[LTP] [PATCH v1] crypto/af_alg09: Test CVE-2026-52972

[LTP] [PATCH v1] crypto/af_alg09: Test CVE-2026-52972

[Stephen Bertram via ltp]

From: Stephen Bertram <sbertram@redhat.com>

Add a regression test for the missing cap on the AEAD associated data
length.  Kernel commit e4c06479d705 ("crypto: af_alg - Cap AEAD AD
length to 0x80000000") rejects ALG_SET_AEAD_ASSOCLEN values greater
than or equal to 0x80000000; without it af_alg_sendmsg() accepts any
32-bit value.

The test opens an AF_ALG AEAD request socket, sets ALG_OP_DECRYPT and
ALG_SET_AEAD_ASSOCLEN to 0x7fffffff, which must be accepted, and to
0x80000000 and 0xffffffff, which must fail with EINVAL.  It does not
call recvmsg(), so the test only depends on the control-message
validation.

Signed-off-by: Stephen Bertram <sbertram@redhat.com>
---
 runtest/crypto                     |   1 +
 testcases/kernel/crypto/.gitignore |   1 +
 testcases/kernel/crypto/af_alg09.c | 131 +++++++++++++++++++++++++++++
 3 files changed, 133 insertions(+)
 create mode 100644 testcases/kernel/crypto/af_alg09.c

diff --git a/runtest/crypto b/runtest/crypto
index a8330db9f..082b906c1 100644
--- a/runtest/crypto
+++ b/runtest/crypto
@@ -6,6 +6,7 @@ af_alg05 af_alg05
 af_alg06 af_alg06
 af_alg07 af_alg07
 af_alg08 af_alg08
+af_alg09 af_alg09
 pcrypt_aead01 pcrypt_aead01
 crypto_user01 crypto_user01
 crypto_user02 crypto_user02
diff --git a/testcases/kernel/crypto/.gitignore b/testcases/kernel/crypto/.gitignore
index aca016b62..e1890d975 100644
--- a/testcases/kernel/crypto/.gitignore
+++ b/testcases/kernel/crypto/.gitignore
@@ -6,6 +6,7 @@ af_alg05
 af_alg06
 af_alg07
 af_alg08
+af_alg09
 pcrypt_aead01
 crypto_user01
 crypto_user02
diff --git a/testcases/kernel/crypto/af_alg09.c b/testcases/kernel/crypto/af_alg09.c
new file mode 100644
index 000000000..4c3f13270
--- /dev/null
+++ b/testcases/kernel/crypto/af_alg09.c
@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2026 Red Hat, Inc.
+ */
+
+/*\
+ * Test for CVE-2026-52972.
+ *
+ * [Description]
+ *
+ * Verify that the AF_ALG AEAD interface rejects an associated data length
+ * greater than or equal to 0x80000000 with EINVAL.
+ *
+ * Before kernel commit e4c06479d705 ("crypto: af_alg - Cap AEAD AD length to
+ * 0x80000000") af_alg_sendmsg() accepted any 32-bit ALG_SET_AEAD_ASSOCLEN
+ * value.
+ */
+
+#include "tst_test.h"
+#include "tst_af_alg.h"
+#include "lapi/socket.h"
+
+#define ASSOCLEN_LIMIT 0x80000000U
+#define SEND_SIZE 16
+
+static int algfd = -1;
+
+/*
+ * Send SEND_SIZE bytes with ALG_SET_AEAD_ASSOCLEN set to assoclen and
+ * ALG_SET_OP set to ALG_OP_DECRYPT.  Return the sendmsg() return value, with
+ * errno from sendmsg() preserved.
+ */
+static ssize_t send_assoclen(int reqfd, uint32_t assoclen)
+{
+	char data[SEND_SIZE] = {0};
+	char control[CMSG_SPACE(sizeof(uint32_t)) * 2];
+	struct iovec iov = {
+		.iov_base = data,
+		.iov_len = sizeof(data),
+	};
+	struct msghdr msg = {
+		.msg_iov = &iov,
+		.msg_iovlen = 1,
+		.msg_control = control,
+		.msg_controllen = sizeof(control),
+	};
+	struct cmsghdr *cmsg;
+	uint32_t op = ALG_OP_DECRYPT;
+
+	memset(control, 0, sizeof(control));
+
+	cmsg = CMSG_FIRSTHDR(&msg);
+	cmsg->cmsg_level = SOL_ALG;
+	cmsg->cmsg_type = ALG_SET_OP;
+	cmsg->cmsg_len = CMSG_LEN(sizeof(op));
+	memcpy(CMSG_DATA(cmsg), &op, sizeof(op));
+
+	cmsg = CMSG_NXTHDR(&msg, cmsg);
+	cmsg->cmsg_level = SOL_ALG;
+	cmsg->cmsg_type = ALG_SET_AEAD_ASSOCLEN;
+	cmsg->cmsg_len = CMSG_LEN(sizeof(assoclen));
+	memcpy(CMSG_DATA(cmsg), &assoclen, sizeof(assoclen));
+
+	return sendmsg(reqfd, &msg, 0);
+}
+
+static void run(void)
+{
+	static const uint32_t assoclens[] = {
+		0x7fffffff,
+		ASSOCLEN_LIMIT,
+		0xffffffff,
+	};
+	size_t i;
+	int reqfd;
+
+	for (i = 0; i < ARRAY_SIZE(assoclens); i++) {
+		reqfd = tst_alg_accept(algfd);
+
+		TEST(send_assoclen(reqfd, assoclens[i]));
+
+		if (assoclens[i] < ASSOCLEN_LIMIT) {
+			if (TST_RET == SEND_SIZE) {
+				tst_res(TPASS, "sendmsg() accepted assoclen=%#x",
+					assoclens[i]);
+			} else if (TST_RET < 0) {
+				tst_res(TFAIL | TTERRNO,
+					"sendmsg() failed for valid assoclen=%#x",
+					assoclens[i]);
+			} else {
+				tst_res(TFAIL,
+					"sendmsg() returned %ld for valid assoclen=%#x",
+					TST_RET, assoclens[i]);
+			}
+		} else if (TST_RET >= 0) {
+			tst_res(TFAIL, "sendmsg() accepted assoclen=%#x",
+				assoclens[i]);
+		} else if (TST_ERR != EINVAL) {
+			tst_res(TFAIL | TTERRNO,
+				"sendmsg() failed for assoclen=%#x with unexpected error",
+				assoclens[i]);
+		} else {
+			tst_res(TPASS, "sendmsg() rejected assoclen=%#x with EINVAL",
+				assoclens[i]);
+		}
+
+		SAFE_CLOSE(reqfd);
+	}
+}
+
+static void setup(void)
+{
+	algfd = tst_alg_setup("aead", "gcm(aes)", NULL, 16);
+}
+
+static void cleanup(void)
+{
+	if (algfd != -1)
+		SAFE_CLOSE(algfd);
+}
+
+static struct tst_test test = {
+	.setup = setup,
+	.cleanup = cleanup,
+	.test_all = run,
+	.tags = (const struct tst_tag[]) {
+		{"linux-git", "e4c06479d7059888adf2f22bc1ebcf053bf691a2"},
+		{"CVE", "2026-52972"},
+		{}
+	},
+};
-- 
2.55.0


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] crypto/af_alg09: Test CVE-2026-52972

[linuxtestproject.agent]

Hi Stephen,

On Fri Nov 13 14:46:30 2026 -0500, Stephen Bertram <sbertram@redhat.com> wrote:
> crypto/af_alg09: Test CVE-2026-52972

> diff --git a/runtest/crypto b/runtest/crypto
> index a8330db9f..082b906c1 100644
> --- a/runtest/crypto
> +++ b/runtest/crypto
> @@ -6,6 +6,7 @@ af_alg05 af_alg05
>  af_alg06 af_alg06
>  af_alg07 af_alg07
>  af_alg08 af_alg08
> +af_alg09 af_alg09

Please also add a "cve-2026-52972 af_alg09" entry to runtest/cve, matching
the other CVE regression tests in this directory.

> +/*\
> + * Test for CVE-2026-52972.
> + *
> + * [Description]

Remove the deprecated [Description] header from the documentation comment
block.

> +static void run(void)
> +{
> +	static const uint32_t assoclens[] = {
> +		0x7fffffff,
> +		ASSOCLEN_LIMIT,
> +		0xffffffff,
> +	};
> +	size_t i;
> +	int reqfd;
> +
> +	for (i = 0; i < ARRAY_SIZE(assoclens); i++) {
> +		reqfd = tst_alg_accept(algfd);
> +
> +		TEST(send_assoclen(reqfd, assoclens[i]));
> +
> +		if (assoclens[i] < ASSOCLEN_LIMIT) {
> +			if (TST_RET == SEND_SIZE) {
> +				tst_res(TPASS, "sendmsg() accepted assoclen=%#x",
> +					assoclens[i]);
> +			} else if (TST_RET < 0) {
> +				tst_res(TFAIL | TTERRNO,
> +					"sendmsg() failed for valid assoclen=%#x",
> +					assoclens[i]);
> +			} else {
> +				tst_res(TFAIL,
> +					"sendmsg() returned %ld for valid assoclen=%#x",
> +					TST_RET, assoclens[i]);
> +			}
> +		} else if (TST_RET >= 0) {
> +			tst_res(TFAIL, "sendmsg() accepted assoclen=%#x",
> +				assoclens[i]);
> +		} else if (TST_ERR != EINVAL) {
> +			tst_res(TFAIL | TTERRNO,
> +				"sendmsg() failed for assoclen=%#x with unexpected error",
> +				assoclens[i]);
> +		} else {
> +			tst_res(TPASS, "sendmsg() rejected assoclen=%#x with EINVAL",
> +				assoclens[i]);
> +		}
> +
> +		SAFE_CLOSE(reqfd);
> +	}
> +}

Move assoclens[] to file scope and use .test = run with .tcnt =
ARRAY_SIZE(assoclens) in struct tst_test instead of looping inside
.test_all. Replace the manual TEST() and if/else result checks with
TST_EXP_VAL(send_assoclen(reqfd, assoclens[i]), SEND_SIZE, ...) for the
valid length and TST_EXP_FAIL2(send_assoclen(reqfd, assoclens[i]), EINVAL,
...) for the rejected lengths.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp