Re: [LTP] Add test for CVE 2026-53362

[linuxtestproject.agent@gmail.com]

Hi Martin,

On Tue, 21 Jul 2026, Martin Doucha wrote:
> Add test for CVE 2026-53362

> +/*
> + * CVE 2026-53362
> + *
> + * Test for vulnerability in socket buffer size calculation for fragmented
> + * UDP packets with gaps. Reproducer based on:
> + * https://github.com/sgkdev/ipv6_frag_escape
> + *
> + * Memory corruption fixed in kernel v7.2:
> + * 736b380e28d0 ("ipv6: account for fraggap on the paged allocation path")
> + */

This high-level description block opens with a plain `/*` instead of
`/*\`. setsockopt10.c (and the rest of the test suite) uses `/*\` for
this block, since it gets exported into the RST-based test catalog.

As written, this stays a regular comment and will not show up in the
generated documentation. Could this be changed to `/*\`?

> +	/* Splice input pipe buffer page into socket */
> +	memset(buf, 0, TEST_MSGSIZE);
> +	buf[TEST_MSGSIZE - 6] = 1;
> +	SAFE_WRITE(SAFE_WRITE_ALL, pipefds[1][1], buf, TEST_MSGSIZE);
> +	splice(pipefds[1][0], NULL, sockfd, NULL, TEST_MSGSIZE, SPLICE_F_MORE);
> +	tee(pipefds[0][0], pipefds[1][1], PATTERN_SIZE, 0);
> +	splice(pipefds[1][0], NULL, sockfd, NULL, PATTERN_SIZE, SPLICE_F_MORE);

The file already includes "lapi/splice.h", which provides
`SAFE_SPLICE()`. Both splice() calls here use the bare syscall
instead, so their return value is discarded. If either call fails or
returns short, the reproduction sequence silently doesn't happen and
the iteration would just report TPASS without having exercised
anything. Would SAFE_SPLICE() be preferable here?

> +	for (i = 0; i < PIPE_COUNT; i++) {
> +		SAFE_CLOSE(pipefds[i][0]);
> +		SAFE_CLOSE(pipefds[i][1]);
> +	}

pipefds[][] (and sockfd, closed a few lines above) are not reset to -1
after being closed here; only setup() initializes them to -1, once.
cleanup() decides whether a descriptor needs closing with a `>= 0`
check.

Since leak_pipe() runs in a loop (up to 64 times), if SAFE_PIPE() or
SAFE_SOCKET() at the start of a later iteration fails (pipe(2)/
socket(2) can fail with EMFILE/ENFILE/ENOMEM) before refreshing a
given slot, cleanup() would see the stale, already-closed descriptor
number from the previous iteration as still open and try to close it
again. Would it make sense to reset the relevant slot to -1 right
after each close?

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp