -1 with errno set to EBADF.
Test timeout defaults to 300 seconds
dup03
Description
Negative test for dup(2) (too many fds).
Algorithm
Open the maximum allowed number of file descriptors and then try to call dup() once more and verify it fails with EMFILE.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
dup04
Description
Basic test for dup(2) of a system pipe descriptor.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
dup05
Description
Basic test for dup(2) of a named pipe descriptor
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
dup201
Description
Negative tests for dup2() with bad fd (EBADF).
-
First fd argument is less than 0
-
First fd argument is getdtablesize()
-
Second fd argument is less than 0
-
Second fd argument is getdtablesize()
Test timeout defaults to 300 seconds
dup202
Description
Test whether the access mode are the same for both file descriptors.
Create file with mode, dup2, [change mode], check mode
-
read only, dup2, read only ? "0444"
-
write only, dup2, write only ? "0222"
-
read/write, dup2 read/write ? "0666"
-
read/write/execute, dup2, set read only, read only ? "0444"
-
read/write/execute, dup2, set write only, write only ? "0222"
-
read/write/execute, dup2, set read/write, read/write ? "0666"
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
dup203
Description
Testcase to check the basic functionality of dup2().
-
Attempt to dup2() on an open file descriptor.
-
Attempt to dup2() on a close file descriptor.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
dup204
Description
Test whether the inode number are the same for both file descriptors.
Test timeout defaults to 300 seconds
dup205
Description
Negative test for dup2() with max open file descriptors.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
dup206
Description
If oldfd is a valid file descriptor, and newfd has the same value as oldfd, then dup2() does nothing, and returns newfd.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
dup207
Description
Test whether the file offset are the same for both file descriptors.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
e
epoll_create01
Description
Verify that epoll_create return a nonnegative file descriptor on success.
The size argument informed the kernel of the number of file descriptors that the caller expected to add to the epoll instance, but it is no longer required.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
2 |
epoll_create02
Description
Verify that epoll_create returns -1 and set errno to EINVAL if size is not greater than zero.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
2 |
epoll_create1_01
Description
Verify that epoll_create1 sets the close-on-exec flag for the returned file descriptor with EPOLL_CLOEXEC.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
2.6.27 |
epoll_create1_02
Description
Verify that epoll_create1 returns -1 and set errno to EINVAL with an invalid value specified in flags.
Test timeout defaults to 300 seconds
epoll_ctl01
Description
Check the basic functionality of the epoll_ctl:
-
When epoll_ctl succeeds to register fd on the epoll instance and associates event with fd, epoll_wait will get registered fd and event correctly.
-
When epoll_ctl succeeds to change event which is related to fd, epoll_wait will get changed event correctly.
-
When epoll_ctl succeeds to deregister fd from the epoll instance epoll_wait won’t get deregistered fd and event.
Test timeout defaults to 300 seconds
epoll_ctl02
Description
Verify that epoll_ctl() fails with:
-
EBADF if epfd is an invalid fd.
-
EPERM if fd does not support epoll.
-
EBADF if fd is an invalid fd.
-
EINVAL if op is not supported.
-
EINVAL if fd is the same as epfd.
-
EINVAL if events is NULL.
-
ENOENT if fd is not registered with EPOLL_CTL_DEL.
-
ENOENT if fd is not registered with EPOLL_CTL_MOD.
-
EEXIST if fd is already registered with EPOLL_CTL_ADD.
Test timeout defaults to 300 seconds
epoll_ctl03
Description
Check that epoll_ctl returns zero with different combinations of events on success.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
2.6.17 |
epoll_ctl04
Description
Verify that the maximum number of nesting allowed inside epoll sets is 5, otherwise epoll_ctl fails with EINVAL.
Test timeout defaults to 300 seconds
epoll_ctl05
Description
Verify that epoll_ctl() fails with ELOOP if fd refers to an epoll instance and this EPOLL_CTL_ADD operation would result in a circular loop of epoll instances monitoring one another.
Test timeout defaults to 300 seconds
epoll_pwait01
Description
Basic test for epoll_pwait() and epoll_pwait2().
-
With a sigmask a signal is ignored and the syscall safely waits until either a file descriptor becomes ready or the timeout expires.
-
Without sigmask if signal arrives a syscall is iterrupted by a signal. The call should return -1 and set errno to EINTR.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
2 |
epoll_pwait02
Description
Basic test for epoll_pwait and epoll_pwait2. Checks if data avaiable in a file descriptor are reported correctly in the syscall return value.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
2 |
epoll_pwait03
Description
Check that epoll_pwait and epoll_pwait2 timeouts correctly.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
sample_fn |
|
do_epoll_pwait() |
|
2 |
epoll_pwait04
Description
Verify that, epoll_pwait() and epoll_pwait2() return -1 and set errno to EFAULT with a sigmask points outside user’s accessible address space.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
2 |
epoll_pwait05
Description
Verify that, epoll_pwait2() return -1 and set errno to EINVAL with an invalid timespec.
Test timeout defaults to 300 seconds
epoll_wait01
Description
Basic test for epoll_wait. Check that epoll_wait works for EPOLLOUT and EPOLLIN events on an epoll instance and that struct epoll_event is set correctly.
Test timeout defaults to 300 seconds
epoll_wait02
Description
Check that epoll_wait(2) timeouts correctly.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
sample_fn |
|
epoll_wait() |
epoll_wait03
Description
Basic test for epoll_wait:
-
epoll_wait fails with EBADF if epfd is not a valid file descriptor.
-
epoll_wait fails with EINVAL if epfd is not an epoll file descriptor.
-
epoll_wait fails with EINVAL if maxevents is less than zero.
-
epoll_wait fails with EINVAL if maxevents is equal to zero.
-
epoll_wait fails with EFAULT if the memory area pointed to by events is not accessible with write permissions.
Test timeout defaults to 300 seconds
epoll_wait04
Description
Check that a timeout equal to zero causes epoll_wait() to return immediately.
Test timeout defaults to 300 seconds
execve05
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
n: opt_nchild Numbers of children |
|
TEST_APP |
execve06
Description
Test that kernel adds dummy argv[0] if empty argument list was passed to execve(). This fixes at least one CVE where userspace programs start to process argument list blindly from argv[1] such as polkit pkexec CVE-2021-4034.
See also https://lwn.net/Articles/883547/
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
| Tag | Info |
|---|---|
dcd46d897adb ("exec: Force single empty string when argv is empty") |
execveat03
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
TEST_APP |
| Tag | Info |
|---|---|
355139a8dba4 ("cap_inode_getsecurity: use d_find_any_alias() instead of d_find_alias()") |
f
fallocate04
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
v verbose Turns on verbose mode |
fallocate06
Description
Tests misaligned fallocate()
Test scenario:
-
write() several blocks worth of data
-
fallocate() some more space (not aligned to FS blocks)
-
try to write() into the allocated space
-
deallocate misaligned part of file range written in step 1
-
read() the deallocated range and check that it was zeroed
Subtests:
-
fill filesystem between step 2 and 3
-
disable copy-on-write on test file
-
combinations of above subtests
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
| Tag | Info |
|---|---|
e093c4be760e ("xfs: Fix tail rounding in xfs_alloc_file_space()") |
|
6d4572a9d71d ("btrfs: allow btrfs_truncate_block() to fallback to nocow for data space reservation") |
fanotify01
Description
Check that fanotify work for a file.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
fanotify02
Description
Check that fanotify work for children of a directory.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
fanotify03
Description
Check that fanotify permission events work.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
resource_files |
fanotify04
Description
Check various fanotify special flags.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
fanotify05
Description
Check that fanotify overflow event is properly generated.
Algorithm
Generate enough events without reading them and check that overflow event is generated.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
fanotify06
Description
Check that fanotify properly merges ignore mask of an inode and mountpoint.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
| Tag | Info |
|---|---|
8edc6e1688fc ("fanotify: fix notification of groups with inode & mount marks") |
|
d989903058a8 ("ovl: do not generate duplicate fsnotify events for "fake" path") |
fanotify07
Description
Check that fanotify permission events are handled properly on instance destruction.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
fanotify08
Description
Sanity check fanotify_init flag FAN_CLOEXEC by fcntl.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
fanotify09
Description
Check that fanotify handles events on children correctly when both parent and subdir or mountpoint marks exist.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
fanotify10
Description
Check that fanotify properly merges ignore mask of a mount mark with a mask of an inode mark on the same group. Unlike the prototype test fanotify06, do not use FAN_MODIFY event for the test mask, because it hides the bug.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
TEST_APP |
|
2 |
| Tag | Info |
|---|---|
9bdda4e9cf2d ("fsnotify: fix ignore mask logic in fsnotify()") |
|
2f02fd3fa13e ("fanotify: fix ignore mask logic for events on child and on dir") |
fanotify11
Description
After fanotify_init adds flags FAN_REPORT_TID, check whether the program can accurately identify which thread id in the multithreaded program triggered the event.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
fanotify12
Description
Validate that the newly introduced FAN_OPEN_EXEC mask functions as expected. The idea is to generate a sequence of open related actions to ensure that the correct event flags are being set depending on what event mask was requested when the object was marked.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
TEST_APP |
fanotify13
Description
Validate that the values returned within an event when FAN_REPORT_FID is specified matches those that are obtained via explicit invocation to system calls statfs(2) and name_to_handle_at(2).
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
| Tag | Info |
|---|---|
c285a2f01d69 ("fanotify: update connector fsid cache on add mark") |
fanotify14
Description
This test file has been designed to ensure that the fanotify system calls fanotify_init(2) and fanotify_mark(2) return the correct error code to the calling process when an invalid flag or mask value has been specified in conjunction with FAN_REPORT_FID.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
| Tag | Info |
|---|---|
ceaf69f8eadc ("fanotify: do not allow setting dirent events in mask of non-dir") |
|
8698e3bab4dd ("fanotify: refine the validation checks on non-dir inode mask") |
fanotify15
Description
Test file that has been purposely designed to verify FAN_REPORT_FID functionality while using newly defined dirent events.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
| Tag | Info |
|---|---|
f367a62a7cad ("fanotify: merge duplicate events on parent and child") |
fanotify16
Description
Check fanotify directory entry modification events, events on child and on self with group init flags:
-
FAN_REPORT_DFID_NAME (dir fid + name)
-
FAN_REPORT_DIR_FID (dir fid)
-
FAN_REPORT_DIR_FID | FAN_REPORT_FID (dir fid + child fid)
-
FAN_REPORT_DFID_NAME | FAN_REPORT_FID (dir fid + name + child fid)
-
FAN_REPORT_DFID_NAME_TARGET (dir fid + name + created/deleted file fid)
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
fanotify17
Description
Check that fanotify groups and marks limits are enforced correctly. If user ns is supported, verify that global limit and per user ns limits are both enforced. Otherwise, we only check that global groups limit is enforced.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
fanotify18
Description
This set of tests is to ensure that the unprivileged listener feature of fanotify is functioning as expected. The objective this test case file is to validate whether any forbidden flags that are passed by an unprivileged user return the correct error result.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
fanotify19
Description
This set of tests is to ensure that the unprivileged listener feature of fanotify is functioning as expected. The objective of this test file is to generate a sequence of events and ensure that the returned events contain the limited values that an unprivileged listener is expected to receive.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
| Tag | Info |
|---|---|
a8b98c808eab ("fanotify: fix permission model of unprivileged group") |
fanotify20
Description
This source file contains a test case which ensures that the fanotify API returns an expected error code when provided an invalid initialization flag alongside FAN_REPORT_PIDFD. Additionally, it checks that the operability with existing FAN_REPORT_* flags is maintained and functioning as intended.
|
Note
|
FAN_REPORT_PIDFD support was added in v5.15-rc1 in af579beb666a ("fanotify: add pidfd support to the fanotify API"). |
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
fanotify21
Description
A test which verifies whether the returned struct fanotify_event_info_pidfd in FAN_REPORT_PIDFD mode contains the expected set of information.
|
Note
|
FAN_REPORT_PIDFD support was added in v5.15-rc1 in af579beb666a ("fanotify: add pidfd support to the fanotify API"). |
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
fanotify22
Description
Check fanotify FAN_ERROR_FS events triggered by intentionally corrupted filesystems:
-
Generate a broken filesystem
-
Start FAN_FS_ERROR monitoring group
-
Make the file system notice the error through ordinary operations
-
Observe the event generated
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
ext4 |
|
1 |
|
1 |
|
debugfs |
|
1 |
|
1 |
|
1 |
| Tag | Info |
|---|---|
124e7c61deb2 ("ext4: fix error code saved on super block during file system abort") |
fanotify23
Description
Check evictable fanotify inode marks.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
ext2 |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
fanout01
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
180 |
|
3.19 |
|
1 |
| Tag | Info |
|---|---|
4971613c1639 ("packet: in packet_do_bind, test fanout with bind_lock held") |
|
008ba2a13f2d ("packet: hold bind lock when rebinding to fanout hook") |
fchmod03
Description
Verify that, fchmod(2) will succeed to change the mode of a file and set the sticky bit on it if invoked by non-root (uid != 0) process with the following constraints, - the process is the owner of the file. - the effective group ID or one of the supplementary group ID’s of the process is equal to the group ID of the file.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
fchmod04
Description
Verify that, fchmod(2) will succeed to change the mode of a directory and set the sticky bit on it if invoked by non-root (uid != 0) process with the following constraints, - the process is the owner of the directory. - the effective group ID or one of the supplementary group ID’s of the process is equal to the group ID of the directory.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
fchmodat01
Description
This test case will verify basic function of fchmodat.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
2.6.16 |
|
1 |
fchown01
Description
Basic test for fchown(). Call fchown() on a fd and expect it to pass.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
fchown02
Description
Verify that fchown(2) invoked by super-user: - clears setuid and setgid bits set on an executable file - preserves setgid bit set on a non-group-executable file
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
fchown03
Description
Verify that, fchown(2) succeeds to change the group of a file specified by path when called by non-root user with the following constraints:
-
euid of the process is equal to the owner of the file
-
the intended gid is either egid, or one of the supplementary gids of the process.
Also verify that fchown() clears the setuid/setgid bits set on the file.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
fchown04
Description
Verify that:
-
fchown() returns -1 and sets errno to EPERM if the effective user id of process does not match the owner of the file and the process is not super user.
-
fchown() returns -1 and sets errno to EBADF if the file descriptor of the specified file is not valid.
-
fchown() returns -1 and sets errno to EROFS if the named file resides on a read-only file system.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
fchown05
Description
Verify that, fchown() succeeds to change the owner and group of a file specified by file descriptor to any numeric owner(uid)/group(gid) values when invoked by super-user.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
fcntl05
Description
Basic test for fcntl(2) using F_GETLK argument.
If the lock could be placed, fcntl() does not actually place it, but returns F_UNLCK in the l_type field of lock and leaves the other field of the structure unchanged.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
fcntl12
Description
Tests basic error handling of the fcntl syscall.
-
EMFILE when cmd is F_DUPFD and the per-process limit on the number of open file descriptors has been reached.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
fcntl13
Description
Tests basic error handling of the fcntl syscall.
-
EFAULT when lock is outside your accessible address space
-
EINVAL when cmd argument is not recognized by this kernel
-
EINVAL when cmd argument is F_SETLK and flock.l_whence is not equal to SEET_CUR,SEEK_SET,SEEK_END
-
EBADF when fd refers to an invalid file descriptor
Test timeout defaults to 300 seconds
fcntl15
Description
Check that file locks are removed when a file descriptor is closed, three different tests are implemented.
Parent opens a file and duplicates the file descriptor, places locks using both file descriptors then closes one descriptor, all locks should be removed.
Open same file twice using open, place locks using both descriptors then close one descriptor, all lock should be removed.
Open file twice, each in a different process, set the locks and the child check the locks. Close the first file descriptor and have child check locks again. Only locks set on first file descriptor should have been removed.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
fcntl35
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
2.6.35 |
|
1 |
| Tag | Info |
|---|---|
086e774a57fb ("pipe: cap initial pipe capacity according to pipe-max-size limit") |
fcntl37
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
TST_CAP, (, TST_CAP_DROP, CAP_SYS_RESOURCE, ) |
fcntl39
Description
Check that dnotify DN_RENAME event is reported only on rename inside same parent.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
CONFIG_DNOTIFY=y |
|
1 |
finit_module01
Description
Basic finit_module() tests.
Algorithm
Inserts a simple module after opening and mmaping the module file.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
finit_module02
Description
Basic finit_module() failure tests.
Algorithm
Tests various failure scenarios for finit_module().
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
| Tag | Info |
|---|---|
032146cda855 ("vfs: check fd has read access in kernel_read_file_from_fd()") |
|
39d637af5aa7 ("vfs: forbid write access when reading a file into memory") |
fork01
Description
-
fork returns without error
-
fork returns the pid of the child
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
fork07
Description
Check that all children inherit parent’s file descriptor.
Parent opens a file and forks children. Each child reads a byte and checks that the value is correct. Parent checks that correct number of bytes was consumed from the file.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
fork08
Description
Check that the parent’s file descriptors will not be affected by being closed in the child.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
fork13
Description
A race in pid generation that causes pids to be reused immediately
From the mainline commit 5fdee8c4a5e1800489ce61963208f8cc55e42ea1:
A program that repeatedly forks and waits is susceptible to having the same pid repeated, especially when it competes with another instance of the same program. This is really bad for bash implementation. Furthermore, many shell scripts assume that pid numbers will not be used for some length of time.
Race description
A B
// pid == offset == n // pid == offset == n + 1
test_and_set_bit(offset, map->page)
test_and_set_bit(offset, map->page);
pid_ns->last_pid = pid;
pid_ns->last_pid = pid;
// pid == n + 1 is freed (wait())
// Next fork()...
last = pid_ns->last_pid; // == n
pid = last + 1;
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
600 |
|
1 |
|
!/proc/sys/kernel/pid_max PID_MAX_STR |
| Tag | Info |
|---|---|
5fdee8c4a5e1 ("pids: fix a race in pid generation that causes pids to be reused immediately") |
fstat02
Description
Tests if fstat() returns correctly and reports correct file information using the stat structure.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
fstatfs02
Description
Testcase to check if fstatfs() sets errno correctly.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
ftruncate03
Description
Verify that ftruncate(2) system call returns appropriate error number:
-
EINVAL — the file is a socket
-
EINVAL — the file descriptor was opened with O_RDONLY
-
EINVAL — the length is negative
-
EBADF — the file descriptor is invalid
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
ftruncate04
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
CONFIG_MANDATORY_FILE_LOCKING=y |
|
1 |
|
1 |
futex_cmp_requeue02
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
3 |
| Tag | Info |
|---|---|
fbe0e839d1e2 ("futex: Prevent overflow by strengthen input validation") |
futex_waitv01
Description
This test verifies EINVAL for futex_waitv syscall.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
5.16 |
futex_waitv02
Description
This test verifies futex_waitv syscall using private data.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
5.16 |
|
n: str_numfutex Number of futex (default 30) |
|
2 |
futex_waitv03
Description
This test verifies futex_waitv syscall using shared data.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
5.16 |
|
n: str_numfutex Number of futex (default 30) |
|
2 |
g
get_mempolicy01
Description
Verify that get_mempolicy() returns a proper return value and errno for various cases.
Test timeout defaults to 300 seconds
get_mempolicy02
Description
Verify that get_mempolicy() returns a proper return errno for failure cases.
Test timeout defaults to 300 seconds
getaddrinfo_01
Description
Basic getaddrinfo() tests.
The test adds LTP specific addresses and names to /etc/hosts to avoid DNS, hostname setup issues and conflicts with existing configuration.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
getcontext01
Description
Basic test for getcontext().
Calls a getcontext() then jumps back with a setcontext().
Test timeout defaults to 300 seconds
getdents01
Description
Basic getdents() test that checks if directory listing is correct and complete.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
4 |
getdents02
Description
Verify that:
-
getdents() fails with EBADF if file descriptor fd is invalid
-
getdents() fails with EINVAL if result buffer is too small
-
getdents() fails with ENOTDIR if file descriptor does not refer to a directory
-
getdents() fails with ENOENT if directory was unlinked()
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
4 |
getdomainname01
Description
Basic test for getdomainname(2)
This is a Phase I test for the getdomainname(2) system call. It is intended to provide a limited exposure of the system call.
Test timeout defaults to 300 seconds
getgid01
Description
Call getgid() and expects that the gid returned correctly.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
getgid03
Description
Testcase to check the basic functionality of getgid().
Algorithm
For functionality test the return value from getgid() is compared to passwd entry.
Test timeout defaults to 300 seconds
gethostid01
Description
Test the basic functionality of the sethostid() and gethostid() system call.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
getitimer01
Description
Check that a correct call to getitimer() succeeds.
Test timeout defaults to 300 seconds
getitimer02
Description
Check that getitimer() call fails:
-
EFAULT with invalid itimerval pointer
-
EINVAL when called with an invalid first argument
Test timeout defaults to 300 seconds
getpagesize01
Description
Verify that getpagesize(2) returns the number of bytes in a memory page as expected.
Test timeout defaults to 300 seconds
getpid01
Description
Verify that getpid() system call returns process ID in range 2 … PID_MAX
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
getpid02
Description
Check that: - fork() in parent returns the same pid as getpid() in child - getppid() in child returns the same pid as getpid() in parent
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
getppid01
Description
Test whether parent process id that getppid() returns is out of range.
Test timeout defaults to 300 seconds
getppid02
Description
Check that getppid() in child returns the same pid as getpid() in parent.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
getrlimit01
Description
Verify that getrlimit(2) call will be successful for all possible resource types.
Test timeout defaults to 300 seconds
getrlimit02
Description
Test for checking error conditions for getrlimit(2) 1) getrlimit(2) returns -1 and sets errno to EFAULT if an invalid address is given for address parameter. 2) getrlimit(2) returns -1 and sets errno to EINVAL if an invalid resource type (RLIM_NLIMITS is a out of range resource type) is passed.
Test timeout defaults to 300 seconds
getrusage01
Description
Test that getrusage() with RUSAGE_SELF and RUSAGE_CHILDREN succeeds.
Test timeout defaults to 300 seconds
getrusage02
Description
Verify that getrusage() fails with:
-
EINVAL with invalid who
-
EFAULT with invalid usage pointer
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
3 |
getrusage03
Description
Test ru_maxrss behaviors in struct rusage.
This test program is backported from upstream commit: 1f10206cf8e9, which fills ru_maxrss value in struct rusage according to rss hiwater mark. To make sure this feature works correctly, a series of tests are executed in this program.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
TST_CAP, (, TST_CAP_REQ, CAP_IPC_LOCK, ) |
|
1 |
|
1 |
|
2.6.32 |
|
512 |
|
1 |
|
resource |
| Tag | Info |
|---|---|
getrusage03_child
Description
Child program executed by getrusage03.
Test timeout defaults to 300 seconds
getsid01
Description
Verify that session IDs returned by getsid() (with argument pid=0) are same in parent and child process.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
getsid02
Description
Verify that getsid(2) fails with ESRCH errno when there is no process found with process ID pid.
Test timeout defaults to 300 seconds
getuid01
Description
Check the basic functionality of the getuid() system call.
Test timeout defaults to 300 seconds
getuid03
Description
Check that getuid() return value matches value from /proc/self/status.
Test timeout defaults to 300 seconds
getxattr04
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
xfs |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
|
1 |
| Tag | Info |
|---|---|
5a93790d4e2d ("xfs: remove racy hasattr check from attr ops") |
h
hugemmap01
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
128, TST_REQUEST |
|
1 |
|
1 |
|
H: Hopt Location of hugetlbfs, i.e. -H /var/hugetlbfs s: nr_opt Set the number of the been allocated hugepages |
hugemmap02
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
128, TST_REQUEST |
|
1 |
|
1 |
|
H: Hopt Location of hugetlbfs, i.e. -H /var/hugetlbfs s: nr_opt Set the number of the been allocated hugepages |
hugemmap04
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
128, TST_REQUEST |
|
1 |
|
1 |
|
H: Hopt Location of hugetlbfs, i.e. -H /var/hugetlbfs s: nr_opt Set the number of the been allocated hugepages |
hugemmap05
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
NR_HPAGES, TST_NEEDS |
|
1 |
|
1 |
|
s opt_sysfs Setup hugepages from sysfs m opt_shmid Reserve hugepages by shmget a: opt_alloc Number of overcommint hugepages |
hugemmap06
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
(, ARSZ, 1, ), LOOP, TST_NEEDS |
|
2.6.32 |
|
1 |
|
1 |
hugemmap07
Description
Certain kernels have a bug where brk() does not perform the same checks that a MAP_FIXED mmap() will, allowing brk() to create a normal page VMA in a hugepage only address region. This can lead to oopses or other badness.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1, TST_NEEDS |
|
1 |
|
1 |
|
TST_TAINT_D |
hugemmap08
Description
Some kernel versions after hugepage demand allocation was added used a dubious heuristic to check if there was enough hugepage space available for a given mapping. The number of not-already-instantiated pages in the mapping was compared against the total hugepage free pool. It was very easy to confuse this heuristic into overcommitting by allocating hugepage memory in chunks, each less than the total available pool size but together more than available. This would generally lead to OOM SIGKILLs of one process or another when it tried to instantiate pages beyond the available pool.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
3, TST_NEEDS |
|
1 |
|
1 |
|
PATH_OC_HPAGES |
hugemmap09
Description
Test sanity of cow optimization on page cache. If a page in page cache has only 1 ref count, it is mapped for a private mapping directly and is overwritten freely, so next time we access the page, we can see corrupt data.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
2, TST_NEEDS |
|
1 |
|
1 |
hugeshmat01
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
128, TST_REQUEST |
|
1 |
|
1 |
|
s: nr_opt Set the number of the been allocated hugepages |
hugeshmat02
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
128, TST_REQUEST |
|
1 |
|
1 |
|
s: nr_opt Set the number of the been allocated hugepages |
hugeshmat03
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
128, TST_REQUEST |
|
1 |
|
1 |
|
s: nr_opt Set the number of the been allocated hugepages |
hugeshmat04
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1, TST_NEEDS |
|
2048 |
|
1 |
|
1 |
| Tag | Info |
|---|---|
c5c99429fa57 ("fix hugepages leak due to pagetable page sharing") |
hugeshmat05
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
N1, TST_NEEDS |
|
1 |
|
1 |
hugeshmctl01
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
128, TST_REQUEST |
|
1 |
|
1 |
|
1 |
|
s: nr_opt Set the number of the been allocated hugepages |
hugeshmctl02
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
128, TST_REQUEST |
|
1 |
|
1 |
|
s: nr_opt Set the number of the been allocated hugepages |
hugeshmctl03
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
128, TST_REQUEST |
|
1 |
|
1 |
|
s: nr_opt Set the number of the been allocated hugepages |
hugeshmdt01
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
128, TST_REQUEST |
|
1 |
|
s: nr_opt Set the number of the been allocated hugepages |
hugeshmget01
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
128, TST_REQUEST |
|
1 |
|
s: nr_opt Set the number of the been allocated hugepages |
hugeshmget02
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
128, TST_REQUEST |
|
1 |
|
s: nr_opt Set the number of the been allocated hugepages |
i
icmp_rate_limit01
CVE-2020-25705
Test of ICMP rate limiting behavior that may be abused for DNS cache poisoning attack. Send a few batches of 100 packets to a closed UDP port and count the ICMP errors. If the number of errors is always the same for each batch (not randomized), the system is vulnerable. Send packets from multiple IP addresses to bypass per-address ICMP throttling.
Fixed in:
commit b38e7819cae946e2edf869e604af1e65a5d241c5 Author: Eric Dumazet <edumazet@google.com> Date: Thu Oct 15 11:42:00 2020 -0700
icmp: randomize the global rate limiter
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
CONFIG_VETH, CONFIG_USER_NS=y, CONFIG_NET_NS=y |
|
?/proc/sys/user/max_user_namespaces |
| Tag | Info |
|---|---|
init_module01
Description
Basic init_module() tests.
Algorithm
Inserts a simple module after opening and mmaping the module file.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
init_module02
Description
Basic init_module() failure tests.
Algorithm
Tests various failure scenarios for init_module().
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
inotify10
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
| Tag | Info |
|---|---|
fecc4559780d ("fsnotify: fix events reported to watching parent and child") |
inotify11
Description
Test opening files after receiving IN_DELETE.
Kernel v5.13 has a regression allowing files to be open after IN_DELETE.
The problem has been fixed by commit: a37d9a17f099 "fsnotify: invalidate dcache before IN_DELETE event".
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
| Tag | Info |
|---|---|
a37d9a17f099 ("fsnotify: invalidate dcache before IN_DELETE event") |
inotify12
Description
Test special inotify mask flags.
Regression test for kernel commit: a32e697cda27 ("inotify: show inotify mask flags in proc fdinfo")
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
10 |
|
1 |
| Tag | Info |
|---|---|
a32e697cda27 ("inotify: show inotify mask flags in proc fdinfo") |
inotify_init1_01
Description
Verify that inotify_init1() returns a file descriptor and sets the close-on-exec (FD_CLOEXEC) flag on the new file descriptor only when called with IN_CLOEXEC.
Test timeout defaults to 300 seconds
inotify_init1_02
Description
Verify that inotify_init1() returns a file descriptor and sets the O_NONBLOCK file status flag on the open file description referred to by the new file descriptor only when called with IN_NONBLOCK.
Test timeout defaults to 300 seconds
io_cancel01
Description
Test io_cancel invoked via syscall(2) with one of pointers set to invalid address and expects it to return EFAULT.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
CONFIG_AIO=y |
io_cancel02
Description
Test io_cancel invoked via libaio with one of the data structures points to invalid data and expects it to return -EFAULT.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
CONFIG_AIO=y |
io_control01
Description
Perform some I/O on a file and check if at least some of it is recorded by the I/O controller.
The exact amount of I/O performed is dependent on the file system, page cache, scheduler and block driver. We call sync and drop the file’s page cache to force reading and writing. We also write random data to try to prevent compression.
The pagecache is a particular issue for reading. If the call to fadvise is ignored then the data may only be read from the cache. So that no I/O requests are made.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
1 |
|
io |
|
TST_CG_V2 |
|
1 |
|
1 |
|
ntfs, tmpfs |
io_destroy01
Description
Test io_destroy invoked via libaio with invalid ctx and expects it to return -EINVAL.
Test timeout defaults to 300 seconds
io_destroy02
Description
Test io_destroy invoked via syscall(2) with an invalid ctx and expects it to return EINVAL.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
CONFIG_AIO=y |
io_getevents01
Description
Test io_getevents invoked via syscall(2) with invalid ctx and expects it to return EINVAL.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
CONFIG_AIO=y |
io_getevents02
Description
Test io_getevents invoked via libaio with invalid ctx and expects it to return -EINVAL.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
CONFIG_AIO=y |
io_setup01
Description
Test io_setup invoked via libaio:
-
io_setup succeeds if both nr_events and ctxp are valid.
-
io_setup fails and returns -EINVAL if ctxp is not initialized to 0.
-
io_setup fails and returns -EINVAL if nr_events is invalid.
-
io_setup fails and returns -EFAULT if ctxp is NULL.
-
io_setup fails and returns -EAGAIN if nr_events exceeds the limit 1of available events.
Test timeout defaults to 300 seconds
io_setup02
Description
Test io_setup invoked via syscall(2):
-
io_setup fails and returns EFAULT if ctxp is NULL.
-
io_setup fails and returns EINVAL if ctxp is not initialized to 0.
-
io_setup fails and returns EINVAL if nr_events is -1.
-
io_setup fails and returns EAGAIN if nr_events exceeds the limit of available events.
-
io_setup succeeds if both nr_events and ctxp are valid.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
CONFIG_AIO=y |
io_submit01
Description
Test io_submit() invoked via libaio:
-
io_submit fails and returns -EINVAL if ctx is invalid.
-
io_submit fails and returns -EINVAL if nr is invalid.
-
io_submit fails and returns -EFAULT if iocbpp pointer is invalid.
-
io_submit fails and returns -EBADF if fd is invalid.
-
io_submit succeeds and returns the number of iocbs submitted.
-
io_submit succeeds and returns 0 if nr is zero.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
io_submit02
Description
Test io_submit invoked via syscall(2):
-
io_submit() returns the number of iocbs submitted.
-
io_submit() returns 0 if nr is zero.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
CONFIG_AIO=y |
|
1 |
io_submit03
Description
Test io_submit invoked via syscall(2):
-
io_submit fails and returns EINVAL if ctx is invalid.
-
io_submit fails and returns EINVAL if nr is invalid.
-
io_submit fails and returns EFAULT if iocbpp pointer is invalid.
-
io_submit fails and returns EBADF if fd is invalid.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
CONFIG_AIO=y |
|
1 |
io_uring02
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
TST_CAP, (, TST_CAP_REQ, CAP_SYS_CHROOT, ) |
|
1 |
ioctl01
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
1 |
|
D: device Tty device. For example, /dev/tty[0-9] |
ioctl07
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
f: s_fuzz Fuzz factor for valid match (default 2) |
ioctl_loop01
Description
Tests ioctl() on loopdevice with LO_FLAGS_AUTOCLEAR and LO_FLAGS_PARTSCAN flags.
For LO_FLAGS_AUTOCLEAR flag, only checks autoclear field value in sysfs and also gets lo_flags by using LOOP_GET_STATUS.
For LO_FLAGS_PARTSCAN flag, it is the same as LO_FLAGS_AUTOCLEAR flag. But also checks whether it can scan partition table correctly i.e. checks whether /dev/loopnp1 and /sys/bloclk/loop0/loop0p1 existed.
For LO_FLAGS_AUTOCLEAR flag, it can be clear. For LO_FLAGS_PARTSCAN flag, it cannot be clear. Test checks this.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
loop |
|
1 |
|
1 |
| Tag | Info |
|---|---|
10c70d95c0f2 ("block: remove the bd_openers checks in blk_drop_partitions") |
|
ioctl_loop02
Description
Tests ioctl() on loopdevice with LO_FLAGS_READ_ONLY (similar as losetup -r) and LOOP_CHANGE_FD flags.
For LOOP_CHANGE_FD, this operation is possible only if the loop device is read-only and the new backing store is the same size and type as the old backing store.
When using LOOP_CONFIGURE ioctl(), it can set LO_FLAGS_READ_ONLY flag even though backing file with write mode.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
loop |
|
1 |
|
1 |
ioctl_loop03
Description
Tests ioctl() on loopdevice with LOOP_CHANGE_FD flag.
Tests whether LOOP_CHANGE_FD can not succeed (get EINVAL error) when loop_dev is not read only.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
loop |
|
1 |
|
1 |
ioctl_loop04
Description
Tests ioctl() on loopdevice with LOOP_SET_CAPACITY flag.
Tests whether LOOP_SET_CAPACITY can update a live loop device size after change the size of the underlying backing file. Also checks sysfs value.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
loop |
|
1 |
|
1 |
ioctl_loop05
Description
Tests ioctl() on loopdevice with LOOP_SET_DIRECT_IO flag.
Tests whether LOOP_SET_DIRECT_IO can update a live loop device dio mode. It requires the backing file also supports dio mode and the lo_offset is aligned with the logical block size.
The direct I/O error handling is a bit messy on Linux, some filesystems return error when it coudln’t be enabled, some silently fall back to regular buffered I/O.
The LOOP_SET_DIRECT_IO ioctl() may ignore all checks if it cannot get the logical block size which is the case if the block device pointer in the backing file inode is not set. In this case the direct I/O appears to be enabled but falls back to buffered I/O later on. This is the case at least for Btrfs. Because of that the test passes both with failure as well as success with non-zero offset.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
loop |
|
1 |
|
1 |
|
tmpfs, overlayfs |
ioctl_loop06
Description
Tests invalid block size of loopdevice by using ioctl() with LOOP_SET_BLOCK_SIZE and LOOP_CONFIGURE flags.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
loop |
|
1 |
|
1 |
ioctl_loop07
Description
Tests ioctl() on loopdevice with LOOP_SET_STATUS64 and LOOP_GET_STATUS64 flags.
Tests lo_sizelimit field. If lo_sizelimit is 0, it means max available. If sizelimit is less than loop_size, loopsize will be truncated.
Also uses LOOP_CONFIGURE ioctl to test lo_sizelimit field.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
loop |
|
1 |
|
1 |
| Tag | Info |
|---|---|
79e5dc59e297 ("loop: Set correct device size when using LOOP_CONFIGURE") |
ioctl_ns01
Description
Test ioctl_ns with NS_GET_PARENT request.
Parent process tries to get parent of initial namespace, which should fail with EPERM because it has no parent.
Child process has a new pid namespace, which should make the call fail with EPERM error.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
4.9 |
|
1 |
ioctl_ns02
Description
Test ioctl_ns with NS_GET_PARENT request.
Test tries to get namespace parent for UTS namespace, which should make the call fail with EINVAL, being a nonhierarchical namespace.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
4.9 |
ioctl_ns03
Description
Test ioctl_ns with NS_GET_OWNER_UID request.
Calls ioctl for a UTS namespace, which isn’t a user namespace. This should make the call fail with EINVAL.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
4.11 |
ioctl_ns04
Description
Test ioctl_ns with NS_GET_USERNS request.
Owning user namespace of process calling ioctl is out of scope, which should make the call fail with EPERM.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
4.9 |
ioctl_ns05
Description
Test ioctl_ns with NS_GET_PARENT request.
Child cloned with the CLONE_NEWPID flag is created in a new pid namespace. That’s checked by comparing its /proc/self/ns/pid symlink and the parent’s one. Also child thinks its pid is 1.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
4.9 |
|
1 |
|
1 |
|
1 |
ioctl_ns06
Description
Test ioctl_ns with NS_GET_USERNS request.
After the call to clone with the CLONE_NEWUSER flag, child is created in a new user namespace. That’s checked by comparing its /proc/self/ns/user symlink and the parent’s one, which should be different.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
|
4.9 |
|
1 |
|
1 |
|
1 |
ioctl_ns07
Description
Test ioctl_ns with NS_GET_* request for file descriptors that aren’t namespaces.
Calling ioctl with test directory’s file descriptor should make the call fail with ENOTTY.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
4.11 |
|
1 |
ioctl_sg01
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
3600 |
| Tag | Info |
|---|---|
a45b599ad808 ("scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()") |
irqbalance01
Description
Check that something (e.g. irqbalance daemon) is performing IRQ load balancing.
On many systems userland needs to set /proc/irq/$IRQ/smp_affinity to prevent many IRQs being delivered to the same CPU.
Note some drivers and IRQ controllers will distribute IRQs evenly. Some systems will have housekeeping CPUs configured. Some IRQs can not be masked etc. So this test is not appropriate for all scenarios.
Furthermore, exactly how IRQs should be distributed is a performance and/or security issue. This is only a generic smoke test. It will hopefully detect misconfigured systems and total balancing failures which are often silent errors.
Heuristic: Evidence of Change
-
Find IRQs with a non-zero count
-
Check if they are now disallowed
There are two sources of information we need to parse:
-
/proc/interrupts
-
/proc/irq/$IRQ/smp_affinity
We get the active IRQs and CPUs from /proc/interrupts. It also contains the per-CPU IRQ counts and info we do not care about.
We get the IRQ masks from each active IRQ’s smp_affinity file. This is a bitmask written out in hexadecimal format. It shows which CPUs an IRQ may be received by.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
2 |
k
keyctl03
Test timeout defaults to 300 seconds
| Tag | Info |
|---|---|
f05819df10d7 ("KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring") |
keyctl04
Test timeout defaults to 300 seconds
| Tag | Info |
|---|---|
c9f838d104fe ("KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings") |
keyctl05
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
1 |
| Tag | Info |
|---|---|
63a0b0509e70 ("KEYS: fix freeing uninitialized memory in key_update()") |
keyctl06
Test timeout defaults to 300 seconds
| Tag | Info |
|---|---|
e645016abc80 ("KEYS: fix writing past end of user-supplied buffer in keyring_read()") |
|
3239b6f29bdf ("KEYS: return full count in keyring_read() if buffer is too small") |
keyctl08
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
2.6.13 |
|
1 |
| Tag | Info |
|---|---|
ee8f844e3c5a ("KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings") |
keyctl09
Description
Test that encrypted keys can be instantiated using user-provided decrypted data that is hex-ascii encoded.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
CONFIG_USER_DECRYPTED_DATA=y |
kill13
Description
Reproducer of CVE-2018-10124; INT_MIN negation.
On most two’s complement CPUs negation of INT_MIN will result in INT_MIN because ~((unsigned)INT_MIN) + 1 overflows to INT_MIN (unless trapped). On one’s complement ~((unsigned)INT_MIN) = INT_MAX.
Without UBSAN kill will always return ESRCH. Regardless of if the bug is present as INT_MIN/INT_MAX are invalid PIDs. It checks the PID before the signal number so we can not cause EINVAL. A trivial test of kill is performed elsewhere. So we don’t run the test without UBSAN to avoid giving the impression we have actually tested for the bug.
Test timeout defaults to 300 seconds
| Key | Value |
|---|---|
CONFIG_UBSAN_SIGNED_OVERFLOW |
|
TST_TAINT_W |
| Tag | Info |
|---|---|
4ea77014af0d ("kernel/signal.c: avoid undefined behaviour in kill_something_info") |