Re: [PATCH v2 14/15] selftests/bpf: Test the LSM policy object kfuncs with Landlock

On Mon, Aug 31, 2026 at 07:53:26PM +0000, sashiko-bot@kernel.org wrote:

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] File descriptors leak on the error path in test_restrict_binprm_discard().
--

commit 7fa3010dd885254cc82b6aa2f6f254ee83a13717
Author: Justin Suess [off-list ref]

selftests/bpf: Test the LSM policy object kfuncs with Landlock

This commit adds tests for LSM policy object kfuncs interacting with Landlock.
It tests execution confinement, audit log flags, and concurrent application
using a syscall program and BPF RCU lock management.

quoted

diff --git a/tools/testing/selftests/bpf/prog_tests/lsm_policy_landlock.c b/tools/testing/selftests/bpf/prog_tests/lsm_policy_landlock.c
new file mode 100644
index 0000000000000..9270b39f5e3a7
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/lsm_policy_landlock.c

[ ... ]

quoted

+static void test_restrict_binprm_discard(void)
+{
+	struct policy_test_env env;
+	char garbage_path[] = "/tmp/lsm_policy_garbage_XXXXXX";
+	int garbage_fd, pipe_fds[2];
+	char buf = 0;
+	pid_t pid;
+
+	if (setup_env(&env))
+		goto out;

[ ... ]

quoted

+	if (!ASSERT_OK(pipe(pipe_fds), "pipe"))
+		goto out_unlink;
+
+	/*
+	 * Cannot use spawn_exec_child(): the same process must test its
+	 * write access after the failed exec.
+	 */
+	pid = fork();
+	if (!ASSERT_GE(pid, 0, "fork"))
+		goto out_unlink;

[Severity: Low]
Does this code leak the file descriptors created by pipe() if fork() fails? 

If fork() fails here, the code jumps directly to the out_unlink label, and it 
appears neither pipe_fds[0] nor pipe_fds[1] are closed before exiting the
function. 

The spawn_exec_child() helper function introduced in this same commit properly 
closes both descriptors on fork failure. Should similar cleanup be added here?

Will fix.

I think that's sashiko's only nit for this patchset.

https://sashiko.dev/#/patchset/20260831145858.3869191-1-utilityemal77@gmail.com

The BPF CI AI review bot didn't run on this since the patchset can't
based on a bpf tree until it catches up to the recent Landlock changes.

Justin

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831145858.3869191-1-utilityemal77@gmail.com?part=14