[LTP] [PATCH] listmount04: Detect EBADF behavior dynamically at runtime

[LTP] [PATCH] listmount04: Detect EBADF behavior dynamically at runtime

[Wake Liu via ltp]

Upstream commit 78f0e33cd6c9 ("fs/namespace: correctly handle errors
returned by grab_requested_mnt_ns") changed the errno from EINVAL to
EBADF when an invalid mount namespace file descriptor is passed to
listmount(). This change has been backported to various stable kernels
(e.g., 6.12.59 LTS).

Instead of hardcoding version checks for every stable backport, probe
the behavior dynamically in setup() by calling listmount() with an
invalid fd (-1) and checking the returned errno.

Signed-off-by: Wake Liu <wakel@google.com>
---
 .../kernel/syscalls/listmount/listmount04.c   | 27 ++++++++++++++++---
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/testcases/kernel/syscalls/listmount/listmount04.c b/testcases/kernel/syscalls/listmount/listmount04.c
index 919f4c854..f7343608f 100644
--- a/testcases/kernel/syscalls/listmount/listmount04.c
+++ b/testcases/kernel/syscalls/listmount/listmount04.c
@@ -153,16 +153,35 @@ static void run(unsigned int n)
 	}
 
 	TST_EXP_FAIL(tst_syscall(__NR_listmount, req, tc->mnt_ids,
-		tc->nr_mnt_ids, tc->flags), tc->exp_errno,
-		"%s", tc->msg);
+				 tc->nr_mnt_ids, tc->flags),
+		     tc->exp_errno,
+		     "%s", tc->msg);
 }
 
 static void setup(void)
 {
-	if (tst_kvercmp(6, 17, 9) >= 0)
+	mnt_id_req req = {
+		.size = MNT_ID_REQ_SIZE_VER0,
+		.mnt_id = LSMT_ROOT,
+		.mnt_ns_fd = -1,
+	};
+	uint64_t ids[MNT_SIZE];
+
+	TEST(tst_syscall(__NR_listmount, &req, ids, MNT_SIZE, 0));
+	if (TST_RET >= 0)
+		tst_brk(TBROK, "listmount() succeeded unexpectedly with invalid fd");
+
+	if (TST_ERR == EBADF) {
 		kver = AFTER_6_17_9;
-	else
+		tst_res(TINFO, "Detected kernel with EBADF behavior for invalid mnt_ns_fd");
+	} else if (TST_ERR == EINVAL) {
 		kver = BEFORE_6_17_9;
+		tst_res(TINFO, "Detected kernel with EINVAL behavior for invalid mnt_ns_fd");
+	} else if (TST_ERR == ENOSYS) {
+		tst_brk(TCONF, "listmount() syscall not supported");
+	} else {
+		tst_brk(TBROK | TTERRNO, "Unexpected error during probe");
+	}
 }
 
 static struct tst_test test = {
-- 
2.55.0.487.gaf234c4eb3-goog


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] listmount04: Detect EBADF behavior dynamically at runtime

[Petr Vorel]

> Upstream commit 78f0e33cd6c9 ("fs/namespace: correctly handle errors
> returned by grab_requested_mnt_ns") changed the errno from EINVAL to
> EBADF when an invalid mount namespace file descriptor is passed to
> listmount(). This change has been backported to various stable kernels
> (e.g., 6.12.59 LTS).

> Instead of hardcoding version checks for every stable backport, probe
> the behavior dynamically in setup() by calling listmount() with an
> invalid fd (-1) and checking the returned errno.

> Signed-off-by: Wake Liu <wakel@google.com>
> ---
>  .../kernel/syscalls/listmount/listmount04.c   | 27 ++++++++++++++++---
>  1 file changed, 23 insertions(+), 4 deletions(-)

> diff --git a/testcases/kernel/syscalls/listmount/listmount04.c b/testcases/kernel/syscalls/listmount/listmount04.c
> index 919f4c854..f7343608f 100644
> --- a/testcases/kernel/syscalls/listmount/listmount04.c
> +++ b/testcases/kernel/syscalls/listmount/listmount04.c
> @@ -153,16 +153,35 @@ static void run(unsigned int n)
>  	}

>  	TST_EXP_FAIL(tst_syscall(__NR_listmount, req, tc->mnt_ids,
> -		tc->nr_mnt_ids, tc->flags), tc->exp_errno,
> -		"%s", tc->msg);
> +				 tc->nr_mnt_ids, tc->flags),
> +		     tc->exp_errno,
> +		     "%s", tc->msg);
>  }

>  static void setup(void)
>  {
> -	if (tst_kvercmp(6, 17, 9) >= 0)
> +	mnt_id_req req = {
> +		.size = MNT_ID_REQ_SIZE_VER0,
> +		.mnt_id = LSMT_ROOT,
> +		.mnt_ns_fd = -1,
> +	};
> +	uint64_t ids[MNT_SIZE];
> +
> +	TEST(tst_syscall(__NR_listmount, &req, ids, MNT_SIZE, 0));
I wonder if we should use listmount() from listmount.h.

> +	if (TST_RET >= 0)
> +		tst_brk(TBROK, "listmount() succeeded unexpectedly with invalid fd");
Maybe we could have TST_EXP_FAIL_ARR_SILENT_BRK() in the future :)

> +
> +	if (TST_ERR == EBADF) {
>  		kver = AFTER_6_17_9;
At this point we may rename macros back to AFTER_6_18 and BEFORE_6_18, with
keeping note that it got backported into stable.

> -	else
> +		tst_res(TINFO, "Detected kernel with EBADF behavior for invalid mnt_ns_fd");
> +	} else if (TST_ERR == EINVAL) {
>  		kver = BEFORE_6_17_9;
> +		tst_res(TINFO, "Detected kernel with EINVAL behavior for invalid mnt_ns_fd");
> +	} else if (TST_ERR == ENOSYS) {
> +		tst_brk(TCONF, "listmount() syscall not supported");
This is IMHO not supported, because it's part of tst_syscall().
Other than this LGTM.
Reviewed-by: Petr Vorel <pvorel@suse.cz>

Kind regards,
Petr

> +	} else {
> +		tst_brk(TBROK | TTERRNO, "Unexpected error during probe");
> +	}

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] listmount04: Detect EBADF behavior dynamically at runtime

[Petr Vorel]

Hi Wake Liu,

...
> > -	else
> > +		tst_res(TINFO, "Detected kernel with EBADF behavior for invalid mnt_ns_fd");
> > +	} else if (TST_ERR == EINVAL) {
> >  		kver = BEFORE_6_17_9;
> > +		tst_res(TINFO, "Detected kernel with EINVAL behavior for invalid mnt_ns_fd");
> > +	} else if (TST_ERR == ENOSYS) {
> > +		tst_brk(TCONF, "listmount() syscall not supported");
> This is IMHO not supported, because it's part of tst_syscall().

I'm sorry, I meant "not needed".

Kind regards,
Petr

> Other than this LGTM.
> Reviewed-by: Petr Vorel <pvorel@suse.cz>

> Kind regards,
> Petr

> > +	} else {
> > +		tst_brk(TBROK | TTERRNO, "Unexpected error during probe");
> > +	}

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2] listmount04: Detect EBADF behavior dynamically at runtime

[Wake Liu via ltp]

Upstream commit 78f0e33cd6c9 ("fs/namespace: correctly handle errors
returned by grab_requested_mnt_ns") changed the errno from EINVAL to
EBADF when an invalid mount namespace file descriptor is passed to
listmount(). This change has been backported to various stable kernels
(e.g., 6.12.59 LTS).

Instead of hardcoding version checks for every stable backport, probe
the behavior dynamically in setup() by calling listmount() with an
invalid fd (-1) and checking the returned errno.

Signed-off-by: Wake Liu <wakel@google.com>
---
 .../kernel/syscalls/listmount/listmount04.c   | 40 ++++++++++++++-----
 1 file changed, 29 insertions(+), 11 deletions(-)

diff --git a/testcases/kernel/syscalls/listmount/listmount04.c b/testcases/kernel/syscalls/listmount/listmount04.c
index 919f4c854..561386cb4 100644
--- a/testcases/kernel/syscalls/listmount/listmount04.c
+++ b/testcases/kernel/syscalls/listmount/listmount04.c
@@ -23,10 +23,11 @@
 #define MNT_SIZE 32
 /*
  * For commit 78f0e33cd6c9 ("fs/namespace: correctly handle errors returned
- * by grab_requested_mnt_ns") from v6.18-rc7 backported to v6.17.9.
+ * by grab_requested_mnt_ns") from v6.18-rc7. Note that this change was
+ * backported to stable kernels (e.g. v6.17.9, v6.12.59).
  */
-#define BEFORE_6_17_9 1
-#define AFTER_6_17_9 2
+#define BEFORE_6_18 1
+#define AFTER_6_18 2
 
 static mnt_id_req *request;
 static uint64_t mnt_ids[MNT_SIZE];
@@ -89,7 +90,7 @@ static struct tcase {
 		.nr_mnt_ids = MNT_SIZE,
 		.exp_errno = EINVAL,
 		.msg = "invalid mnt_id_req.spare",
-		.kver = BEFORE_6_17_9,
+		.kver = BEFORE_6_18,
 	},
 	{
 		.req_usage = 1,
@@ -100,7 +101,7 @@ static struct tcase {
 		.nr_mnt_ids = MNT_SIZE,
 		.exp_errno = EBADF,
 		.msg = "invalid mnt_id_req.mnt_ns_fd",
-		.kver = AFTER_6_17_9,
+		.kver = AFTER_6_18,
 	},
 	{
 		.req_usage = 1,
@@ -153,16 +154,33 @@ static void run(unsigned int n)
 	}
 
 	TST_EXP_FAIL(tst_syscall(__NR_listmount, req, tc->mnt_ids,
-		tc->nr_mnt_ids, tc->flags), tc->exp_errno,
-		"%s", tc->msg);
+				 tc->nr_mnt_ids, tc->flags),
+		     tc->exp_errno,
+		     "%s", tc->msg);
 }
 
 static void setup(void)
 {
-	if (tst_kvercmp(6, 17, 9) >= 0)
-		kver = AFTER_6_17_9;
-	else
-		kver = BEFORE_6_17_9;
+	mnt_id_req req = {
+		.size = MNT_ID_REQ_SIZE_VER0,
+		.mnt_id = LSMT_ROOT,
+		.mnt_ns_fd = -1,
+	};
+	uint64_t ids[MNT_SIZE];
+
+	TEST(tst_syscall(__NR_listmount, &req, ids, MNT_SIZE, 0));
+	if (TST_RET >= 0)
+		tst_brk(TBROK, "listmount() succeeded unexpectedly with invalid fd");
+
+	if (TST_ERR == EBADF) {
+		kver = AFTER_6_18;
+		tst_res(TINFO, "Detected kernel with EBADF behavior for invalid mnt_ns_fd");
+	} else if (TST_ERR == EINVAL) {
+		kver = BEFORE_6_18;
+		tst_res(TINFO, "Detected kernel with EINVAL behavior for invalid mnt_ns_fd");
+	} else {
+		tst_brk(TBROK | TTERRNO, "Unexpected error during probe");
+	}
 }
 
 static struct tst_test test = {
-- 
2.55.0.487.gaf234c4eb3-goog


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] listmount04: Detect EBADF behavior dynamically at runtime

[Wake Liu via ltp]

Hi Petr,

Thanks for the review. I've just sent out v2.

To address your comments:
- listmount() helper: We can't use it here because it constructs the
request struct internally with `mnt_ns_fd = 0`. We need to set
`mnt_ns_fd = -1` to trigger the error behavior we are probing.
- Macro rename: Renamed BEFORE/AFTER_6_17_9 to BEFORE/AFTER_6_18 and
added a note about stable backports.
- ENOSYS check: Removed since `.min_kver = "6.11"` guarantees listmount support.

Best regards,
Wake


On Fri, Jul 24, 2026 at 8:11 PM Petr Vorel <pvorel@suse.cz> wrote:
>
> > Upstream commit 78f0e33cd6c9 ("fs/namespace: correctly handle errors
> > returned by grab_requested_mnt_ns") changed the errno from EINVAL to
> > EBADF when an invalid mount namespace file descriptor is passed to
> > listmount(). This change has been backported to various stable kernels
> > (e.g., 6.12.59 LTS).
>
> > Instead of hardcoding version checks for every stable backport, probe
> > the behavior dynamically in setup() by calling listmount() with an
> > invalid fd (-1) and checking the returned errno.
>
> > Signed-off-by: Wake Liu <wakel@google.com>
> > ---
> >  .../kernel/syscalls/listmount/listmount04.c   | 27 ++++++++++++++++---
> >  1 file changed, 23 insertions(+), 4 deletions(-)
>
> > diff --git a/testcases/kernel/syscalls/listmount/listmount04.c b/testcases/kernel/syscalls/listmount/listmount04.c
> > index 919f4c854..f7343608f 100644
> > --- a/testcases/kernel/syscalls/listmount/listmount04.c
> > +++ b/testcases/kernel/syscalls/listmount/listmount04.c
> > @@ -153,16 +153,35 @@ static void run(unsigned int n)
> >       }
>
> >       TST_EXP_FAIL(tst_syscall(__NR_listmount, req, tc->mnt_ids,
> > -             tc->nr_mnt_ids, tc->flags), tc->exp_errno,
> > -             "%s", tc->msg);
> > +                              tc->nr_mnt_ids, tc->flags),
> > +                  tc->exp_errno,
> > +                  "%s", tc->msg);
> >  }
>
> >  static void setup(void)
> >  {
> > -     if (tst_kvercmp(6, 17, 9) >= 0)
> > +     mnt_id_req req = {
> > +             .size = MNT_ID_REQ_SIZE_VER0,
> > +             .mnt_id = LSMT_ROOT,
> > +             .mnt_ns_fd = -1,
> > +     };
> > +     uint64_t ids[MNT_SIZE];
> > +
> > +     TEST(tst_syscall(__NR_listmount, &req, ids, MNT_SIZE, 0));
> I wonder if we should use listmount() from listmount.h.
>
> > +     if (TST_RET >= 0)
> > +             tst_brk(TBROK, "listmount() succeeded unexpectedly with invalid fd");
> Maybe we could have TST_EXP_FAIL_ARR_SILENT_BRK() in the future :)
>
> > +
> > +     if (TST_ERR == EBADF) {
> >               kver = AFTER_6_17_9;
> At this point we may rename macros back to AFTER_6_18 and BEFORE_6_18, with
> keeping note that it got backported into stable.
>
> > -     else
> > +             tst_res(TINFO, "Detected kernel with EBADF behavior for invalid mnt_ns_fd");
> > +     } else if (TST_ERR == EINVAL) {
> >               kver = BEFORE_6_17_9;
> > +             tst_res(TINFO, "Detected kernel with EINVAL behavior for invalid mnt_ns_fd");
> > +     } else if (TST_ERR == ENOSYS) {
> > +             tst_brk(TCONF, "listmount() syscall not supported");
> This is IMHO not supported, because it's part of tst_syscall().
> Other than this LGTM.
> Reviewed-by: Petr Vorel <pvorel@suse.cz>
>
> Kind regards,
> Petr
>
> > +     } else {
> > +             tst_brk(TBROK | TTERRNO, "Unexpected error during probe");
> > +     }



-- 
Best Regards,
Wake Liu

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] listmount04: Detect EBADF behavior dynamically at runtime

[linuxtestproject.agent]

Hi Wake,

On 2026-07-27, Wake Liu wrote:
> listmount04: Detect EBADF behavior dynamically at runtime

Verdict - Reviewed

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp