[LTP] [PATCH] keyctl05: Use DNS_LOOKUP_GOOD to avoid false-negatives due to EKEYEXPIRED

[LTP] [PATCH] keyctl05: Use DNS_LOOKUP_GOOD to avoid false-negatives due to EKEYEXPIRED

[Florian Schmaus via ltp]

In keyctl05, test_update_nonupdatable() verifies that
keyctl(KEYCTL_UPDATE) fails with EOPNOTSUPP on key types without an
->update() method (such as 'dns_resolver').

Commit 4e9400050683 ("keyctl05: Improve the dns_res_payload for boundary
testing") changed the dns_res_payload to a 6-byte V1 server-list header:
    { 0x00, 0x00, 0x01, 0xff, 0x00, 0x00 }

Byte 4 represents the lookup status (enum dns_lookup_status). Setting it
to 0x00 (DNS_LOOKUP_NOT_DONE) causes the kernel's dns_resolver_preparse()
(net/dns_resolver/dns_key.c) to treat it as a failed lookup:
    if ((v1->status != DNS_LOOKUP_GOOD &&
         v1->status != DNS_LOOKUP_GOOD_WITH_BAD)) {
        if (prep->expiry == TIME64_MAX)
            prep->expiry = ktime_get_real_seconds() + 1;
    }

This sets an aggressive 1-second expiration on the key. On slower
environments, such as QEMU, more than 1 second may elapse between
add_key() and keyctl(KEYCTL_UPDATE), causing the update call in
test_update_nonupdatable() to fail with EKEYEXPIRED (127) rather than
EOPNOTSUPP:
    keyctl05.c:143: TFAIL: updating 'dns_resolver' key unexpectedly failed: EKEYEXPIRED (127)

Set status (byte 4) in dns_res_payload to 0x01 (DNS_LOOKUP_GOOD) so
that the kernel does not set a 1-second negative expiry, while still
retaining the 6-byte boundary payload check for commit acc657692aed.

Signed-off-by: Florian Schmaus <florian.schmaus@codasip.com>
---
 testcases/kernel/syscalls/keyctl/keyctl05.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/testcases/kernel/syscalls/keyctl/keyctl05.c b/testcases/kernel/syscalls/keyctl/keyctl05.c
index abc881628678..45f25fa7d366 100644
--- a/testcases/kernel/syscalls/keyctl/keyctl05.c
+++ b/testcases/kernel/syscalls/keyctl/keyctl05.c
@@ -208,8 +208,13 @@ static void do_test(unsigned int i)
 	 * the incoming data for add_key() sysdall should be not less than 6
 	 * bytes, because struct dns_server_list_v1_header is 6 bytes.
 	 * The minimum payload will be tested here for boundary testing.
+	 *
+	 * Set status (byte 4) to 0x01 (DNS_LOOKUP_GOOD) so the kernel does
+	 * not treat it as a failed lookup and set a 1s expiry (prep->expiry
+	 * = now + 1), which causes keyctl_update() to fail with EKEYEXPIRED
+	 * on slow systems (e.g., QEMU).
 	 */
-	static char dns_res_payload[] = { 0x00, 0x00, 0x01, 0xff, 0x00, 0x00 };
+	static char dns_res_payload[] = { 0x00, 0x00, 0x01, 0xff, 0x01, 0x00 };
 
 	switch (i) {
 	case 0:
-- 
2.55.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] keyctl05: Use DNS_LOOKUP_GOOD to avoid false-negatives due to EKEYEXPIRED

[linuxtestproject.agent]

Hi Florian,

On 14 Oct 2026, Florian Schmaus via ltp wrote:
> keyctl05: Use DNS_LOOKUP_GOOD to avoid false-negatives due to EKEYEXPIRED

Verdict - Reviewed

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] keyctl05: Use DNS_LOOKUP_GOOD to avoid false-negatives due to EKEYEXPIRED

[Andrea Cervesato via ltp]

Hi Florian,


> In keyctl05, test_update_nonupdatable() verifies that
> keyctl(KEYCTL_UPDATE) fails with EOPNOTSUPP on key types without an
> ->update() method (such as 'dns_resolver').
> 
> Commit 4e9400050683 ("keyctl05: Improve the dns_res_payload for boundary
> testing") changed the dns_res_payload to a 6-byte V1 server-list header:
>     { 0x00, 0x00, 0x01, 0xff, 0x00, 0x00 }
> 
> Byte 4 represents the lookup status (enum dns_lookup_status). Setting it
> to 0x00 (DNS_LOOKUP_NOT_DONE) causes the kernel's dns_resolver_preparse()
> (net/dns_resolver/dns_key.c) to treat it as a failed lookup:
>     if ((v1->status != DNS_LOOKUP_GOOD &&
>          v1->status != DNS_LOOKUP_GOOD_WITH_BAD)) {
>         if (prep->expiry == TIME64_MAX)
>             prep->expiry = ktime_get_real_seconds() + 1;
>     }
> 
> This sets an aggressive 1-second expiration on the key. On slower
> environments, such as QEMU, more than 1 second may elapse between
> add_key() and keyctl(KEYCTL_UPDATE), causing the update call in
> test_update_nonupdatable() to fail with EKEYEXPIRED (127) rather than
> EOPNOTSUPP:
>     keyctl05.c:143: TFAIL: updating 'dns_resolver' key unexpectedly failed: EKEYEXPIRED (127)
> 
> Set status (byte 4) in dns_res_payload to 0x01 (DNS_LOOKUP_GOOD) so
> that the kernel does not set a 1-second negative expiry, while still
> retaining the 6-byte boundary payload check for commit acc657692aed.

Good catch. I'm wondering if it makes sense to use KEYCTL_SET_TIMEOUT in
this case, but I guess we can rely on the test timeout in this case.

did you explore this option already?

Otherwise LGTM

Reviewed-by: Andrea Cervesato <andrea.cervesato@suse.com>

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] keyctl05: Use DNS_LOOKUP_GOOD to avoid false-negatives due to EKEYEXPIRED

[Andrea Cervesato via ltp]

Merged, Thanks!

--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] keyctl05: Use DNS_LOOKUP_GOOD to avoid false-negatives due to EKEYEXPIRED

[Florian Schmaus via ltp]

On 14/10/2026 09.43, Andrea Cervesato wrote:
> Hi Florian,
> 
> 
>> In keyctl05, test_update_nonupdatable() verifies that
>> keyctl(KEYCTL_UPDATE) fails with EOPNOTSUPP on key types without an
>> ->update() method (such as 'dns_resolver').
>>
>> Commit 4e9400050683 ("keyctl05: Improve the dns_res_payload for boundary
>> testing") changed the dns_res_payload to a 6-byte V1 server-list header:
>>      { 0x00, 0x00, 0x01, 0xff, 0x00, 0x00 }
>>
>> Byte 4 represents the lookup status (enum dns_lookup_status). Setting it
>> to 0x00 (DNS_LOOKUP_NOT_DONE) causes the kernel's dns_resolver_preparse()
>> (net/dns_resolver/dns_key.c) to treat it as a failed lookup:
>>      if ((v1->status != DNS_LOOKUP_GOOD &&
>>           v1->status != DNS_LOOKUP_GOOD_WITH_BAD)) {
>>          if (prep->expiry == TIME64_MAX)
>>              prep->expiry = ktime_get_real_seconds() + 1;
>>      }
>>
>> This sets an aggressive 1-second expiration on the key. On slower
>> environments, such as QEMU, more than 1 second may elapse between
>> add_key() and keyctl(KEYCTL_UPDATE), causing the update call in
>> test_update_nonupdatable() to fail with EKEYEXPIRED (127) rather than
>> EOPNOTSUPP:
>>      keyctl05.c:143: TFAIL: updating 'dns_resolver' key unexpectedly failed: EKEYEXPIRED (127)
>>
>> Set status (byte 4) in dns_res_payload to 0x01 (DNS_LOOKUP_GOOD) so
>> that the kernel does not set a 1-second negative expiry, while still
>> retaining the 6-byte boundary payload check for commit acc657692aed.
> 
> Good catch. I'm wondering if it makes sense to use KEYCTL_SET_TIMEOUT in
> this case, but I guess we can rely on the test timeout in this case.
> 
> did you explore this option already?

Sorry, no. This seemed like the less intrusive fix.


> Otherwise LGTM
> 
> Reviewed-by: Andrea Cervesato <andrea.cervesato@suse.com>

Thanks!


> 
> --
> Andrea Cervesato
> SUSE QE Automation Engineer Linux
> andrea.cervesato@suse.com


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp