Re: [LTP] [PATCH 2/2] cve/sctphantom: Add reproducer for CVE-2026-64564

[Petr Vorel <pvorel@suse.cz>]

> Hi Petr,

> > Nice reproducer, full of magic. Generally LGTM, few notes bellow?
> > Acked-by: Petr Vorel <pvorel@suse.cz>
> > Tested-by: Petr Vorel <pvorel@suse.cz>

> > > +static void setup(void)
> > > +{
> > > +	int fd;
> > > +	const struct tst_path_val sysctls[] = {
> > > +		{"/proc/sys/net/sctp/addip_enable", "1", TST_SR_TCONF},
> > > +		{"/proc/sys/net/sctp/addip_noauth_enable", "1", TST_SR_TCONF},
> > > +		{}
> > > +	};
> > Can't this be part of .save_restore in struct tst_test?

> I had to move it inside setup/cleanup because we need to load sctp module
> _before_ setting the addip_enable, which is available only after loading
> the module.

Thanks for info!

> > > +	const struct tst_path_val *sysctl;
> > > +
> > > +	tst_modprobe("sctp", NULL);
> > ...

> > > +
> > > +/*
> > > + * The freed transport is released by an RCU callback; once it is gone,
> > > + * reading the association status dereferences the stale primary_path,
> > > + * which KASAN reports as a use-after-free.
> > > + */
> > > +static void probe_uaf(void)
> > > +{
> > > +	uint8_t buf[512];
> > > +	long delay = 1;
> > > +	int i;
> > > +
> > > +	tst_res(TINFO, "probing the stale primary path via SCTP_STATUS");
> > > +
> > > +	for (i = 0; i < 12; i++) {
> > > +		socklen_t len = sizeof(buf);
> > > +
> > > +		TEST(getsockopt(cli_fd, SOL_SCTP, SCTP_STATUS, buf, &len));
> > What is the point of using TEST() macro here. Why not run getsockopt() directly?

> Yeah I also removed it, but then messed up with undo history :-)
> I will remove it again.

Good, it can be removed before merge.

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp