[LTP] [PATCH] cve-2026-46331: fix intermittent ENOENT failure

[Andrea Cervesato]

From: Andrea Cervesato <andrea.cervesato@suse.com>

The required qdisc, classifier and action modules cannot be
autoloaded from the unprivileged user namespace, so arming the
traffic filter sometimes failed with ENOENT.

Preload the modules as root before dropping privileges and entering
the network namespace.

Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
---
tst_kconfig.c:90: TINFO: Parsing kernel config '/proc/config.gz'
tst_kconfig.c:755: TINFO: CONFIG_FAULT_INJECTION kernel option detected which might slow the execution
tst_test.c:1872: TINFO: Overall timeout per run is 0h 02m 00s
cve-2026-46331.c:200: TBROK: Failed to modify traffic filter: ENOENT

HINT: You _MAY_ be missing kernel fixes:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=899ee91156e5

HINT: You _MAY_ be vulnerable to CVE(s):

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331
---
 testcases/cve/cve-2026-46331.c | 33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/testcases/cve/cve-2026-46331.c b/testcases/cve/cve-2026-46331.c
index c33d358396f21024d8a68e9cd5c4cae0a9339a9f..dd19860e1d35152547e933850d7b8c91281240c4 100644
--- a/testcases/cve/cve-2026-46331.c
+++ b/testcases/cve/cve-2026-46331.c
@@ -35,6 +35,8 @@
  */
 
 #include <sys/sendfile.h>
+#include <sys/prctl.h>
+#include <pwd.h>
 #include <linux/rtnetlink.h>
 
 #include "tst_test.h"
@@ -128,7 +130,31 @@ static int acc_fd = -1;
 static void setup(void)
 {
 	struct sockaddr_in addr;
-	int i;
+	struct passwd *pw;
+	static const char *const mods[] = {
+		"sch_ingress", "cls_matchall", "act_pedit"
+	};
+	static const char *cmd[] = {"modprobe", NULL, NULL};
+	unsigned int i;
+
+	for (i = 0; i < ARRAY_SIZE(mods); i++) {
+		cmd[1] = mods[i];
+
+		if (tst_cmd(cmd, NULL, "/dev/null", TST_CMD_PASS_RETVAL))
+			tst_brk(TCONF, "kernel module %s is not available", mods[i]);
+	}
+
+	/* Drop privileges so the reproducer runs as an unprivileged user */
+	pw = SAFE_GETPWNAM("nobody");
+	SAFE_SETGID(pw->pw_gid);
+	SAFE_SETUID(pw->pw_uid);
+
+	/*
+	 * setuid() clears the dumpable flag, which makes /proc/self/*
+	 * owned by root and prevents tst_setup_netns() from writing the
+	 * uid/gid maps. Restore it so the user namespace can be set up.
+	 */
+	SAFE_PRCTL(PR_SET_DUMPABLE, 1, 0, 0, 0);
 
 	tst_setup_netns();
 	NETDEV_SET_STATE("lo", 1);
@@ -253,7 +279,12 @@ static struct tst_test test = {
 	.test_all = run,
 	.setup = setup,
 	.cleanup = cleanup,
+	.needs_root = 1,
 	.needs_tmpdir = 1,
+	.needs_cmds = (struct tst_cmd[]) {
+		{.cmd = "modprobe"},
+		{}
+	},
 	.needs_kconfigs = (const char *[]) {
 		"CONFIG_USER_NS=y",
 		"CONFIG_NET_NS=y",

---
base-commit: a67fe5f7b20492ff6ee7f4b1776a7579d4b3859b
change-id: 20260717-fix_cve-2026-46331_enoent-9b9254da578e

Best regards,
-- 
Andrea Cervesato <andrea.cervesato@suse.com>