Re: [LTP] [PATCH 2/2] cve/sctphantom: Add reproducer for CVE-2026-64564

[Petr Vorel <pvorel@suse.cz>]

Hi Andrea,

> Add a reproducer for CVE-2026-64564, a use-after-free in the SCTP
> Dynamic Address Reconfiguration (RFC 5061) DEL-IP processing.

> This vulnerability was fixed upstream by commit 9b2854f86f0b ("sctp:
> don't free the ASCONF's own transport in DEL-IP processing").

> Signed-off-by: Andrea Cervesato <andrea.cervesato@suse.com>
> Link: https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564

Nice reproducer, full of magic. Generally LGTM, few notes bellow?
Acked-by: Petr Vorel <pvorel@suse.cz>
Tested-by: Petr Vorel <pvorel@suse.cz>

> +static void setup(void)
> +{
> +	int fd;
> +	const struct tst_path_val sysctls[] = {
> +		{"/proc/sys/net/sctp/addip_enable", "1", TST_SR_TCONF},
> +		{"/proc/sys/net/sctp/addip_noauth_enable", "1", TST_SR_TCONF},
> +		{}
> +	};
Can't this be part of .save_restore in struct tst_test?

> +	const struct tst_path_val *sysctl;
> +
> +	tst_modprobe("sctp", NULL);
...

> +
> +/*
> + * The freed transport is released by an RCU callback; once it is gone,
> + * reading the association status dereferences the stale primary_path,
> + * which KASAN reports as a use-after-free.
> + */
> +static void probe_uaf(void)
> +{
> +	uint8_t buf[512];
> +	long delay = 1;
> +	int i;
> +
> +	tst_res(TINFO, "probing the stale primary path via SCTP_STATUS");
> +
> +	for (i = 0; i < 12; i++) {
> +		socklen_t len = sizeof(buf);
> +
> +		TEST(getsockopt(cli_fd, SOL_SCTP, SCTP_STATUS, buf, &len));
What is the point of using TEST() macro here. Why not run getsockopt() directly?

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp