[LTP] [PATCH v1] accept03/tst_fd: Harden parallel runs against shared path races

[LTP] [PATCH v1] accept03/tst_fd: Harden parallel runs against shared path races

[Stephen Bertram via ltp]

From: Stephen Bertram <sbertram@redhat.com>

Concurrent syscall runs can TBROK in tst_fd when multiple processes
race on fixed fd_file/fd_dir names (unlink ENOENT). Use pid-unique
paths with O_EXCL, distinct names for the file and O_PATH cases, and
give accept03 a private tmpdir.

Signed-off-by: Stephen Bertram <sbertram@redhat.com>
---
 lib/tst_fd.c                                | 29 +++++++++++++++------
 testcases/kernel/syscalls/accept/accept03.c |  1 +
 2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/lib/tst_fd.c b/lib/tst_fd.c
index 6538a098c..5d4430cf8 100644
--- a/lib/tst_fd.c
+++ b/lib/tst_fd.c
@@ -30,29 +30,42 @@ struct tst_fd_desc {
 	const char *desc;
 };
 
+static void fd_path(char *buf, size_t len, const char *prefix)
+{
+	snprintf(buf, len, "%s_%d", prefix, getpid());
+}
+
 static void open_file(struct tst_fd *fd)
 {
-	fd->fd = SAFE_OPEN("fd_file", O_RDWR | O_CREAT, 0666);
-	SAFE_UNLINK("fd_file");
+	char path[64];
+
+	fd_path(path, sizeof(path), "fd_file");
+	fd->fd = SAFE_OPEN(path, O_RDWR | O_CREAT | O_EXCL, 0666);
+	SAFE_UNLINK(path);
 }
 
 static void open_path(struct tst_fd *fd)
 {
+	char path[64];
 	int tfd;
 
-	tfd = SAFE_CREAT("fd_file", 0666);
+	fd_path(path, sizeof(path), "fd_path");
+	tfd = SAFE_OPEN(path, O_RDWR | O_CREAT | O_EXCL, 0666);
 	SAFE_CLOSE(tfd);
 
-	fd->fd = SAFE_OPEN("fd_file", O_PATH);
+	fd->fd = SAFE_OPEN(path, O_PATH);
 
-	SAFE_UNLINK("fd_file");
+	SAFE_UNLINK(path);
 }
 
 static void open_dir(struct tst_fd *fd)
 {
-	SAFE_MKDIR("fd_dir", 0700);
-	fd->fd = SAFE_OPEN("fd_dir", O_DIRECTORY);
-	SAFE_RMDIR("fd_dir");
+	char path[64];
+
+	fd_path(path, sizeof(path), "fd_dir");
+	SAFE_MKDIR(path, 0700);
+	fd->fd = SAFE_OPEN(path, O_DIRECTORY);
+	SAFE_RMDIR(path);
 }
 
 static void open_dev_zero(struct tst_fd *fd)
diff --git a/testcases/kernel/syscalls/accept/accept03.c b/testcases/kernel/syscalls/accept/accept03.c
index bc472397d..dea4988cf 100644
--- a/testcases/kernel/syscalls/accept/accept03.c
+++ b/testcases/kernel/syscalls/accept/accept03.c
@@ -55,4 +55,5 @@ static void verify_accept(void)
 
 static struct tst_test test = {
 	.test_all = verify_accept,
+	.needs_tmpdir = 1,
 };
-- 
2.55.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v1] accept03/tst_fd: Harden parallel runs against shared path races

[Cyril Hrubis]

Hi!
> Concurrent syscall runs can TBROK in tst_fd when multiple processes
> race on fixed fd_file/fd_dir names (unlink ENOENT). Use pid-unique
> paths with O_EXCL, distinct names for the file and O_PATH cases, and
> give accept03 a private tmpdir.

If we give the tests private tmpdir we do not need the pid unique
filenames. There is no point in doing both.

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2] accept03/tst_fd: Harden parallel runs against shared path races

[Stephen Bertram via ltp]

From: Stephen Bertram <sbertram@redhat.com>

Concurrent syscall runs can TBROK in tst_fd when multiple processes
race on fixed fd_file/fd_dir names (unlink ENOENT). Use pid-unique
paths with O_EXCL, distinct names for the file and O_PATH cases.

This covers accept03, epoll_pwait06, ioctl_pidfd01, and splice07,
which call TST_FD_FOREACH without a private tmpdir.

Signed-off-by: Stephen Bertram <sbertram@redhat.com>
---
 lib/tst_fd.c | 29 +++++++++++++++++++++--------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/lib/tst_fd.c b/lib/tst_fd.c
index 6538a098c..5d4430cf8 100644
--- a/lib/tst_fd.c
+++ b/lib/tst_fd.c
@@ -30,29 +30,42 @@ struct tst_fd_desc {
 	const char *desc;
 };
 
+static void fd_path(char *buf, size_t len, const char *prefix)
+{
+	snprintf(buf, len, "%s_%d", prefix, getpid());
+}
+
 static void open_file(struct tst_fd *fd)
 {
-	fd->fd = SAFE_OPEN("fd_file", O_RDWR | O_CREAT, 0666);
-	SAFE_UNLINK("fd_file");
+	char path[64];
+
+	fd_path(path, sizeof(path), "fd_file");
+	fd->fd = SAFE_OPEN(path, O_RDWR | O_CREAT | O_EXCL, 0666);
+	SAFE_UNLINK(path);
 }
 
 static void open_path(struct tst_fd *fd)
 {
+	char path[64];
 	int tfd;
 
-	tfd = SAFE_CREAT("fd_file", 0666);
+	fd_path(path, sizeof(path), "fd_path");
+	tfd = SAFE_OPEN(path, O_RDWR | O_CREAT | O_EXCL, 0666);
 	SAFE_CLOSE(tfd);
 
-	fd->fd = SAFE_OPEN("fd_file", O_PATH);
+	fd->fd = SAFE_OPEN(path, O_PATH);
 
-	SAFE_UNLINK("fd_file");
+	SAFE_UNLINK(path);
 }
 
 static void open_dir(struct tst_fd *fd)
 {
-	SAFE_MKDIR("fd_dir", 0700);
-	fd->fd = SAFE_OPEN("fd_dir", O_DIRECTORY);
-	SAFE_RMDIR("fd_dir");
+	char path[64];
+
+	fd_path(path, sizeof(path), "fd_dir");
+	SAFE_MKDIR(path, 0700);
+	fd->fd = SAFE_OPEN(path, O_DIRECTORY);
+	SAFE_RMDIR(path);
 }
 
 static void open_dev_zero(struct tst_fd *fd)
-- 
2.55.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v2] accept03/tst_fd: Harden parallel runs against

[Petr Vorel]

> Concurrent syscall runs can TBROK in tst_fd when multiple processes
> race on fixed fd_file/fd_dir names (unlink ENOENT). Use pid-unique
> paths with O_EXCL, distinct names for the file and O_PATH cases.
> 
> This covers accept03, epoll_pwait06, ioctl_pidfd01, and splice07,
> which call TST_FD_FOREACH without a private tmpdir.

While this is smart (no more tests will have bug due missing .needs_tmpdir = 1),
I'm not sure if it's a good idea. There is a reason why we have .needs_tmpdir,
e.g. CWD is read-only, no cleanup of created files, etc.

That's why I'd prefer to fix the 3 tests (add .needs_tmpdir) and then:

1) either add a check for missing .needs_tmpdir for these functions (patch
below) or
2) enable temporary directory creation for each test (slower, but no need to
ever worry).

The approach bellow is not ideal, because it covers only this case.
But adding check to safe_open() (and other functions) would have to check if the
path is relative or not, for which I would not bloat the library code.

Therefore I sent a patch checking this via sparse ('make check'):

https://lore.kernel.org/ltp/20261104182800.421758-1-pvorel@suse.cz/T/#u

Kind regards,
Petr

commit fa68043e5948ff1b8cb2c647d309ccf4808e23d7
Author: Petr Vorel <pvorel@suse.cz>
Date:   2026-11-04 18:34:06 +0100

    tst_fd: Add check for missing .needs_tmpdir

    Signed-off-by: Petr Vorel <pvorel@suse.cz>

diff --git lib/tst_fd.c lib/tst_fd.c
index 6538a098c7..05e1bbe8b0 100644
--- lib/tst_fd.c
+++ lib/tst_fd.c
@@ -22,6 +22,8 @@
 #include "lapi/bpf.h"
 #include "lapi/fsmount.h"
 
+#include "tso_tmpdir.h"
+
 #include "tst_fd.h"
 
 struct tst_fd_desc {
@@ -30,8 +32,17 @@ struct tst_fd_desc {
 	const char *desc;
 };
 
+static void require_tmpdir(struct tst_fd *fd)
+{
+	if (!tst_tmpdir_created()) {
+		tst_brk(TBROK, "%s fd requires .needs_tmpdir = 1",
+			tst_fd_desc(fd));
+	}
+}
+
 static void open_file(struct tst_fd *fd)
 {
+	require_tmpdir(fd);
 	fd->fd = SAFE_OPEN("fd_file", O_RDWR | O_CREAT, 0666);
 	SAFE_UNLINK("fd_file");
 }
@@ -40,6 +51,7 @@ static void open_path(struct tst_fd *fd)
 {
 	int tfd;
 
+	require_tmpdir(fd);
 	tfd = SAFE_CREAT("fd_file", 0666);
 	SAFE_CLOSE(tfd);
 
@@ -50,6 +62,7 @@ static void open_path(struct tst_fd *fd)
 
 static void open_dir(struct tst_fd *fd)
 {
+	require_tmpdir(fd);
 	SAFE_MKDIR("fd_dir", 0700);
 	fd->fd = SAFE_OPEN("fd_dir", O_DIRECTORY);
 	SAFE_RMDIR("fd_dir");

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] accept03/tst_fd: Harden parallel runs against shared path races

[linuxtestproject.agent]

Hi Stephen,

On Wed Nov 4 11:46:36 2026 -0500, Stephen Bertram <sbertram@redhat.com> wrote:
> accept03/tst_fd: Harden parallel runs against shared path races

> This covers accept03, epoll_pwait06, ioctl_pidfd01, and splice07,
> which call TST_FD_FOREACH without a private tmpdir.
>
> +static void fd_path(char *buf, size_t len, const char *prefix)
> +{
> +	snprintf(buf, len, "%s_%d", prefix, getpid());
> +}

Tests that create temporary files or directories must set .needs_tmpdir = 1
in struct tst_test rather than creating files in the current working
directory. Without .needs_tmpdir = 1, open_file(), open_path(), and
open_dir() fail with EROFS/EACCES when run from a read-only working
directory and leave leftover files behind if interrupted before
SAFE_UNLINK()/SAFE_RMDIR(). Set .needs_tmpdir = 1 in accept03,
epoll_pwait06, ioctl_pidfd01, and splice07 (as epoll_ctl06, readahead01,
ioctl_ficlone04, and file_attr04 already do) and guard file creation in
tst_fd.c with tst_tmpdir_created().

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v3] accept03/tst_fd: Harden parallel runs against shared path races

[Stephen Bertram via ltp]

From: Stephen Bertram <sbertram@redhat.com>

TST_FD_FOREACH in accept03, epoll_pwait06, ioctl_pidfd01, and
splice07 creates fixed fd_file and fd_dir names in the current
directory. Parallel runs that share that directory race on those
names. Set .needs_tmpdir so each run gets its own directory.

Signed-off-by: Stephen Bertram <sbertram@redhat.com>
---
 testcases/kernel/syscalls/accept/accept03.c           | 1 +
 testcases/kernel/syscalls/epoll_pwait/epoll_pwait06.c | 1 +
 testcases/kernel/syscalls/ioctl/ioctl_pidfd01.c       | 1 +
 testcases/kernel/syscalls/splice/splice07.c           | 1 +
 4 files changed, 4 insertions(+)

diff --git a/testcases/kernel/syscalls/accept/accept03.c b/testcases/kernel/syscalls/accept/accept03.c
index bc472397d..dea4988cf 100644
--- a/testcases/kernel/syscalls/accept/accept03.c
+++ b/testcases/kernel/syscalls/accept/accept03.c
@@ -55,4 +55,5 @@ static void verify_accept(void)
 
 static struct tst_test test = {
 	.test_all = verify_accept,
+	.needs_tmpdir = 1,
 };
diff --git a/testcases/kernel/syscalls/epoll_pwait/epoll_pwait06.c b/testcases/kernel/syscalls/epoll_pwait/epoll_pwait06.c
index e12d9d394..b30b7289b 100644
--- a/testcases/kernel/syscalls/epoll_pwait/epoll_pwait06.c
+++ b/testcases/kernel/syscalls/epoll_pwait/epoll_pwait06.c
@@ -78,6 +78,7 @@ static void cleanup(void)
 
 static struct tst_test test = {
 	.test_all = run,
+	.needs_tmpdir = 1,
 	.setup = setup,
 	.cleanup = cleanup,
 	.test_variants = TEST_VARIANTS,
diff --git a/testcases/kernel/syscalls/ioctl/ioctl_pidfd01.c b/testcases/kernel/syscalls/ioctl/ioctl_pidfd01.c
index 95c0e8f3f..629bc2a1e 100644
--- a/testcases/kernel/syscalls/ioctl/ioctl_pidfd01.c
+++ b/testcases/kernel/syscalls/ioctl/ioctl_pidfd01.c
@@ -56,6 +56,7 @@ static void setup(void)
 
 static struct tst_test test = {
 	.test_all = run,
+	.needs_tmpdir = 1,
 	.setup = setup,
 	.forks_child = 1,
 	.bufs = (struct tst_buffers []) {
diff --git a/testcases/kernel/syscalls/splice/splice07.c b/testcases/kernel/syscalls/splice/splice07.c
index c750a14bf..c42e7ecd3 100644
--- a/testcases/kernel/syscalls/splice/splice07.c
+++ b/testcases/kernel/syscalls/splice/splice07.c
@@ -69,4 +69,5 @@ static void verify_splice(void)
 
 static struct tst_test test = {
 	.test_all = verify_splice,
+	.needs_tmpdir = 1,
 };
-- 
2.55.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] accept03/tst_fd: Harden parallel runs against shared path races

[linuxtestproject.agent]

Hi Stephen,

On Wed Nov 4 15:35:50 2026 -0500, Stephen Bertram <sbertram@redhat.com> wrote:
> accept03/tst_fd: Harden parallel runs against shared path races

Verdict - Reviewed

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v2] accept03/tst_fd: Harden parallel runs against

[Cyril Hrubis]

Hi!
> commit fa68043e5948ff1b8cb2c647d309ccf4808e23d7
> Author: Petr Vorel <pvorel@suse.cz>
> Date:   2026-11-04 18:34:06 +0100
> 
>     tst_fd: Add check for missing .needs_tmpdir
> 
>     Signed-off-by: Petr Vorel <pvorel@suse.cz>
> 
> diff --git lib/tst_fd.c lib/tst_fd.c
> index 6538a098c7..05e1bbe8b0 100644
> --- lib/tst_fd.c
> +++ lib/tst_fd.c
> @@ -22,6 +22,8 @@
>  #include "lapi/bpf.h"
>  #include "lapi/fsmount.h"
>  
> +#include "tso_tmpdir.h"
> +
>  #include "tst_fd.h"
>  
>  struct tst_fd_desc {
> @@ -30,8 +32,17 @@ struct tst_fd_desc {
>  	const char *desc;
>  };
>  
> +static void require_tmpdir(struct tst_fd *fd)
> +{
> +	if (!tst_tmpdir_created()) {
> +		tst_brk(TBROK, "%s fd requires .needs_tmpdir = 1",
> +			tst_fd_desc(fd));
> +	}
> +}
> +
>  static void open_file(struct tst_fd *fd)
>  {
> +	require_tmpdir(fd);
>  	fd->fd = SAFE_OPEN("fd_file", O_RDWR | O_CREAT, 0666);
>  	SAFE_UNLINK("fd_file");
>  }
> @@ -40,6 +51,7 @@ static void open_path(struct tst_fd *fd)
>  {
>  	int tfd;
>  
> +	require_tmpdir(fd);
>  	tfd = SAFE_CREAT("fd_file", 0666);
>  	SAFE_CLOSE(tfd);
>  
> @@ -50,6 +62,7 @@ static void open_path(struct tst_fd *fd)
>  
>  static void open_dir(struct tst_fd *fd)
>  {
> +	require_tmpdir(fd);
>  	SAFE_MKDIR("fd_dir", 0700);
>  	fd->fd = SAFE_OPEN("fd_dir", O_DIRECTORY);
>  	SAFE_RMDIR("fd_dir");

This approach looks good to me.

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp