[LTP] [PATCH] cve-2026-46331: fix intermittent ENOENT failure

[Sebastian Chlad]

Hi Andrea,

the rules say: "rules/ground-rules.md:If root is required, the reason MUST
be documented in the test's doc comment." Maybe worth adding?

Besides the subject says: "fix intermittent ENOENT failure". From your
patch it seems there is nothing intermittent about this behaviour.
I think commit subject should be amended to provide more accurate
description.

On Fri, 17 Jul 2026 at 15:21, Andrea Cervesato <andrea.cervesato@suse.de>
wrote:

> From: Andrea Cervesato <andrea.cervesato@suse.com>
>
> The required qdisc, classifier and action modules cannot be
> autoloaded from the unprivileged user namespace, so arming the
> traffic filter sometimes failed with ENOENT.
>
> Preload the modules as root before dropping privileges and entering
> the network namespace.
>
> Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
> ---
> tst_kconfig.c:90: TINFO: Parsing kernel config '/proc/config.gz'
> tst_kconfig.c:755: TINFO: CONFIG_FAULT_INJECTION kernel option detected
> which might slow the execution
> tst_test.c:1872: TINFO: Overall timeout per run is 0h 02m 00s
> cve-2026-46331.c:200: TBROK: Failed to modify traffic filter: ENOENT
>
> HINT: You _MAY_ be missing kernel fixes:
>
>
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=899ee91156e5
>
> HINT: You _MAY_ be vulnerable to CVE(s):
>
> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46331
> ---
>  testcases/cve/cve-2026-46331.c | 33 ++++++++++++++++++++++++++++++++-
>  1 file changed, 32 insertions(+), 1 deletion(-)
>
> diff --git a/testcases/cve/cve-2026-46331.c
> b/testcases/cve/cve-2026-46331.c
> index
> c33d358396f21024d8a68e9cd5c4cae0a9339a9f..dd19860e1d35152547e933850d7b8c91281240c4
> 100644
> --- a/testcases/cve/cve-2026-46331.c
> +++ b/testcases/cve/cve-2026-46331.c
> @@ -35,6 +35,8 @@
>   */
>
>  #include <sys/sendfile.h>
> +#include <sys/prctl.h>
> +#include <pwd.h>
>  #include <linux/rtnetlink.h>
>
>  #include "tst_test.h"
> @@ -128,7 +130,31 @@ static int acc_fd = -1;
>  static void setup(void)
>  {
>         struct sockaddr_in addr;
> -       int i;
> +       struct passwd *pw;
> +       static const char *const mods[] = {
> +               "sch_ingress", "cls_matchall", "act_pedit"
> +       };
> +       static const char *cmd[] = {"modprobe", NULL, NULL};
> +       unsigned int i;
> +
> +       for (i = 0; i < ARRAY_SIZE(mods); i++) {
> +               cmd[1] = mods[i];
> +
> +               if (tst_cmd(cmd, NULL, "/dev/null", TST_CMD_PASS_RETVAL))
> +                       tst_brk(TCONF, "kernel module %s is not
> available", mods[i]);
> +       }
> +
> +       /* Drop privileges so the reproducer runs as an unprivileged user
> */
> +       pw = SAFE_GETPWNAM("nobody");
> +       SAFE_SETGID(pw->pw_gid);
> +       SAFE_SETUID(pw->pw_uid);
> +
> +       /*
> +        * setuid() clears the dumpable flag, which makes /proc/self/*
> +        * owned by root and prevents tst_setup_netns() from writing the
> +        * uid/gid maps. Restore it so the user namespace can be set up.
> +        */
> +       SAFE_PRCTL(PR_SET_DUMPABLE, 1, 0, 0, 0);
>
>         tst_setup_netns();
>         NETDEV_SET_STATE("lo", 1);
> @@ -253,7 +279,12 @@ static struct tst_test test = {
>         .test_all = run,
>         .setup = setup,
>         .cleanup = cleanup,
> +       .needs_root = 1,
>         .needs_tmpdir = 1,
> +       .needs_cmds = (struct tst_cmd[]) {
> +               {.cmd = "modprobe"},
> +               {}
> +       },
>         .needs_kconfigs = (const char *[]) {
>                 "CONFIG_USER_NS=y",
>                 "CONFIG_NET_NS=y",
>
> ---
> base-commit: a67fe5f7b20492ff6ee7f4b1776a7579d4b3859b
> change-id: 20260717-fix_cve-2026-46331_enoent-9b9254da578e
>


Otherwise lgtm.



>
> Best regards,
> --
> Andrea Cervesato <andrea.cervesato@suse.com>
>
>
> --
> Mailing list info: https://lists.linux.it/listinfo/ltp
>