[LTP] [PATCH v3 0/2] Fix cve-2026-46331 producing ENOENT

[LTP] [PATCH v3 0/2] Fix cve-2026-46331 producing ENOENT

[Andrea Cervesato]

tst_kconfig.c:90: TINFO: Parsing kernel config '/proc/config.gz'
tst_kconfig.c:755: TINFO: CONFIG_FAULT_INJECTION kernel option detected which might slow the execution
tst_test.c:1872: TINFO: Overall timeout per run is 0h 02m 00s
cve-2026-46331.c:200: TBROK: Failed to modify traffic filter: ENOENT

HINT: You _MAY_ be missing kernel fixes:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=899ee91156e5

HINT: You _MAY_ be vulnerable to CVE(s):

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
Changes in v3:
- commit adding modules to tst_kconfig
- Link to v2: https://lore.kernel.org/20260720-fix_cve-2026-46331_enoent-v2-1-395819e74978@suse.com

Changes in v2:
- explain why we use root
- use tst_modprobe()
- add more CONFIG_* requirements
- Link to v1: https://lore.kernel.org/20260717-fix_cve-2026-46331_enoent-v1-1-85425e81ff7a@suse.com

---
Andrea Cervesato (2):
      tst_kconfig: add module mappings for ingress/matchall/pedit
      cve-2026-46331: fix intermittent ENOENT failure

 lib/tst_kconfig.c              |  3 +++
 testcases/cve/cve-2026-46331.c | 34 ++++++++++++++++++++++++++++++++--
 2 files changed, 35 insertions(+), 2 deletions(-)
---
base-commit: 51a74d8821a9712d122d2d435581a9bbc277708a
change-id: 20260717-fix_cve-2026-46331_enoent-9b9254da578e

Best regards,
-- 
Andrea Cervesato <andrea.cervesato@suse.com>


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v3 1/2] tst_kconfig: add module mappings for ingress/matchall/pedit

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

Map CONFIG_NET_SCH_INGRESS, CONFIG_NET_CLS_MATCHALL and CONFIG_NET_ACT_PEDIT
to their kernel modules (sch_ingress, cls_matchall, act_pedit).

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 lib/tst_kconfig.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/tst_kconfig.c b/lib/tst_kconfig.c
index 44eacc7c2989a5af3347b8f7ed16393fde0122a6..277ac606895046e072cf8f86076ecf7d79f9b1e6 100644
--- a/lib/tst_kconfig.c
+++ b/lib/tst_kconfig.c
@@ -162,6 +162,9 @@ static struct config_module_map {
 	{"CONFIG_CAN_RAW", "can-raw"},
 	{"CONFIG_CAN_BCM", "can-bcm"},
 	{"CONFIG_IP_SCTP", "sctp"},
+	{"CONFIG_NET_SCH_INGRESS", "sch_ingress"},
+	{"CONFIG_NET_CLS_MATCHALL", "cls_matchall"},
+	{"CONFIG_NET_ACT_PEDIT", "act_pedit"},
 	{}
 };
 

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v3 1/2] tst_kconfig: add module mappings for ingress/matchall/pedit

[Cyril Hrubis]

Hi!
> Map CONFIG_NET_SCH_INGRESS, CONFIG_NET_CLS_MATCHALL and CONFIG_NET_ACT_PEDIT
> to their kernel modules (sch_ingress, cls_matchall, act_pedit).
> 
> Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
> ---
>  lib/tst_kconfig.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/lib/tst_kconfig.c b/lib/tst_kconfig.c
> index 44eacc7c2989a5af3347b8f7ed16393fde0122a6..277ac606895046e072cf8f86076ecf7d79f9b1e6 100644
> --- a/lib/tst_kconfig.c
> +++ b/lib/tst_kconfig.c
> @@ -162,6 +162,9 @@ static struct config_module_map {
>  	{"CONFIG_CAN_RAW", "can-raw"},
>  	{"CONFIG_CAN_BCM", "can-bcm"},
>  	{"CONFIG_IP_SCTP", "sctp"},
> +	{"CONFIG_NET_SCH_INGRESS", "sch_ingress"},
> +	{"CONFIG_NET_CLS_MATCHALL", "cls_matchall"},
> +	{"CONFIG_NET_ACT_PEDIT", "act_pedit"},
>  	{}
>  };

This is still missing the additions to the CONFIG -> module map.

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] tst_kconfig: add module mappings for ingress/matchall/pedit

[linuxtestproject.agent]

Hi Andrea,

On Mon, Jul 20 2026, Andrea Cervesato wrote:
> tst_kconfig: add module mappings for ingress/matchall/pedit

--- [PATCH 1/2] ---

> Map CONFIG_NET_SCH_INGRESS, CONFIG_NET_CLS_MATCHALL and CONFIG_NET_ACT_PEDIT
> to their kernel modules (sch_ingress, cls_matchall, act_pedit).

The body restates what the subject already says. Is there a sentence
missing that explains what prompted these additions -- e.g. that the
following patch (cve-2026-46331) needs them for the kconfig module
check to work when the features are built as modules?

--- [PATCH 2/2] ---

> +	for (unsigned int i = 0; i < ARRAY_SIZE(mods); i++)
> +		tst_modprobe(mods[i], NULL);
> +
> +	/* Drop privileges so the reproducer runs as an unprivileged user */
> +	pw = SAFE_GETPWNAM("nobody");
> +	SAFE_SETGID(pw->pw_gid);
> +	SAFE_SETUID(pw->pw_uid);

The three modules loaded by tst_modprobe() are never unloaded. cleanup()
has no matching tst_module_unload() calls, so sch_ingress, cls_matchall
and act_pedit remain in the kernel after the test exits.

The constraint is structural: SAFE_SETUID() permanently drops root, so
cleanup() runs as "nobody" and cannot call rmmod even if the call were
added there.

Is the expectation that these modules are present on any system running
this test, making the omission intentional? If so, a short comment in
cleanup() noting that module unload is skipped because privileges have
been dropped would make the intent clear.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v3 2/2] cve-2026-46331: fix intermittent ENOENT failure

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

The required qdisc, classifier and action modules cannot be
autoloaded from the unprivileged user namespace, so arming the
traffic filter sometimes failed with ENOENT.

Preload the modules as root before dropping privileges and entering
the network namespace.

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
 testcases/cve/cve-2026-46331.c | 34 ++++++++++++++++++++++++++++++++--
 1 file changed, 32 insertions(+), 2 deletions(-)

diff --git a/testcases/cve/cve-2026-46331.c b/testcases/cve/cve-2026-46331.c
index c33d358396f21024d8a68e9cd5c4cae0a9339a9f..6af43afb7910dd72777c1433f75dc8efce33366e 100644
--- a/testcases/cve/cve-2026-46331.c
+++ b/testcases/cve/cve-2026-46331.c
@@ -32,12 +32,19 @@
  * - Reread the file through the same ``O_RDONLY`` descriptor and
  *   compare with the original pattern; any difference means the
  *   page cache was corrupted
+ *
+ * The test needs root to preload the qdisc, classifier and action
+ * modules, which cannot be autoloaded from the unprivileged user
+ * namespace, before dropping privileges to an unprivileged user.
  */
 
 #include <sys/sendfile.h>
+#include <sys/prctl.h>
+#include <pwd.h>
 #include <linux/rtnetlink.h>
 
 #include "tst_test.h"
+#include "tst_module.h"
 #include "tst_net.h"
 #include "tst_netdevice.h"
 #include "lapi/if_ether.h"
@@ -128,7 +135,25 @@ static int acc_fd = -1;
 static void setup(void)
 {
 	struct sockaddr_in addr;
-	int i;
+	struct passwd *pw;
+	static const char *const mods[] = {
+		"sch_ingress", "cls_matchall", "act_pedit"
+	};
+
+	for (unsigned int i = 0; i < ARRAY_SIZE(mods); i++)
+		tst_modprobe(mods[i], NULL);
+
+	/* Drop privileges so the reproducer runs as an unprivileged user */
+	pw = SAFE_GETPWNAM("nobody");
+	SAFE_SETGID(pw->pw_gid);
+	SAFE_SETUID(pw->pw_uid);
+
+	/*
+	 * setuid() clears the dumpable flag, which makes the /proc/self
+	 * files owned by root and prevents tst_setup_netns() from writing the
+	 * uid/gid maps. Restore it so the user namespace can be set up.
+	 */
+	SAFE_PRCTL(PR_SET_DUMPABLE, 1, 0, 0, 0);
 
 	tst_setup_netns();
 	NETDEV_SET_STATE("lo", 1);
@@ -144,7 +169,7 @@ static void setup(void)
 	SAFE_BIND(listen_fd, (struct sockaddr *)&addr, sizeof(addr));
 	SAFE_LISTEN(listen_fd, 1);
 
-	for (i = 0; i < DATA_SIZE; i++)
+	for (unsigned int i = 0; i < DATA_SIZE; i++)
 		original[i] = (uint8_t)(i & 0xff);
 
 	memset(&pedit_sel_buf, 0, sizeof(pedit_sel_buf));
@@ -253,7 +278,12 @@ static struct tst_test test = {
 	.test_all = run,
 	.setup = setup,
 	.cleanup = cleanup,
+	.needs_root = 1,
 	.needs_tmpdir = 1,
+	.needs_cmds = (struct tst_cmd[]) {
+		{.cmd = "modprobe"},
+		{}
+	},
 	.needs_kconfigs = (const char *[]) {
 		"CONFIG_USER_NS=y",
 		"CONFIG_NET_NS=y",

-- 
2.51.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp