[PATCH 0/2] sysctl: Cover the jiffies converters in the selftests

[PATCH 0/2] sysctl: Cover the jiffies converters in the selftests

[Zhan Xusheng]

Joel asked for a test for the negative read path fixed by

	https://lore.kernel.org/r/20260922031229.2300283-2-zhanxusheng@xiaomi.com

These apply on sysctl-next and depend on that fix; without it 2/2 fails,
which is the point.

While writing the test I noticed that fix's changelog is incomplete: it
names proc_dointvec_jiffies() and proc_dointvec_ms_jiffies(), but
proc_dointvec_userhz_jiffies() goes through the same
proc_int_k2u_conv_kop() and is affected too.  Measured on
net/ipv4/neigh/default/retrans_time at CONFIG_HZ=250, unpatched:

  # echo -1 > /proc/sys/net/ipv4/neigh/default/retrans_time
  # cat /proc/sys/net/ipv4/neigh/default/retrans_time
  -18446742229035144246

I will correct that in the respin.

Tested in qemu at CONFIG_HZ=250 with CONFIG_TEST_SYSCTL=y, and built as
=m.  2/2 reports "not ok" without the fix and "ok" with it, and the
pass/fail counts of the other tests are unchanged either way.

Zhan Xusheng (2):
  sysctl: Add jiffies converter entries to the test module
  selftests: sysctl: Check the sign of a negative jiffies read

 lib/test_sysctl.c                        | 31 ++++++++++++++++++++++++
 tools/testing/selftests/sysctl/sysctl.sh | 23 ++++++++++++++++++
 2 files changed, 54 insertions(+)


base-commit: c5c4ca25387e3cefd1af64edf9187546b6d06787
-- 
2.43.0

[PATCH 1/2] sysctl: Add jiffies converter entries to the test module

[Zhan Xusheng]

lib/test_sysctl.c covers proc_dointvec(), proc_douintvec(),
proc_dostring(), proc_do_large_bitmap() and proc_dou8vec_minmax(), but
none of the jiffies converters.  Their int paths report the sign
separately from the magnitude, which is a shape the existing entries do
not exercise at all.

Add one entry per affected int converter: proc_dointvec_jiffies(),
proc_dointvec_ms_jiffies() and proc_dointvec_userhz_jiffies().  Each is
seeded with HZ jiffies, which is one second in every converter's own
unit, so the three read back as 1, 1000 and 100 respectively.

Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
---
 lib/test_sysctl.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/lib/test_sysctl.c b/lib/test_sysctl.c
index 909cfcf76dbf..7718cf4ffd47 100644
--- a/lib/test_sysctl.c
+++ b/lib/test_sysctl.c
@@ -15,6 +15,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/init.h>
+#include <linux/jiffies.h>
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/printk.h>
@@ -48,6 +49,10 @@ struct test_sysctl_data {
 
 	int boot_int;
 
+	int int_jiffies;
+	int int_ms_jiffies;
+	int int_userhz_jiffies;
+
 	unsigned int uint_0001;
 
 	char string_0001[65];
@@ -67,6 +72,11 @@ static struct test_sysctl_data test_data = {
 
 	.boot_int = 0,
 
+	/* One second in each converter's unit; all three store HZ jiffies. */
+	.int_jiffies = HZ,
+	.int_ms_jiffies = HZ,
+	.int_userhz_jiffies = HZ,
+
 	.uint_0001 = 314,
 
 	.string_0001 = "(none)",
@@ -113,6 +123,27 @@ static const struct ctl_table test_table[] = {
 		.extra1		= SYSCTL_ZERO,
 		.extra2         = SYSCTL_ONE,
 	},
+	{
+		.procname	= "int_jiffies",
+		.data		= &test_data.int_jiffies,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec_jiffies,
+	},
+	{
+		.procname	= "int_ms_jiffies",
+		.data		= &test_data.int_ms_jiffies,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec_ms_jiffies,
+	},
+	{
+		.procname	= "int_userhz_jiffies",
+		.data		= &test_data.int_userhz_jiffies,
+		.maxlen		= sizeof(int),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec_userhz_jiffies,
+	},
 	{
 		.procname	= "uint_0001",
 		.data		= &test_data.uint_0001,
-- 
2.43.0

[PATCH 2/2] selftests: sysctl: Check the sign of a negative jiffies read

[Zhan Xusheng]

proc_int_k2u_conv_kop() returns the sign through *negp and the magnitude
through *u_ptr.  For a negative value it used to convert the
sign-extended int and negate afterwards, so the magnitude came back as a
wrapped 64-bit number.  Nothing noticed, because no test wrote a
negative value to a jiffies sysctl.

Write one to each of the three int converters and require the value to
read back unchanged.  Each value is chosen to convert exactly at every
CONFIG_HZ, so the test does not depend on it:

	converter		write	jiffies stored	reads back
	jiffies			-1	-HZ		-1
	ms_jiffies		-1000	-HZ		-1000
	userhz_jiffies		-100	-HZ		-100

On a kernel without the fix, at CONFIG_HZ=250:

  # int_jiffies: got '-18372957097414713411', want '-1'
  # int_ms_jiffies: got '-18446744069414585320', want '-1000'
  # int_userhz_jiffies: got '-18446742229035144346', want '-100'
  not ok 1 test_int_jiffies_negative

(paths shortened; the runner prints them under /proc/sys/debug/test_sysctl)

Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
---
 tools/testing/selftests/sysctl/sysctl.sh | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/tools/testing/selftests/sysctl/sysctl.sh b/tools/testing/selftests/sysctl/sysctl.sh
index ceb5cfa0cfd4..ad1ee0fccd7c 100755
--- a/tools/testing/selftests/sysctl/sysctl.sh
+++ b/tools/testing/selftests/sysctl/sysctl.sh
@@ -328,6 +328,29 @@ test_int_plain()
 	assert_int_range "$t" "$baseline" || RET=$KSFT_FAIL
 }
 
+# The jiffies converters report the sign separately from the magnitude, so a
+# negative value must survive the round trip through the converter.  Each
+# value below is chosen to convert exactly at every CONFIG_HZ.
+test_int_jiffies_negative()
+{
+	local t="${SYSCTL}/int_jiffies"
+	local m="${SYSCTL}/int_ms_jiffies"
+	local u="${SYSCTL}/int_userhz_jiffies"
+
+	[[ -f "$t" && -f "$m" && -f "$u" ]] || { RET=$KSFT_SKIP; return; }
+
+	printf '%s' "-1" > "$t"
+	assert_content "$t" "-1" || RET=$KSFT_FAIL
+	printf '%s' "-1000" > "$m"
+	assert_content "$m" "-1000" || RET=$KSFT_FAIL
+	printf '%s' "-100" > "$u"
+	assert_content "$u" "-100" || RET=$KSFT_FAIL
+
+	# The positive path was never broken; keep it covered.
+	printf '%s' "1" > "$t"
+	assert_content "$t" "1" || RET=$KSFT_FAIL
+}
+
 test_uint_plain()
 {
 	local t="${SYSCTL}/uint_0001"
-- 
2.43.0

Re: [PATCH 1/2] sysctl: Add jiffies converter entries to the test module

[Bradley Morgan]

On 23 September 2026 15:49:36 BST, Zhan Xusheng <zhanxusheng1024@gmail.com>
wrote:
>lib/test_sysctl.c covers proc_dointvec(), proc_douintvec(),
>proc_dostring(), proc_do_large_bitmap() and proc_dou8vec_minmax(), but
>none of the jiffies converters.  Their int paths report the sign
>separately from the magnitude, which is a shape the existing entries do
>not exercise at all.
>
>Add one entry per affected int converter: proc_dointvec_jiffies(),
>proc_dointvec_ms_jiffies() and proc_dointvec_userhz_jiffies().  Each is
>seeded with HZ jiffies, which is one second in every converter's own
>unit, so the three read back as 1, 1000 and 100 respectively.

LGTM, thanks (and I reviewed this properly)

Reviewed-by: Bradley Morgan <brads@mainlining.org>

All tests pass with your patch applied on my PowerPC box:

Tested-by: Bradley Morgan <brads@mainlining.org> # POWER10


>
>Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
>---
> lib/test_sysctl.c | 31 +++++++++++++++++++++++++++++++
> 1 file changed, 31 insertions(+)
>
>diff --git a/lib/test_sysctl.c b/lib/test_sysctl.c
>index 909cfcf76dbf..7718cf4ffd47 100644
>--- a/lib/test_sysctl.c
>+++ b/lib/test_sysctl.c
>@@ -15,6 +15,7 @@
> #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
> 
> #include <linux/init.h>
>+#include <linux/jiffies.h>
> #include <linux/list.h>
> #include <linux/module.h>
> #include <linux/printk.h>
>@@ -48,6 +49,10 @@ struct test_sysctl_data {
> 
> 	int boot_int;
> 
>+	int int_jiffies;
>+	int int_ms_jiffies;
>+	int int_userhz_jiffies;
>+
> 	unsigned int uint_0001;
> 
> 	char string_0001[65];
>@@ -67,6 +72,11 @@ static struct test_sysctl_data test_data = {
> 
> 	.boot_int = 0,
> 
>+	/* One second in each converter's unit; all three store HZ jiffies. */

Nice comment!

>+	.int_jiffies = HZ,
>+	.int_ms_jiffies = HZ,
>+	.int_userhz_jiffies = HZ,
>+
> 	.uint_0001 = 314,
> 
> 	.string_0001 = "(none)",
>@@ -113,6 +123,27 @@ static const struct ctl_table test_table[] = {
> 		.extra1		= SYSCTL_ZERO,
> 		.extra2         = SYSCTL_ONE,
> 	},
>+	{
>+		.procname	= "int_jiffies",
>+		.data		= &test_data.int_jiffies,
>+		.maxlen		= sizeof(int),
>+		.mode		= 0644,
>+		.proc_handler	= proc_dointvec_jiffies,
>+	},
>+	{
>+		.procname	= "int_ms_jiffies",
>+		.data		= &test_data.int_ms_jiffies,
>+		.maxlen		= sizeof(int),
>+		.mode		= 0644,
>+		.proc_handler	= proc_dointvec_ms_jiffies,
>+	},
>+	{
>+		.procname	= "int_userhz_jiffies",
>+		.data		= &test_data.int_userhz_jiffies,
>+		.maxlen		= sizeof(int),
>+		.mode		= 0644,
>+		.proc_handler	= proc_dointvec_userhz_jiffies,
>+	},

This looks correct to me.


> 	{
> 		.procname	= "uint_0001",
> 		.data		= &test_data.uint_0001,
>


--- Thanks!
"I'm not a very positive person" - Linus torvalds

Re: [PATCH 2/2] selftests: sysctl: Check the sign of a negative jiffies read

[Bradley Morgan]

On 23 September 2026 15:49:37 BST, Zhan Xusheng <zhanxusheng1024@gmail.com>
wrote:
>proc_int_k2u_conv_kop() returns the sign through *negp and the magnitude
>through *u_ptr.  For a negative value it used to convert the
>sign-extended int and negate afterwards, so the magnitude came back as a
>wrapped 64-bit number.  Nothing noticed, because no test wrote a
>negative value to a jiffies sysctl.
>
>Write one to each of the three int converters and require the value to
>read back unchanged.  Each value is chosen to convert exactly at every
>CONFIG_HZ, so the test does not depend on it:
>
>	converter		write	jiffies stored	reads back
>	jiffies			-1	-HZ		-1
>	ms_jiffies		-1000	-HZ		-1000
>	userhz_jiffies		-100	-HZ		-100
>
>On a kernel without the fix, at CONFIG_HZ=250:
>
>  # int_jiffies: got '-18372957097414713411', want '-1'
>  # int_ms_jiffies: got '-18446744069414585320', want '-1000'
>  # int_userhz_jiffies: got '-18446742229035144346', want '-100'
>  not ok 1 test_int_jiffies_negative
>
>(paths shortened; the runner prints them under
>/proc/sys/debug/test_sysctl)
>
>Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
>---
> tools/testing/selftests/sysctl/sysctl.sh | 23 +++++++++++++++++++++++
> 1 file changed, 23 insertions(+)
>
>diff --git a/tools/testing/selftests/sysctl/sysctl.sh b/tools/testing/selftests/sysctl/sysctl.sh
>index ceb5cfa0cfd4..ad1ee0fccd7c 100755
>--- a/tools/testing/selftests/sysctl/sysctl.sh
>+++ b/tools/testing/selftests/sysctl/sysctl.sh
>@@ -328,6 +328,29 @@ test_int_plain()
> 	assert_int_range "$t" "$baseline" || RET=$KSFT_FAIL
> }
> 
>+# The jiffies converters report the sign separately from the magnitude, so a
>+# negative value must survive the round trip through the converter.  Each
>+# value below is chosen to convert exactly at every CONFIG_HZ.

I have a feeling this could be decreased, but I don't care.

Reviewed-by: Bradley Morgan <brads@mainlining.org>


Tested on PowerPC: 

Tested-by: Bradley Morgan <brads@mainlining.org> # POWER10

>+test_int_jiffies_negative()
>+{
>+	local t="${SYSCTL}/int_jiffies"
>+	local m="${SYSCTL}/int_ms_jiffies"
>+	local u="${SYSCTL}/int_userhz_jiffies"
>+
>+	[[ -f "$t" && -f "$m" && -f "$u" ]] || { RET=$KSFT_SKIP; return; }
>+
>+	printf '%s' "-1" > "$t"
>+	assert_content "$t" "-1" || RET=$KSFT_FAIL
>+	printf '%s' "-1000" > "$m"
>+	assert_content "$m" "-1000" || RET=$KSFT_FAIL
>+	printf '%s' "-100" > "$u"
>+	assert_content "$u" "-100" || RET=$KSFT_FAIL
>+
>+	# The positive path was never broken; keep it covered.
>+	printf '%s' "1" > "$t"
>+	assert_content "$t" "1" || RET=$KSFT_FAIL
>+}
>+
> test_uint_plain()
> {
> 	local t="${SYSCTL}/uint_0001"
>

--- Thanks!
"I'm not a very positive person" - Linus torvalds

Re: [PATCH 0/2] sysctl: Cover the jiffies converters in the selftests

[Joel Granados]

[-- Attachment #1: Type: text/plain, Size: 1576 bytes --]

On Wed, Sep 23, 2026 at 10:49:35PM +0800, Zhan Xusheng wrote:
> Joel asked for a test for the negative read path fixed by
> 
> 	https://lore.kernel.org/r/20260922031229.2300283-2-zhanxusheng@xiaomi.com
> 
> These apply on sysctl-next and depend on that fix; without it 2/2 fails,
> which is the point.
> 
> While writing the test I noticed that fix's changelog is incomplete: it
> names proc_dointvec_jiffies() and proc_dointvec_ms_jiffies(), but
> proc_dointvec_userhz_jiffies() goes through the same
> proc_int_k2u_conv_kop() and is affected too.  Measured on
> net/ipv4/neigh/default/retrans_time at CONFIG_HZ=250, unpatched:
> 
>   # echo -1 > /proc/sys/net/ipv4/neigh/default/retrans_time
>   # cat /proc/sys/net/ipv4/neigh/default/retrans_time
>   -18446742229035144246
> 
> I will correct that in the respin.
This means that you will send the V2 of the fix (not the test). Right?

> 
> Tested in qemu at CONFIG_HZ=250 with CONFIG_TEST_SYSCTL=y, and built as
> =m.  2/2 reports "not ok" without the fix and "ok" with it, and the
> pass/fail counts of the other tests are unchanged either way.
> 
> Zhan Xusheng (2):
>   sysctl: Add jiffies converter entries to the test module
>   selftests: sysctl: Check the sign of a negative jiffies read

I just tested this in my env. Works like a charm. I even rebased the fix
on top of these tests and saw that everything was fixed.

Thx!!!!

The testing code will get added to sysctl-next, but the fixes should go
into the current release. Will wait for your V2 to forward them down.

Best

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

Re: [PATCH 2/2] selftests: sysctl: Check the sign of a negative jiffies read

[Joel Granados]

[-- Attachment #1: Type: text/plain, Size: 2331 bytes --]

On Wed, Sep 23, 2026 at 04:53:54PM +0100, Bradley Morgan wrote:
> On 23 September 2026 15:49:37 BST, Zhan Xusheng <zhanxusheng1024@gmail.com>
> wrote:
> >proc_int_k2u_conv_kop() returns the sign through *negp and the magnitude
> >through *u_ptr.  For a negative value it used to convert the
> >sign-extended int and negate afterwards, so the magnitude came back as a
> >wrapped 64-bit number.  Nothing noticed, because no test wrote a
> >negative value to a jiffies sysctl.
> >
> >Write one to each of the three int converters and require the value to
> >read back unchanged.  Each value is chosen to convert exactly at every
> >CONFIG_HZ, so the test does not depend on it:
> >
> >	converter		write	jiffies stored	reads back
> >	jiffies			-1	-HZ		-1
> >	ms_jiffies		-1000	-HZ		-1000
> >	userhz_jiffies		-100	-HZ		-100
> >
> >On a kernel without the fix, at CONFIG_HZ=250:
> >
> >  # int_jiffies: got '-18372957097414713411', want '-1'
> >  # int_ms_jiffies: got '-18446744069414585320', want '-1000'
> >  # int_userhz_jiffies: got '-18446742229035144346', want '-100'
> >  not ok 1 test_int_jiffies_negative
> >
> >(paths shortened; the runner prints them under
> >/proc/sys/debug/test_sysctl)
> >
> >Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
> >---
> > tools/testing/selftests/sysctl/sysctl.sh | 23 +++++++++++++++++++++++
> > 1 file changed, 23 insertions(+)
> >
> >diff --git a/tools/testing/selftests/sysctl/sysctl.sh b/tools/testing/selftests/sysctl/sysctl.sh
> >index ceb5cfa0cfd4..ad1ee0fccd7c 100755
> >--- a/tools/testing/selftests/sysctl/sysctl.sh
> >+++ b/tools/testing/selftests/sysctl/sysctl.sh
> >@@ -328,6 +328,29 @@ test_int_plain()
> > 	assert_int_range "$t" "$baseline" || RET=$KSFT_FAIL
> > }
> > 
> >+# The jiffies converters report the sign separately from the magnitude, so a
> >+# negative value must survive the round trip through the converter.  Each
> >+# value below is chosen to convert exactly at every CONFIG_HZ.
> 
> I have a feeling this could be decreased, but I don't care.

If you don't care, don't comment.
> 
> Reviewed-by: Bradley Morgan <brads@mainlining.org>
> 
> 
> Tested on PowerPC: 
> 
> Tested-by: Bradley Morgan <brads@mainlining.org> # POWER10

Please don't suffix anything after the tag as b4 picks it up.

Best

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

Re: [PATCH 2/2] selftests: sysctl: Check the sign of a negative jiffies read

[Bradley Morgan]

On 25 September 2026 12:45:27 BST, Joel Granados <joel.granados@kernel.org>
wrote:
>On Wed, Sep 23, 2026 at 04:53:54PM +0100, Bradley Morgan wrote:
>> On 23 September 2026 15:49:37 BST, Zhan Xusheng
><zhanxusheng1024@gmail.com>
>> wrote:
>> >proc_int_k2u_conv_kop() returns the sign through *negp and the
>magnitude
>> >through *u_ptr.  For a negative value it used to convert the
>> >sign-extended int and negate afterwards, so the magnitude came back as
>a
>> >wrapped 64-bit number.  Nothing noticed, because no test wrote a
>> >negative value to a jiffies sysctl.
>> >
>> >Write one to each of the three int converters and require the value to
>> >read back unchanged.  Each value is chosen to convert exactly at every
>> >CONFIG_HZ, so the test does not depend on it:
>> >
>> >	converter		write	jiffies stored	reads back
>> >	jiffies			-1	-HZ		-1
>> >	ms_jiffies		-1000	-HZ		-1000
>> >	userhz_jiffies		-100	-HZ		-100
>> >
>> >On a kernel without the fix, at CONFIG_HZ=250:
>> >
>> >  # int_jiffies: got '-18372957097414713411', want '-1'
>> >  # int_ms_jiffies: got '-18446744069414585320', want '-1000'
>> >  # int_userhz_jiffies: got '-18446742229035144346', want '-100'
>> >  not ok 1 test_int_jiffies_negative
>> >
>> >(paths shortened; the runner prints them under
>> >/proc/sys/debug/test_sysctl)
>> >
>> >Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
>> >---
>> > tools/testing/selftests/sysctl/sysctl.sh | 23 +++++++++++++++++++++++
>> > 1 file changed, 23 insertions(+)
>> >
>> >diff --git a/tools/testing/selftests/sysctl/sysctl.sh
>b/tools/testing/selftests/sysctl/sysctl.sh
>> >index ceb5cfa0cfd4..ad1ee0fccd7c 100755
>> >--- a/tools/testing/selftests/sysctl/sysctl.sh
>> >+++ b/tools/testing/selftests/sysctl/sysctl.sh
>> >@@ -328,6 +328,29 @@ test_int_plain()
>> > 	assert_int_range "$t" "$baseline" || RET=$KSFT_FAIL
>> > }
>> > 
>> >+# The jiffies converters report the sign separately from the
>magnitude, so a
>> >+# negative value must survive the round trip through the converter. 
>Each
>> >+# value below is chosen to convert exactly at every CONFIG_HZ.
>> 
>> I have a feeling this could be decreased, but I don't care.
>
>If you don't care, don't comment.
>> 

its because I think it could, but it isn't a complete patch breaker.

>> Reviewed-by: Bradley Morgan <brads@mainlining.org>
>> 
>> 
>> Tested on PowerPC: 
>> 
>> Tested-by: Bradley Morgan <brads@mainlining.org> # POWER10
>
>Please don't suffix anything after the tag as b4 picks it up.
>
>Best
>

--- Thanks!
"I'm not a very positive person" - Linus torvalds