[LTP] [PATCH v6 0/4] tst_kconfig: automatic module load/unload for CONFIG_*=m

[LTP] [PATCH v6 0/4] tst_kconfig: automatic module load/unload for CONFIG_*=m

[Li Wang (Hieco)]

Tests that depend on a config set to =m currently load the module
themselves, and may fail with misleading errors when it is missing,
e.g. bind() returning EADDRNOTAVAIL for AF_VSOCK without vsock_loopback.

This series makes tst_kconfig record the module for every
config_module_maps[] entry seen as =m, load them once the kernel
config check passes, and unload them at cleanup time.

Changes in v6:
- Rename tst_kconfig_module_unload_all to tst_kconfig_module_unload.
- Unload modules with delete_module(O_NONBLOCK) instead of tst_modprobe(). 
- Drop the redundant modules_loaded flag.
- Reword keyctl23 root note instead of removing it.

Changes in v5:
- cve-2025-21756.c: merge drop_privileges into setup and drop cleanup.
- keyctl23.c: remove tst_modprobe() so it can run on Android.

Changes in v4:
- tst_kconfig: fold module_name_for_config() into
  kconfig_module_record()
- tst_kconfig: move the choice == 'm' gate into
  kconfig_module_record() and pass struct tst_kconfig_var * instead
  of the raw config name.

Changes in v3:
- Queue only configs that stay 'm' after kconfig_module_check(),
  so a module downgraded to 'n' does not abort an otherwise
  runnable test.
- Unload with "modprobe -r" instead of "rmmod" to also remove
  dependencies pulled in by modprobe.
- Drop the redundant geteuid() check in the unload path.
- Raise MAX_LOADED_MODULES from 16 to 32.
- cve-2025-21756: drop privileges to nobody after module loading
  and regain root in cleanup(), so the reproducer runs from a
  non-root context while the framework can still unload modules.

Changes in v2:
- Add tst_module_is_loaded() helper.
- Only load/unload modules that are not already loaded.
- Skip automatic loading when KCONFIG_SKIP_CHECK=1, keeping the
  semantics consistent with skipping the config check.
- Document the KCONFIG_SKIP_CHECK=1 behaviour for keyctl29/keyctl30
  and the vsock/vsock_loopback mapping.

Li Wang (Hieco) (4):
  lib: add module is loaded check
  tst_kconfig: load and unload kernel modules for CONFIG_*=m
  tst_kconfig: add module mappings for vsock/vsock_loopback
  testcases: drop manual tst_modprobe() now handled by tst_kconfig

 include/tst_kconfig.h                       | 21 +++++
 include/tst_module.h                        |  1 +
 lib/tst_kconfig.c                           | 86 +++++++++++++++++++++
 lib/tst_module.c                            | 39 ++++++++++
 lib/tst_test.c                              | 13 +++-
 testcases/cve/cve-2025-21756.c              | 17 ++++
 testcases/cve/cve-2026-46331.c              |  7 --
 testcases/cve/sctphantom.c                  |  3 -
 testcases/kernel/syscalls/keyctl/keyctl23.c |  6 +-
 testcases/kernel/syscalls/keyctl/keyctl29.c |  3 -
 testcases/kernel/syscalls/keyctl/keyctl30.c |  3 -
 11 files changed, 176 insertions(+), 23 deletions(-)

-- 
2.56.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v6 1/4] lib: add module is loaded check

[Li Wang (Hieco)]

Add a helper that checks whether a kernel module is loaded by
looking it up in /proc/modules. Module names are normalized so that
hyphens match the underscores used by the kernel.

Signed-off-by: Li Wang (Hieco) <li.wang@linux.dev>
---
 include/tst_module.h |  1 +
 lib/tst_module.c     | 39 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/include/tst_module.h b/include/tst_module.h
index e55321d19..9b789e289 100644
--- a/include/tst_module.h
+++ b/include/tst_module.h
@@ -49,5 +49,6 @@ static inline void tst_requires_module_signature_disabled(void)
 
 void tst_modprobe(const char *mod_name, char *const argv[]);
 void tst_module_reload(const char *mod_name, char *const argv[]);
+bool tst_module_is_loaded(const char *mod_name);
 
 #endif /* TST_MODULE_H */
diff --git a/lib/tst_module.c b/lib/tst_module.c
index cbd2415d5..db341ec57 100644
--- a/lib/tst_module.c
+++ b/lib/tst_module.c
@@ -21,6 +21,7 @@
  */
 
 #define _GNU_SOURCE
+#include <ctype.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
@@ -174,3 +175,41 @@ void tst_module_reload(const char *mod_name, char *const argv[])
 	tst_module_unload_(NULL, mod_name);
 	tst_modprobe(mod_name, argv);
 }
+
+bool tst_module_is_loaded(const char *mod_name)
+{
+	char line[4096];
+	size_t mod_len = strlen(mod_name);
+	FILE *file;
+
+	file = fopen("/proc/modules", "r");
+	if (!file)
+		return false;
+
+	while (fgets(line, sizeof(line), file)) {
+		char *p = line;
+		size_t i;
+
+		while (*p && !isspace(*p))
+			p++;
+
+		if ((size_t)(p - line) != mod_len)
+			continue;
+
+		for (i = 0; i < mod_len; i++) {
+			char a = (line[i] == '-') ? '_' : line[i];
+			char b = (mod_name[i] == '-') ? '_' : mod_name[i];
+
+			if (a != b)
+				break;
+		}
+
+		if (i == mod_len) {
+			fclose(file);
+			return true;
+		}
+	}
+
+	fclose(file);
+	return false;
+}
-- 
2.56.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v6 2/4] tst_kconfig: load and unload kernel modules for CONFIG_*=m

[Li Wang (Hieco)]

Tests that depend on a config set to =m must currently load the
module themselves, and may fail with misleading errors when it is
not loaded, e.g. bind() returning EADDRNOTAVAIL for AF_VSOCK when
vsock_loopback is missing.

Record the module for every config_module_maps[] entry seen as =m
and not already loaded while parsing the kernel config. When
needs_kconfigs is set, load them via tst_modprobe() after a
successful tst_kconfig_check(), and unload them in reverse order
from do_cleanup(). Only modules that were actually loaded are
unloaded; modules still in use are skipped. Dependencies pulled in
by modprobe are not unloaded.

Modules are only loaded when running as root.

Signed-off-by: Li Wang (Hieco) <li.wang@linux.dev>
---
 include/tst_kconfig.h | 21 +++++++++++
 lib/tst_kconfig.c     | 84 +++++++++++++++++++++++++++++++++++++++++++
 lib/tst_test.c        | 13 +++++--
 3 files changed, 115 insertions(+), 3 deletions(-)

diff --git a/include/tst_kconfig.h b/include/tst_kconfig.h
index c454f3467..d603919d9 100644
--- a/include/tst_kconfig.h
+++ b/include/tst_kconfig.h
@@ -105,4 +105,25 @@ void tst_kcmdline_parse(struct tst_kcmdline_var params[], size_t params_len);
  */
 int tst_has_slow_kconfig(void);
 
+/**
+ * tst_kconfig_module_load() - Load kernel modules for CONFIG_*=m entries.
+ *
+ * Loads the modules for CONFIG_* options found as =m in the kernel config
+ * that are not already loaded, in the order they were found.
+ * Does nothing when not running as root.
+ */
+void tst_kconfig_module_load(void);
+
+/**
+ * tst_kconfig_module_unload() - Unload modules loaded by
+ *                               tst_kconfig_module_load().
+ *
+ * Unloads, in reverse order, only the modules that were actually loaded.
+ * Modules still in use are skipped silently. Dependencies pulled in by
+ * modprobe are not unloaded.
+ *
+ * Called from do_cleanup(), so it runs regardless of the test result.
+ */
+void tst_kconfig_module_unload(void);
+
 #endif	/* TST_KCONFIG_H__ */
diff --git a/lib/tst_kconfig.c b/lib/tst_kconfig.c
index f055c2e5f..a0985912c 100644
--- a/lib/tst_kconfig.c
+++ b/lib/tst_kconfig.c
@@ -16,8 +16,15 @@
 #include "tst_bool_expr.h"
 #include "tst_safe_stdio.h"
 
+#include "lapi/syscalls.h"
+#include "tst_module.h"
 #include "tst_kconfig_checks.h"
 
+#define MAX_LOADED_MODULES 32
+
+static const char *loaded_modules[MAX_LOADED_MODULES];
+static unsigned int loaded_module_count;
+
 static int kconfig_skip_check(void)
 {
 	char *skipped = getenv("KCONFIG_SKIP_CHECK");
@@ -189,6 +196,36 @@ static void kconfig_module_check(struct tst_kconfig_var *var)
 	}
 }
 
+static void kconfig_module_record(struct tst_kconfig_var *var)
+{
+	unsigned int i;
+	const char *mod = NULL;
+
+	if (var->choice != 'm')
+		return;
+
+	for (i = 0; config_module_maps[i].config; i++) {
+		if (!strcmp(config_module_maps[i].config, var->id)) {
+			mod = config_module_maps[i].module_name;
+			break;
+		}
+	}
+
+	if (!mod)
+		return;
+
+	if (tst_module_is_loaded(mod))
+		return;
+
+	for (i = 0; i < loaded_module_count; i++) {
+		if (!strcmp(loaded_modules[i], mod))
+			return;
+	}
+
+	if (loaded_module_count < MAX_LOADED_MODULES)
+		loaded_modules[loaded_module_count++] = mod;
+}
+
 static inline int kconfig_parse_line(const char *line,
                                      struct tst_kconfig_var *vars,
                                      unsigned int vars_len)
@@ -268,6 +305,7 @@ out:
 				vars[i].choice = 'm';
 				kconfig_runtime_check(&vars[i]);
 				kconfig_module_check(&vars[i]);
+				kconfig_module_record(&vars[i]);
 				return 1;
 			}
 		}
@@ -300,6 +338,52 @@ exit:
 	close_kconfig(fp);
 }
 
+void tst_kconfig_module_load(void)
+{
+	unsigned int i;
+
+	if (geteuid() != 0)
+		return;
+
+	for (i = 0; i < loaded_module_count; i++) {
+		tst_res(TDEBUG, "Loading module '%s'", loaded_modules[i]);
+		tst_modprobe(loaded_modules[i], NULL);
+	}
+}
+
+void tst_kconfig_module_unload(void)
+{
+	char name[64], *p;
+
+	if (!loaded_module_count)
+		return;
+
+	while (loaded_module_count > 0) {
+		snprintf(name, sizeof(name), "%s",
+			 loaded_modules[--loaded_module_count]);
+
+		for (p = name; (p = strchr(p, '-')); )
+			*p = '_';
+
+		tst_res(TDEBUG, "Unloading module '%s'", name);
+
+		if (!syscall(__NR_delete_module, name, O_NONBLOCK))
+			continue;
+
+		switch (errno) {
+		case ENOENT:		/* already unloaded */
+		case EWOULDBLOCK:	/* in use */
+		case EBUSY:		/* still loading or unloading */
+		case ENOSYS:		/* no CONFIG_MODULE_UNLOAD */
+			break;
+		default:
+			tst_res(TWARN, "Failed to unload module '%s'", name);
+		}
+	}
+
+	loaded_module_count = 0;
+}
+
 static size_t array_len(const char *const kconfigs[])
 {
 	size_t i = 0;
diff --git a/lib/tst_test.c b/lib/tst_test.c
index 10ff73397..a9e679bee 100644
--- a/lib/tst_test.c
+++ b/lib/tst_test.c
@@ -1471,12 +1471,16 @@ static void do_setup(int argc, char *argv[])
 
 	check_supported_kver();
 
-	if (tst_test->needs_kconfigs && tst_kconfig_check(tst_test->needs_kconfigs))
-		tst_brk(TCONF, "Aborting due to unsuitable kernel config, see above!");
-
 	if (tst_test->needs_root && geteuid() != 0)
 		tst_brk(TCONF, "Test needs to be run as root");
 
+	if (tst_test->needs_kconfigs) {
+		if (tst_kconfig_check(tst_test->needs_kconfigs))
+			tst_brk(TCONF, "Aborting due to unsuitable kernel config, see above!");
+
+		tst_kconfig_module_load();
+	}
+
 	if (tst_test->min_kver)
 		check_kver(tst_test->min_kver, 1);
 
@@ -1690,6 +1694,9 @@ static void do_cleanup(void)
 	if (tst_test->restore_wallclock)
 		tst_wallclock_restore();
 
+	if (tst_test->needs_kconfigs)
+		tst_kconfig_module_unload();
+
 	cleanup_ipc();
 }
 
-- 
2.56.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v6 3/4] tst_kconfig: add module mappings for vsock/vsock_loopback

[Li Wang (Hieco)]

Map CONFIG_VSOCKETS to "vsock" and CONFIG_VSOCKETS_LOOPBACK to
"vsock_loopback" so tst_kconfig can load them on demand.

cve-2025-21756 binds to VMADDR_CID_LOCAL and therefore needs
vsock_loopback. Without the module loaded, bind() fails with
EADDRNOTAVAIL and the test aborts with TBROK. Declare both configs in
needs_kconfigs so the modules are loaded first.

The test needs root only to load the modules; the reproducer runs as
an ordinary non-root process in the initial namespace, where it can
use loopback VSOCK on non-privileged ports. Drop privileges to nobody
in setup() after the modules are loaded; the framework unloads the
modules from its still-root context, so no restore is needed in
cleanup().

Signed-off-by: Li Wang (Hieco) <li.wang@linux.dev>
---
 lib/tst_kconfig.c              |  2 ++
 testcases/cve/cve-2025-21756.c | 17 +++++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/lib/tst_kconfig.c b/lib/tst_kconfig.c
index a0985912c..dca7daec8 100644
--- a/lib/tst_kconfig.c
+++ b/lib/tst_kconfig.c
@@ -174,6 +174,8 @@ static struct config_module_map {
 	{"CONFIG_NET_ACT_PEDIT", "act_pedit"},
 	{"CONFIG_PKCS8_PRIVATE_KEY_PARSER", "pkcs8_key_parser"},
 	{"CONFIG_X509_CERTIFICATE_PARSER", "x509_key_parser"},
+	{"CONFIG_VSOCKETS", "vsock"},
+	{"CONFIG_VSOCKETS_LOOPBACK", "vsock_loopback"},
 	{}
 };
 
diff --git a/testcases/cve/cve-2025-21756.c b/testcases/cve/cve-2025-21756.c
index 4245a4c95..b49950045 100644
--- a/testcases/cve/cve-2025-21756.c
+++ b/testcases/cve/cve-2025-21756.c
@@ -13,12 +13,22 @@
  * Beware, this test will crash the system.
  */
 
+#include <pwd.h>
+
 #include "tst_test.h"
 #include "lapi/vm_sockets.h"
 
 #define MAX_PORT_RETRIES	24
 #define VMADDR_CID_NONEXISTING	42
 
+static void setup(void)
+{
+	struct passwd *pw = SAFE_GETPWNAM("nobody");
+
+	SAFE_SETEGID(pw->pw_gid);
+	SAFE_SETEUID(pw->pw_uid);
+}
+
 static int vsock_bind(unsigned int cid, unsigned int port, int type)
 {
 	int sock;
@@ -85,8 +95,15 @@ static void run(void)
 }
 
 static struct tst_test test = {
+	.needs_root = 1,
+	.setup = setup,
 	.test_all = run,
 	.taint_check = TST_TAINT_W | TST_TAINT_D,
+	.needs_kconfigs = (const char *const[]) {
+		"CONFIG_VSOCKETS",
+		"CONFIG_VSOCKETS_LOOPBACK",
+		NULL
+	},
 	.tags = (const struct tst_tag[]) {
 		{"linux-git", "fcdd2242c0231032fc84e1404315c245ae56322a"},
 		{"CVE", "2025-21756"},
-- 
2.56.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v6 4/4] testcases: drop manual tst_modprobe() now handled by tst_kconfig

[Li Wang (Hieco)]

Now that tst_kconfig loads the modules for every CONFIG_*=m entry
listed in config_module_maps[] and unloads them again at cleanup
time, tests no longer have to call tst_modprobe() from setup().

Drop the explicit tst_modprobe() calls, and the now unused
tst_module.h includes, from:

- cve-2026-46331.c: sch_ingress, cls_matchall, act_pedit
- sctphantom.c: sctp
- keyctl23.c: x509_key_parser
- keyctl29.c: x509_key_parser
- keyctl30.c: pkcs8_key_parser

All tests already declare the matching configs in .needs_kconfigs,
so tst_kconfig takes care of loading the modules before setup()
runs and unloading them once the test finishes.

BTW, with KCONFIG_SKIP_CHECK=1 the config check returns early,
so the automatic module loading is skipped as well. Users who set
that variable are expected to ensure the required modules are
loaded themselves.

Signed-off-by: Li Wang (Hieco) <li.wang@linux.dev>
---
 testcases/cve/cve-2026-46331.c              | 7 -------
 testcases/cve/sctphantom.c                  | 3 ---
 testcases/kernel/syscalls/keyctl/keyctl23.c | 6 ++----
 testcases/kernel/syscalls/keyctl/keyctl29.c | 3 ---
 testcases/kernel/syscalls/keyctl/keyctl30.c | 3 ---
 5 files changed, 2 insertions(+), 20 deletions(-)

diff --git a/testcases/cve/cve-2026-46331.c b/testcases/cve/cve-2026-46331.c
index 439b1280a..e5a81c833 100644
--- a/testcases/cve/cve-2026-46331.c
+++ b/testcases/cve/cve-2026-46331.c
@@ -44,7 +44,6 @@
 #include <linux/rtnetlink.h>
 
 #include "tst_test.h"
-#include "tst_module.h"
 #include "tst_net.h"
 #include "tst_netdevice.h"
 #include "lapi/if_ether.h"
@@ -136,12 +135,6 @@ static void setup(void)
 {
 	struct sockaddr_in addr;
 	struct passwd *pw;
-	static const char *const mods[] = {
-		"sch_ingress", "cls_matchall", "act_pedit"
-	};
-
-	for (unsigned int i = 0; i < ARRAY_SIZE(mods); i++)
-		tst_modprobe(mods[i], NULL);
 
 	/* Drop privileges so the reproducer runs as an unprivileged user */
 	pw = SAFE_GETPWNAM("nobody");
diff --git a/testcases/cve/sctphantom.c b/testcases/cve/sctphantom.c
index 83834b848..bdbe40286 100644
--- a/testcases/cve/sctphantom.c
+++ b/testcases/cve/sctphantom.c
@@ -50,7 +50,6 @@
  */
 
 #include "tst_test.h"
-#include "tst_module.h"
 #include "tst_checksum.h"
 #include "tst_safe_net.h"
 
@@ -205,8 +204,6 @@ static void setup(void)
 	};
 	const struct tst_path_val *sysctl;
 
-	tst_modprobe("sctp", NULL);
-
 	for (sysctl = sysctls; sysctl->path; sysctl++)
 		tst_sys_conf_save(sysctl);
 
diff --git a/testcases/kernel/syscalls/keyctl/keyctl23.c b/testcases/kernel/syscalls/keyctl/keyctl23.c
index cf90210d2..8d4d170f0 100644
--- a/testcases/kernel/syscalls/keyctl/keyctl23.c
+++ b/testcases/kernel/syscalls/keyctl/keyctl23.c
@@ -6,7 +6,8 @@
 /*\
  * Test ``KEYCTL_RESTRICT_KEYRING`` builtin_trusted of :manpage:`keyctl(2)`.
  *
- * Requires root (CAP_SYS_MODULE) to load the ``x509_key_parser`` module.
+ * * Requires root (CAP_SYS_MODULE) so that the test library can load the
+ * ``x509_key_parser`` module.
  *
  * [Algorithm]
  *
@@ -16,7 +17,6 @@
  */
 
 #include "keyctl_common.h"
-#include "tst_module.h"
 
 #define PAYLOAD		"payload"
 
@@ -89,8 +89,6 @@ static void setup(void)
 {
 	SAFE_KEYCTL(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
 
-	tst_modprobe("x509_key_parser", NULL);
-
 	ring_builtin = SAFE_NEW_RING("ltpkeyctl23_builtin");
 
 	user_key = SAFE_NEW_USER_KEY("k", PAYLOAD, sizeof(PAYLOAD),
diff --git a/testcases/kernel/syscalls/keyctl/keyctl29.c b/testcases/kernel/syscalls/keyctl/keyctl29.c
index afc0a093c..e66b39bcb 100644
--- a/testcases/kernel/syscalls/keyctl/keyctl29.c
+++ b/testcases/kernel/syscalls/keyctl/keyctl29.c
@@ -23,7 +23,6 @@
 
 #include "keyctl_common.h"
 #include "keyctl_pkey_data.h"
-#include "tst_module.h"
 
 static key_serial_t cert_key;
 static struct keyctl_pkey_query *query_buf;
@@ -32,8 +31,6 @@ static void setup(void)
 {
 	SAFE_KEYCTL(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
 
-	tst_modprobe("x509_key_parser", NULL);
-
 	cert_key = add_asymmetric_key_or_tconf("cert", rsa2048_cert,
 					       sizeof(rsa2048_cert),
 					       "CONFIG_X509_CERTIFICATE_PARSER");
diff --git a/testcases/kernel/syscalls/keyctl/keyctl30.c b/testcases/kernel/syscalls/keyctl/keyctl30.c
index ef51bba33..4f43007e0 100644
--- a/testcases/kernel/syscalls/keyctl/keyctl30.c
+++ b/testcases/kernel/syscalls/keyctl/keyctl30.c
@@ -20,7 +20,6 @@
 
 #include "keyctl_common.h"
 #include "keyctl_pkey_data.h"
-#include "tst_module.h"
 
 static key_serial_t priv_key;
 static struct keyctl_pkey_query *query_buf;
@@ -29,8 +28,6 @@ static void setup(void)
 {
 	SAFE_KEYCTL(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
 
-	tst_modprobe("pkcs8_key_parser", NULL);
-
 	priv_key = add_asymmetric_key_or_tconf("priv", rsa2048_pkcs8,
 					       sizeof(rsa2048_pkcs8),
 					       "CONFIG_PKCS8_PRIVATE_KEY_PARSER");
-- 
2.56.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] lib: add module is loaded check

[linuxtestproject.agent]

Hi Li,

On Mon Nov 2 10:43:25 2026 +0800, Li Wang (Hieco) <li.wang@linux.dev> wrote:
> lib: add module is loaded check

--- [PATCH 1/4] ---

> --- a/include/tst_module.h
> +++ b/include/tst_module.h
> @@ -49,5 +49,6 @@ static inline void tst_requires_module_signature_disabled(void)
>  
>  void tst_modprobe(const char *mod_name, char *const argv[]);
>  void tst_module_reload(const char *mod_name, char *const argv[]);
> +bool tst_module_is_loaded(const char *mod_name);

Add a kernel-doc comment (/** ... */) for tst_module_is_loaded() documenting
@mod_name and Return:.

--- [PATCH 2/4] ---

> +static void kconfig_module_record(struct tst_kconfig_var *var)
> +{
> +	unsigned int i;
> +	const char *mod = NULL;
> +
> +	if (var->choice != 'm')
> +		return;
> +
> +	for (i = 0; config_module_maps[i].config; i++) {
> +		if (!strcmp(config_module_maps[i].config, var->id)) {
> +			mod = config_module_maps[i].module_name;
> +			break;
> +		}
> +	}
> +
> +	if (!mod)
> +		return;
> +
> +	if (tst_module_is_loaded(mod))
> +		return;
> +
> +	for (i = 0; i < loaded_module_count; i++) {
> +		if (!strcmp(loaded_modules[i], mod))
> +			return;
> +	}
> +
> +	if (loaded_module_count < MAX_LOADED_MODULES)
> +		loaded_modules[loaded_module_count++] = mod;
> +}

Recording modules into loaded_modules[] inside kconfig_parse_line() happens
even when geteuid() != 0, when tst_kconfig_check() fails with TCONF (e.g.
CONFIG_X509_CERTIFICATE_PARSER=y on a =m kernel), or when tst_kconfig_read()
is called later during the test. Consequently, tst_kconfig_module_unload() in
do_cleanup() attempts to unload modules that were never loaded by
tst_kconfig_module_load(), and fails with EPERM (emitting a spurious TWARN)
when running unprivileged (such as vsock01). Only record modules in the
unload list when tst_kconfig_module_load() actually loads them.

> +		default:
> +			tst_res(TWARN, "Failed to unload module '%s'", name);
> +		}

Use TWARN | TERRNO so the failure reason from delete_module() is printed.

--- [PATCH 3/4] ---

>  static struct tst_test test = {
> +	.needs_root = 1,
> +	.setup = setup,
>  	.test_all = run,

Document why root is required (loading the vsock/vsock_loopback modules) in
the top-level /*\ ... */ test description block.

--- [PATCH 4/4] ---

>  /*\
>   * Test ``KEYCTL_RESTRICT_KEYRING`` builtin_trusted of :manpage:`keyctl(2)`.
>   *
> - * Requires root (CAP_SYS_MODULE) to load the ``x509_key_parser`` module.
> + * * Requires root (CAP_SYS_MODULE) so that the test library can load the
> + * ``x509_key_parser`` module.

Remove the extra asterisk in "* * Requires root", which creates a malformed
reST bullet item. Also update .needs_kconfigs in keyctl23.c from
"CONFIG_X509_CERTIFICATE_PARSER=y" to "CONFIG_X509_CERTIFICATE_PARSER",
otherwise tst_kconfig_check() aborts with TCONF on =m kernels instead of
loading x509_key_parser.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp