* [LTP] [PATCH] cve-2026-46331: fix intermittent ENOENT failure
@ 2026-07-17 13:21 Andrea Cervesato
2026-07-20 7:53 ` Sebastian Chlad
2026-07-20 11:02 ` Cyril Hrubis
0 siblings, 2 replies; 4+ messages in thread
From: Andrea Cervesato @ 2026-07-17 13:21 UTC (permalink / raw)
To: Linux Test Project
From: Andrea Cervesato <andrea.cervesato@suse.com>
The required qdisc, classifier and action modules cannot be
autoloaded from the unprivileged user namespace, so arming the
traffic filter sometimes failed with ENOENT.
Preload the modules as root before dropping privileges and entering
the network namespace.
Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
tst_kconfig.c:90: TINFO: Parsing kernel config '/proc/config.gz'
tst_kconfig.c:755: TINFO: CONFIG_FAULT_INJECTION kernel option detected which might slow the execution
tst_test.c:1872: TINFO: Overall timeout per run is 0h 02m 00s
cve-2026-46331.c:200: TBROK: Failed to modify traffic filter: ENOENT
HINT: You _MAY_ be missing kernel fixes:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=899ee91156e5
HINT: You _MAY_ be vulnerable to CVE(s):
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331
---
testcases/cve/cve-2026-46331.c | 33 ++++++++++++++++++++++++++++++++-
1 file changed, 32 insertions(+), 1 deletion(-)
diff --git a/testcases/cve/cve-2026-46331.c b/testcases/cve/cve-2026-46331.c
index c33d358396f21024d8a68e9cd5c4cae0a9339a9f..dd19860e1d35152547e933850d7b8c91281240c4 100644
--- a/testcases/cve/cve-2026-46331.c
+++ b/testcases/cve/cve-2026-46331.c
@@ -35,6 +35,8 @@
*/
#include <sys/sendfile.h>
+#include <sys/prctl.h>
+#include <pwd.h>
#include <linux/rtnetlink.h>
#include "tst_test.h"
@@ -128,7 +130,31 @@ static int acc_fd = -1;
static void setup(void)
{
struct sockaddr_in addr;
- int i;
+ struct passwd *pw;
+ static const char *const mods[] = {
+ "sch_ingress", "cls_matchall", "act_pedit"
+ };
+ static const char *cmd[] = {"modprobe", NULL, NULL};
+ unsigned int i;
+
+ for (i = 0; i < ARRAY_SIZE(mods); i++) {
+ cmd[1] = mods[i];
+
+ if (tst_cmd(cmd, NULL, "/dev/null", TST_CMD_PASS_RETVAL))
+ tst_brk(TCONF, "kernel module %s is not available", mods[i]);
+ }
+
+ /* Drop privileges so the reproducer runs as an unprivileged user */
+ pw = SAFE_GETPWNAM("nobody");
+ SAFE_SETGID(pw->pw_gid);
+ SAFE_SETUID(pw->pw_uid);
+
+ /*
+ * setuid() clears the dumpable flag, which makes /proc/self/*
+ * owned by root and prevents tst_setup_netns() from writing the
+ * uid/gid maps. Restore it so the user namespace can be set up.
+ */
+ SAFE_PRCTL(PR_SET_DUMPABLE, 1, 0, 0, 0);
tst_setup_netns();
NETDEV_SET_STATE("lo", 1);
@@ -253,7 +279,12 @@ static struct tst_test test = {
.test_all = run,
.setup = setup,
.cleanup = cleanup,
+ .needs_root = 1,
.needs_tmpdir = 1,
+ .needs_cmds = (struct tst_cmd[]) {
+ {.cmd = "modprobe"},
+ {}
+ },
.needs_kconfigs = (const char *[]) {
"CONFIG_USER_NS=y",
"CONFIG_NET_NS=y",
---
base-commit: a67fe5f7b20492ff6ee7f4b1776a7579d4b3859b
change-id: 20260717-fix_cve-2026-46331_enoent-9b9254da578e
Best regards,
--
Andrea Cervesato <andrea.cervesato@suse.com>
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [LTP] [PATCH] cve-2026-46331: fix intermittent ENOENT failure
2026-07-17 13:21 [LTP] [PATCH] cve-2026-46331: fix intermittent ENOENT failure Andrea Cervesato
@ 2026-07-20 7:53 ` Sebastian Chlad
2026-07-20 11:02 ` Cyril Hrubis
1 sibling, 0 replies; 4+ messages in thread
From: Sebastian Chlad @ 2026-07-20 7:53 UTC (permalink / raw)
To: Andrea Cervesato; +Cc: Linux Test Project
Hi Andrea,
the rules say: "rules/ground-rules.md:If root is required, the reason MUST
be documented in the test's doc comment." Maybe worth adding?
Besides the subject says: "fix intermittent ENOENT failure". From your
patch it seems there is nothing intermittent about this behaviour.
I think commit subject should be amended to provide more accurate
description.
On Fri, 17 Jul 2026 at 15:21, Andrea Cervesato <andrea.cervesato@suse.de>
wrote:
> From: Andrea Cervesato <andrea.cervesato@suse.com>
>
> The required qdisc, classifier and action modules cannot be
> autoloaded from the unprivileged user namespace, so arming the
> traffic filter sometimes failed with ENOENT.
>
> Preload the modules as root before dropping privileges and entering
> the network namespace.
>
> Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
> ---
> tst_kconfig.c:90: TINFO: Parsing kernel config '/proc/config.gz'
> tst_kconfig.c:755: TINFO: CONFIG_FAULT_INJECTION kernel option detected
> which might slow the execution
> tst_test.c:1872: TINFO: Overall timeout per run is 0h 02m 00s
> cve-2026-46331.c:200: TBROK: Failed to modify traffic filter: ENOENT
>
> HINT: You _MAY_ be missing kernel fixes:
>
>
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=899ee91156e5
>
> HINT: You _MAY_ be vulnerable to CVE(s):
>
> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331
> ---
> testcases/cve/cve-2026-46331.c | 33 ++++++++++++++++++++++++++++++++-
> 1 file changed, 32 insertions(+), 1 deletion(-)
>
> diff --git a/testcases/cve/cve-2026-46331.c
> b/testcases/cve/cve-2026-46331.c
> index
> c33d358396f21024d8a68e9cd5c4cae0a9339a9f..dd19860e1d35152547e933850d7b8c91281240c4
> 100644
> --- a/testcases/cve/cve-2026-46331.c
> +++ b/testcases/cve/cve-2026-46331.c
> @@ -35,6 +35,8 @@
> */
>
> #include <sys/sendfile.h>
> +#include <sys/prctl.h>
> +#include <pwd.h>
> #include <linux/rtnetlink.h>
>
> #include "tst_test.h"
> @@ -128,7 +130,31 @@ static int acc_fd = -1;
> static void setup(void)
> {
> struct sockaddr_in addr;
> - int i;
> + struct passwd *pw;
> + static const char *const mods[] = {
> + "sch_ingress", "cls_matchall", "act_pedit"
> + };
> + static const char *cmd[] = {"modprobe", NULL, NULL};
> + unsigned int i;
> +
> + for (i = 0; i < ARRAY_SIZE(mods); i++) {
> + cmd[1] = mods[i];
> +
> + if (tst_cmd(cmd, NULL, "/dev/null", TST_CMD_PASS_RETVAL))
> + tst_brk(TCONF, "kernel module %s is not
> available", mods[i]);
> + }
> +
> + /* Drop privileges so the reproducer runs as an unprivileged user
> */
> + pw = SAFE_GETPWNAM("nobody");
> + SAFE_SETGID(pw->pw_gid);
> + SAFE_SETUID(pw->pw_uid);
> +
> + /*
> + * setuid() clears the dumpable flag, which makes /proc/self/*
> + * owned by root and prevents tst_setup_netns() from writing the
> + * uid/gid maps. Restore it so the user namespace can be set up.
> + */
> + SAFE_PRCTL(PR_SET_DUMPABLE, 1, 0, 0, 0);
>
> tst_setup_netns();
> NETDEV_SET_STATE("lo", 1);
> @@ -253,7 +279,12 @@ static struct tst_test test = {
> .test_all = run,
> .setup = setup,
> .cleanup = cleanup,
> + .needs_root = 1,
> .needs_tmpdir = 1,
> + .needs_cmds = (struct tst_cmd[]) {
> + {.cmd = "modprobe"},
> + {}
> + },
> .needs_kconfigs = (const char *[]) {
> "CONFIG_USER_NS=y",
> "CONFIG_NET_NS=y",
>
> ---
> base-commit: a67fe5f7b20492ff6ee7f4b1776a7579d4b3859b
> change-id: 20260717-fix_cve-2026-46331_enoent-9b9254da578e
>
Otherwise lgtm.
>
> Best regards,
> --
> Andrea Cervesato <andrea.cervesato@suse.com>
>
>
> --
> Mailing list info: https://lists.linux.it/listinfo/ltp
>
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [LTP] [PATCH] cve-2026-46331: fix intermittent ENOENT failure
2026-07-17 13:21 [LTP] [PATCH] cve-2026-46331: fix intermittent ENOENT failure Andrea Cervesato
2026-07-20 7:53 ` Sebastian Chlad
@ 2026-07-20 11:02 ` Cyril Hrubis
2026-07-20 12:06 ` Andrea Cervesato via ltp
1 sibling, 1 reply; 4+ messages in thread
From: Cyril Hrubis @ 2026-07-20 11:02 UTC (permalink / raw)
To: Andrea Cervesato; +Cc: Linux Test Project
Hi!
> #include <sys/sendfile.h>
> +#include <sys/prctl.h>
> +#include <pwd.h>
> #include <linux/rtnetlink.h>
>
> #include "tst_test.h"
> @@ -128,7 +130,31 @@ static int acc_fd = -1;
> static void setup(void)
> {
> struct sockaddr_in addr;
> - int i;
> + struct passwd *pw;
> + static const char *const mods[] = {
> + "sch_ingress", "cls_matchall", "act_pedit"
> + };
> + static const char *cmd[] = {"modprobe", NULL, NULL};
> + unsigned int i;
> +
> + for (i = 0; i < ARRAY_SIZE(mods); i++) {
> + cmd[1] = mods[i];
> +
> + if (tst_cmd(cmd, NULL, "/dev/null", TST_CMD_PASS_RETVAL))
> + tst_brk(TCONF, "kernel module %s is not available", mods[i]);
> + }
We do have tst_module_load().
> + /* Drop privileges so the reproducer runs as an unprivileged user */
> + pw = SAFE_GETPWNAM("nobody");
> + SAFE_SETGID(pw->pw_gid);
> + SAFE_SETUID(pw->pw_uid);
> +
> + /*
> + * setuid() clears the dumpable flag, which makes /proc/self/*
> + * owned by root and prevents tst_setup_netns() from writing the
> + * uid/gid maps. Restore it so the user namespace can be set up.
> + */
> + SAFE_PRCTL(PR_SET_DUMPABLE, 1, 0, 0, 0);
>
> tst_setup_netns();
> NETDEV_SET_STATE("lo", 1);
> @@ -253,7 +279,12 @@ static struct tst_test test = {
> .test_all = run,
> .setup = setup,
> .cleanup = cleanup,
> + .needs_root = 1,
> .needs_tmpdir = 1,
> + .needs_cmds = (struct tst_cmd[]) {
> + {.cmd = "modprobe"},
> + {}
> + },
> .needs_kconfigs = (const char *[]) {
> "CONFIG_USER_NS=y",
> "CONFIG_NET_NS=y",
The check for the module existence should be done by adding:
"CONFIG_NET_SCH_INGRESS",
"CONFIG_NET_CLS_MATCHALL",
"CONFIG_NET_ACT_PEDIT",
to the needs_kconfigs.
And then adding module mappings to tst_kconfig.c
diff --git a/lib/tst_kconfig.c b/lib/tst_kconfig.c
index 44eacc7c2..277ac6068 100644
--- a/lib/tst_kconfig.c
+++ b/lib/tst_kconfig.c
@@ -162,6 +162,9 @@ static struct config_module_map {
{"CONFIG_CAN_RAW", "can-raw"},
{"CONFIG_CAN_BCM", "can-bcm"},
{"CONFIG_IP_SCTP", "sctp"},
+ {"CONFIG_NET_SCH_INGRESS", "sch_ingress"},
+ {"CONFIG_NET_CLS_MATCHALL", "cls_matchall"},
+ {"CONFIG_NET_ACT_PEDIT", "act_pedit"},
{}
};
With that the checks will be done in the test library even before the
test is started.
We may also add a flag to tst_test structure to load the modules mapped
to the config variables, something as .kconfig_load.
--
Cyril Hrubis
chrubis@suse.cz
--
Mailing list info: https://lists.linux.it/listinfo/ltp
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-07-20 12:06 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-17 13:21 [LTP] [PATCH] cve-2026-46331: fix intermittent ENOENT failure Andrea Cervesato
2026-07-20 7:53 ` Sebastian Chlad
2026-07-20 11:02 ` Cyril Hrubis
2026-07-20 12:06 ` Andrea Cervesato via ltp
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.