[LTP] [PATCH 0/3] tst_kconfig: automatic module load/unload for CONFIG_*=m

[LTP] [PATCH 0/3] tst_kconfig: automatic module load/unload for CONFIG_*=m

[Li Wang]

Tests that depend on a config set to =m currently load the module
themselves, and may fail with misleading errors when it is missing,
e.g. bind() returning EADDRNOTAVAIL for AF_VSOCK without vsock_loopback.

This series makes tst_kconfig record the module for every
config_module_maps[] entry seen as =m, load them once the kernel
config check passes, and unload them at cleanup time.

Li Wang (3):
  tst_kconfig: load and unload kernel modules for CONFIG_*=m
  tst_kconfig: add module mappings for vsock/vsock_loopback
  testcases: drop manual tst_modprobe() now handled by tst_kconfig

 include/tst_kconfig.h                       | 28 ++++++++
 lib/tst_kconfig.c                           | 72 +++++++++++++++++++++
 lib/tst_test.c                              |  4 ++
 testcases/cve/cve-2025-21756.c              |  6 ++
 testcases/cve/cve-2026-46331.c              |  7 --
 testcases/cve/sctphantom.c                  |  3 -
 testcases/kernel/syscalls/keyctl/keyctl29.c |  3 -
 testcases/kernel/syscalls/keyctl/keyctl30.c |  3 -
 8 files changed, 110 insertions(+), 16 deletions(-)

-- 
2.55.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH 1/3] tst_kconfig: load and unload kernel modules for CONFIG_*=m

[Li Wang]

Tests that depend on a config set to =m must currently load the
module themselves, and may fail with misleading errors when it is
not loaded, e.g. bind() returning EADDRNOTAVAIL for AF_VSOCK when
vsock_loopback is missing.

Record the module for every config_module_maps[] entry seen as =m
during kconfig_parse_line(), load them in
tst_kconfig_module_load() via tst_modprobe(), and unload them in
reverse order from tst_kconfig_module_unload_all(), called by
do_test_cleanup(). Modules still in use are skipped without
aborting the test.

Loading and unloading are performed only as root; otherwise the
recorded list is left untouched.

Signed-off-by: Li Wang <li.wang@linux.dev>
---
 include/tst_kconfig.h | 28 +++++++++++++++++
 lib/tst_kconfig.c     | 70 +++++++++++++++++++++++++++++++++++++++++++
 lib/tst_test.c        |  4 +++
 3 files changed, 102 insertions(+)

diff --git a/include/tst_kconfig.h b/include/tst_kconfig.h
index c454f3467..540ae369c 100644
--- a/include/tst_kconfig.h
+++ b/include/tst_kconfig.h
@@ -105,4 +105,32 @@ void tst_kcmdline_parse(struct tst_kcmdline_var params[], size_t params_len);
  */
 int tst_has_slow_kconfig(void);
 
+/*
+ * tst_kconfig_module_load() - Load kernel modules for CONFIG_*=m entries.
+ *
+ * Loads every module recorded during the last kernel config check, in
+ * the order they were discovered. The list is populated by
+ * kconfig_module_record() from kconfig_parse_line() for each CONFIG_*
+ * entry that is set to =m and has a matching entry in
+ * config_module_maps[].
+ *
+ * Loading is skipped when not running as root, and does nothing when
+ * the recorded list is empty.
+ */
+void tst_kconfig_module_load(void);
+
+/*
+ * tst_kconfig_module_unload_all() - Unload modules loaded by
+ *                                   tst_kconfig_module_load().
+ *
+ * Unloads every module recorded by tst_kconfig_module_load(), in
+ * reverse load order so that inter-module dependencies are respected.
+ * Modules still in use are skipped silently, leaving the system state
+ * as close as possible to what it was before the test started.
+ *
+ * Called from do_test_cleanup() so that the modules are released when
+ * the test finishes, regardless of the test result.
+ */
+void tst_kconfig_module_unload_all(void);
+
 #endif	/* TST_KCONFIG_H__ */
diff --git a/lib/tst_kconfig.c b/lib/tst_kconfig.c
index 49957e28d..7e3ee1fe8 100644
--- a/lib/tst_kconfig.c
+++ b/lib/tst_kconfig.c
@@ -16,8 +16,14 @@
 #include "tst_bool_expr.h"
 #include "tst_safe_stdio.h"
 
+#include "tst_module.h"
 #include "tst_kconfig_checks.h"
 
+#define MAX_LOADED_MODULES 16
+
+static const char *loaded_modules[MAX_LOADED_MODULES];
+static unsigned int loaded_module_count;
+
 static int kconfig_skip_check(void)
 {
 	char *skipped = getenv("KCONFIG_SKIP_CHECK");
@@ -189,6 +195,35 @@ static void kconfig_module_check(struct tst_kconfig_var *var)
 	}
 }
 
+static const char *module_name_for_config(const char *cfg)
+{
+	size_t i;
+
+	for (i = 0; config_module_maps[i].config; i++) {
+		if (!strcmp(config_module_maps[i].config, cfg))
+			return config_module_maps[i].module_name;
+	}
+
+	return NULL;
+}
+
+static void kconfig_module_record(const char *cfg)
+{
+	unsigned int i;
+	const char *mod = module_name_for_config(cfg);
+
+	if (!mod)
+		return;
+
+	for (i = 0; i < loaded_module_count; i++) {
+		if (!strcmp(loaded_modules[i], mod))
+			return;
+	}
+
+	if (loaded_module_count < MAX_LOADED_MODULES)
+		loaded_modules[loaded_module_count++] = mod;
+}
+
 static inline int kconfig_parse_line(const char *line,
                                      struct tst_kconfig_var *vars,
                                      unsigned int vars_len)
@@ -268,6 +303,8 @@ out:
 				vars[i].choice = 'm';
 				kconfig_runtime_check(&vars[i]);
 				kconfig_module_check(&vars[i]);
+				if (vars[i].choice == 'm')
+					kconfig_module_record(vars[i].id);
 				return 1;
 			}
 		}
@@ -300,6 +337,39 @@ exit:
 	close_kconfig(fp);
 }
 
+void tst_kconfig_module_load(void)
+{
+	unsigned int i;
+
+	if (geteuid() != 0)
+		return;
+
+	for (i = 0; i < loaded_module_count; i++) {
+		tst_res(TDEBUG, "Loading module '%s'", loaded_modules[i]);
+		tst_modprobe(loaded_modules[i], NULL);
+	}
+}
+
+void tst_kconfig_module_unload_all(void)
+{
+	unsigned int i;
+
+	if (!loaded_module_count)
+		return;
+
+	if (geteuid() != 0)
+		return;
+
+	for (i = loaded_module_count; i > 0; i--) {
+		const char *const argv[] = { "rmmod", loaded_modules[i - 1], NULL };
+
+		tst_res(TDEBUG, "Unloading module '%s'", loaded_modules[i - 1]);
+		tst_cmd(argv, "/dev/null", "/dev/null", TST_CMD_PASS_RETVAL);
+	}
+
+	loaded_module_count = 0;
+}
+
 static size_t array_len(const char *const kconfigs[])
 {
 	size_t i = 0;
diff --git a/lib/tst_test.c b/lib/tst_test.c
index 10ff73397..04a85a781 100644
--- a/lib/tst_test.c
+++ b/lib/tst_test.c
@@ -425,6 +425,7 @@ static void do_test_cleanup(void)
 		tst_test->cleanup();
 
 	tst_free_all();
+	tst_kconfig_module_unload_all();
 
 	tst_brk_handler = tst_vbrk_;
 }
@@ -1474,6 +1475,9 @@ static void do_setup(int argc, char *argv[])
 	if (tst_test->needs_kconfigs && tst_kconfig_check(tst_test->needs_kconfigs))
 		tst_brk(TCONF, "Aborting due to unsuitable kernel config, see above!");
 
+	if (tst_test->needs_kconfigs)
+		tst_kconfig_module_load();
+
 	if (tst_test->needs_root && geteuid() != 0)
 		tst_brk(TCONF, "Test needs to be run as root");
 
-- 
2.55.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH 2/3] tst_kconfig: add module mappings for vsock/vsock_loopback

[Li Wang]

Map CONFIG_VSOCKETS and CONFIG_VSOCKETS_LOOPBACK to their kernel
modules (vsock, vsock_loopback).

Signed-off-by: Li Wang <li.wang@linux.dev>
---
 lib/tst_kconfig.c              | 2 ++
 testcases/cve/cve-2025-21756.c | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/lib/tst_kconfig.c b/lib/tst_kconfig.c
index 7e3ee1fe8..17db9cd1a 100644
--- a/lib/tst_kconfig.c
+++ b/lib/tst_kconfig.c
@@ -173,6 +173,8 @@ static struct config_module_map {
 	{"CONFIG_NET_ACT_PEDIT", "act_pedit"},
 	{"CONFIG_PKCS8_PRIVATE_KEY_PARSER", "pkcs8_key_parser"},
 	{"CONFIG_X509_CERTIFICATE_PARSER", "x509_key_parser"},
+	{"CONFIG_VSOCKETS", "vsock"},
+	{"CONFIG_VSOCKETS_LOOPBACK", "vsock_loopback"},
 	{}
 };
 
diff --git a/testcases/cve/cve-2025-21756.c b/testcases/cve/cve-2025-21756.c
index 4245a4c95..1df8545c9 100644
--- a/testcases/cve/cve-2025-21756.c
+++ b/testcases/cve/cve-2025-21756.c
@@ -85,8 +85,14 @@ static void run(void)
 }
 
 static struct tst_test test = {
+	.needs_root = 1,
 	.test_all = run,
 	.taint_check = TST_TAINT_W | TST_TAINT_D,
+	.needs_kconfigs = (const char *const[]) {
+		"CONFIG_VSOCKETS",
+		"CONFIG_VSOCKETS_LOOPBACK",
+		NULL
+	},
 	.tags = (const struct tst_tag[]) {
 		{"linux-git", "fcdd2242c0231032fc84e1404315c245ae56322a"},
 		{"CVE", "2025-21756"},
-- 
2.55.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH 3/3] testcases: drop manual tst_modprobe() now handled by tst_kconfig

[Li Wang]

Now that tst_kconfig loads the modules for every CONFIG_*=m entry
listed in config_module_maps[] and unloads them again at cleanup
time, tests no longer have to call tst_modprobe() from setup().

Drop the explicit tst_modprobe() calls, and the now unused
tst_module.h includes, from:

- cve-2026-46331.c: sch_ingress, cls_matchall, act_pedit
- sctphantom.c: sctp
- keyctl29.c: x509_key_parser
- keyctl30.c: pkcs8_key_parser

All four tests already declare the matching configs in
.needs_kconfigs, so tst_kconfig takes care of loading the modules
before setup() runs and unloading them once the test finishes.

Signed-off-by: Li Wang <li.wang@linux.dev>
---
 testcases/cve/cve-2026-46331.c              | 7 -------
 testcases/cve/sctphantom.c                  | 3 ---
 testcases/kernel/syscalls/keyctl/keyctl29.c | 3 ---
 testcases/kernel/syscalls/keyctl/keyctl30.c | 3 ---
 4 files changed, 16 deletions(-)

diff --git a/testcases/cve/cve-2026-46331.c b/testcases/cve/cve-2026-46331.c
index 3d32a1cbb..3c8db5042 100644
--- a/testcases/cve/cve-2026-46331.c
+++ b/testcases/cve/cve-2026-46331.c
@@ -44,7 +44,6 @@
 #include <linux/rtnetlink.h>
 
 #include "tst_test.h"
-#include "tst_module.h"
 #include "tst_net.h"
 #include "tst_netdevice.h"
 #include "lapi/if_ether.h"
@@ -136,12 +135,6 @@ static void setup(void)
 {
 	struct sockaddr_in addr;
 	struct passwd *pw;
-	static const char *const mods[] = {
-		"sch_ingress", "cls_matchall", "act_pedit"
-	};
-
-	for (unsigned int i = 0; i < ARRAY_SIZE(mods); i++)
-		tst_modprobe(mods[i], NULL);
 
 	/* Drop privileges so the reproducer runs as an unprivileged user */
 	pw = SAFE_GETPWNAM("nobody");
diff --git a/testcases/cve/sctphantom.c b/testcases/cve/sctphantom.c
index 83834b848..bdbe40286 100644
--- a/testcases/cve/sctphantom.c
+++ b/testcases/cve/sctphantom.c
@@ -50,7 +50,6 @@
  */
 
 #include "tst_test.h"
-#include "tst_module.h"
 #include "tst_checksum.h"
 #include "tst_safe_net.h"
 
@@ -205,8 +204,6 @@ static void setup(void)
 	};
 	const struct tst_path_val *sysctl;
 
-	tst_modprobe("sctp", NULL);
-
 	for (sysctl = sysctls; sysctl->path; sysctl++)
 		tst_sys_conf_save(sysctl);
 
diff --git a/testcases/kernel/syscalls/keyctl/keyctl29.c b/testcases/kernel/syscalls/keyctl/keyctl29.c
index afc0a093c..e66b39bcb 100644
--- a/testcases/kernel/syscalls/keyctl/keyctl29.c
+++ b/testcases/kernel/syscalls/keyctl/keyctl29.c
@@ -23,7 +23,6 @@
 
 #include "keyctl_common.h"
 #include "keyctl_pkey_data.h"
-#include "tst_module.h"
 
 static key_serial_t cert_key;
 static struct keyctl_pkey_query *query_buf;
@@ -32,8 +31,6 @@ static void setup(void)
 {
 	SAFE_KEYCTL(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
 
-	tst_modprobe("x509_key_parser", NULL);
-
 	cert_key = add_asymmetric_key_or_tconf("cert", rsa2048_cert,
 					       sizeof(rsa2048_cert),
 					       "CONFIG_X509_CERTIFICATE_PARSER");
diff --git a/testcases/kernel/syscalls/keyctl/keyctl30.c b/testcases/kernel/syscalls/keyctl/keyctl30.c
index ef51bba33..4f43007e0 100644
--- a/testcases/kernel/syscalls/keyctl/keyctl30.c
+++ b/testcases/kernel/syscalls/keyctl/keyctl30.c
@@ -20,7 +20,6 @@
 
 #include "keyctl_common.h"
 #include "keyctl_pkey_data.h"
-#include "tst_module.h"
 
 static key_serial_t priv_key;
 static struct keyctl_pkey_query *query_buf;
@@ -29,8 +28,6 @@ static void setup(void)
 {
 	SAFE_KEYCTL(KEYCTL_JOIN_SESSION_KEYRING, 0, 0, 0, 0);
 
-	tst_modprobe("pkcs8_key_parser", NULL);
-
 	priv_key = add_asymmetric_key_or_tconf("priv", rsa2048_pkcs8,
 					       sizeof(rsa2048_pkcs8),
 					       "CONFIG_PKCS8_PRIVATE_KEY_PARSER");
-- 
2.55.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] tst_kconfig: load and unload kernel modules for CONFIG_*=m

[linuxtestproject.agent]

Hi Li,

On Wed, 7 Oct 2026, Li Wang wrote:
> tst_kconfig: load and unload kernel modules for CONFIG_*=m

--- [PATCH 1/3] ---

> diff --git a/lib/tst_kconfig.c b/lib/tst_kconfig.c
> +	if (loaded_module_count < MAX_LOADED_MODULES)
> +		loaded_modules[loaded_module_count++] = mod;

High: This records config matches, not modules newly loaded by the test,
so cleanup can remove an unused module that was already loaded beforehand.
A read-only tst_kconfig_read() during a callback also adds unload targets
without loading them. Separate config discovery from ownership tracking
and unload only modules successfully added by this test.

> diff --git a/lib/tst_test.c b/lib/tst_test.c
> +	tst_kconfig_module_unload_all();

High: Loading happens once in the library parent, but this cleanup runs
in each test child. Setup aborts and killed children leak modules, later
variants can lose modules removed by the first child, and cve-2026-46331
cannot unload after dropping initial-user-namespace privileges. Move
unloading to parent do_cleanup(), after all variants and resource teardown.

> diff --git a/lib/tst_kconfig.c b/lib/tst_kconfig.c
> +		tst_modprobe(loaded_modules[i], NULL);
> +		const char *const argv[] = { "rmmod", loaded_modules[i - 1], NULL };

Medium: modprobe also inserts dependencies that this list never records;
with both initially absent, loading can-raw inserts can, but cleanup only
removes can-raw and leaves can loaded. Track newly inserted dependencies
relative to the initial module state and remove owned modules in
dependency order.

> diff --git a/include/tst_kconfig.h b/include/tst_kconfig.h
> +/*
> + * tst_kconfig_module_load() - Load kernel modules for CONFIG_*=m entries.

Low: Both new public API comments use /* rather than /** and are omitted
from the generated kernel-doc reference. Use kernel-doc comment openers
for both declarations.

--- [PATCH 2/3] ---

> Map CONFIG_VSOCKETS and CONFIG_VSOCKETS_LOOPBACK to their kernel
> modules (vsock, vsock_loopback).

Low: The body only restates the mappings and does not explain the new
config and privilege gates in cve-2025-21756. Explain the missing-loopback
bind failure and why the test now requires root.

> diff --git a/testcases/cve/cve-2025-21756.c b/testcases/cve/cve-2025-21756.c
> +	.needs_root = 1,

Low: Document this new root requirement in the test's high-level
description, identifying module loading as the privileged operation.

--- [PATCH 3/3] ---

> diff --git a/testcases/kernel/syscalls/keyctl/keyctl29.c b/testcases/kernel/syscalls/keyctl/keyctl29.c
> -	tst_modprobe("x509_key_parser", NULL);
> diff --git a/testcases/kernel/syscalls/keyctl/keyctl30.c b/testcases/kernel/syscalls/keyctl/keyctl30.c
> -	tst_modprobe("pkcs8_key_parser", NULL);

Medium: With KCONFIG_SKIP_CHECK=1, tst_kconfig_check() returns before
recording modules, leaving these removed loads without a replacement.
When parser modules are installed but unloaded, keyctl29/keyctl30 now
skip with EBADMSG instead of executing their checks. Preserve module
setup independently of config validation, or retain the explicit loads.

Verdict - Needs revision

Pre-existing issue (not introduced by this series):

Medium: sctphantom saves its SCTP sysctls in the test child's private
tst_sys_conf list, but only the library parent calls tst_sys_conf_restore()
and cannot see those saved values. Use parent-side .save_restore after
module loading, or explicitly restore them in the test child's cleanup.

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] tst_kconfig: load and unload kernel modules for CONFIG_*=m

[Li Wang]

On Wed, Oct 07, 2026 at 02:17:58PM +0000, linuxtestproject.agent@gmail.com wrote:
> Hi Li,
> 
> On Wed, 7 Oct 2026, Li Wang wrote:
> > tst_kconfig: load and unload kernel modules for CONFIG_*=m
> 
> --- [PATCH 1/3] ---
> 
> > diff --git a/lib/tst_kconfig.c b/lib/tst_kconfig.c
> > +	if (loaded_module_count < MAX_LOADED_MODULES)
> > +		loaded_modules[loaded_module_count++] = mod;
> 
> High: This records config matches, not modules newly loaded by the test,
> so cleanup can remove an unused module that was already loaded beforehand.
> A read-only tst_kconfig_read() during a callback also adds unload targets
> without loading them. Separate config discovery from ownership tracking
> and unload only modules successfully added by this test.

Good point, will fix it in v2.

> 
> > diff --git a/lib/tst_test.c b/lib/tst_test.c
> > +	tst_kconfig_module_unload_all();
> 
> High: Loading happens once in the library parent, but this cleanup runs
> in each test child. Setup aborts and killed children leak modules, later
> variants can lose modules removed by the first child, and cve-2026-46331
> cannot unload after dropping initial-user-namespace privileges. Move
> unloading to parent do_cleanup(), after all variants and resource teardown.

Agreed.

> 
> > diff --git a/lib/tst_kconfig.c b/lib/tst_kconfig.c
> > +		tst_modprobe(loaded_modules[i], NULL);
> > +		const char *const argv[] = { "rmmod", loaded_modules[i - 1], NULL };
> 
> Medium: modprobe also inserts dependencies that this list never records;
> with both initially absent, loading can-raw inserts can, but cleanup only
> removes can-raw and leaves can loaded. Track newly inserted dependencies
> relative to the initial module state and remove owned modules in
> dependency order.
> 
> > diff --git a/include/tst_kconfig.h b/include/tst_kconfig.h
> > +/*
> > + * tst_kconfig_module_load() - Load kernel modules for CONFIG_*=m entries.
> 
> Low: Both new public API comments use /* rather than /** and are omitted
> from the generated kernel-doc reference. Use kernel-doc comment openers
> for both declarations.

+1

> 
> --- [PATCH 2/3] ---
> 
> > Map CONFIG_VSOCKETS and CONFIG_VSOCKETS_LOOPBACK to their kernel
> > modules (vsock, vsock_loopback).
> 
> Low: The body only restates the mappings and does not explain the new
> config and privilege gates in cve-2025-21756. Explain the missing-loopback
> bind failure and why the test now requires root.

Will add the note in v2.

> 
> > diff --git a/testcases/cve/cve-2025-21756.c b/testcases/cve/cve-2025-21756.c
> > +	.needs_root = 1,
> 
> Low: Document this new root requirement in the test's high-level
> description, identifying module loading as the privileged operation.

Sure.

> 
> --- [PATCH 3/3] ---
> 
> > diff --git a/testcases/kernel/syscalls/keyctl/keyctl29.c b/testcases/kernel/syscalls/keyctl/keyctl29.c
> > -	tst_modprobe("x509_key_parser", NULL);
> > diff --git a/testcases/kernel/syscalls/keyctl/keyctl30.c b/testcases/kernel/syscalls/keyctl/keyctl30.c
> > -	tst_modprobe("pkcs8_key_parser", NULL);
> 
> Medium: With KCONFIG_SKIP_CHECK=1, tst_kconfig_check() returns before
> recording modules, leaving these removed loads without a replacement.
> When parser modules are installed but unloaded, keyctl29/keyctl30 now
> skip with EBADMSG instead of executing their checks. Preserve module
> setup independently of config validation, or retain the explicit loads.

With KCONFIG_SKIP_CHECK=1 the config check returns early and the
automatic module loading is skipped as well. However, I consider
that the intended behaviour rather than a regression.

KCONFIG_SKIP_CHECK=1 is an explicit opt-out from the kernel config
check. Loading the modules depends on the result of that check: the
list of modules is built by kconfig_parse_line() while parsing the
config, and with the check skipped that parsing never happens. To
load the modules anyway we would have to either re-parse the config,
which contradicts the whole point of skipping it, or hardcode the
module list, which would duplicate config_module_maps[].

So skipping the automatic load together with the config check keeps
the semantics consistent: KCONFIG_SKIP_CHECK=1 skips everything that
depends on the config check, and users who set it are expected to
make sure the modules their tests need are already loaded.

The affected tests are still executed normally when the config check
runs, which is the default. I've added a note to the commit message
to make the KCONFIG_SKIP_CHECK=1 behaviour explicit.


-- 
Regards,
Li Wang

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp