Re: [LTP] crypto/af_alg09: Test CVE-2026-52972

[linuxtestproject.agent@gmail.com]

Hi Stephen,

On Fri Nov 13 14:46:30 2026 -0500, Stephen Bertram <sbertram@redhat.com> wrote:
> crypto/af_alg09: Test CVE-2026-52972

> diff --git a/runtest/crypto b/runtest/crypto
> index a8330db9f..082b906c1 100644
> --- a/runtest/crypto
> +++ b/runtest/crypto
> @@ -6,6 +6,7 @@ af_alg05 af_alg05
>  af_alg06 af_alg06
>  af_alg07 af_alg07
>  af_alg08 af_alg08
> +af_alg09 af_alg09

Please also add a "cve-2026-52972 af_alg09" entry to runtest/cve, matching
the other CVE regression tests in this directory.

> +/*\
> + * Test for CVE-2026-52972.
> + *
> + * [Description]

Remove the deprecated [Description] header from the documentation comment
block.

> +static void run(void)
> +{
> +	static const uint32_t assoclens[] = {
> +		0x7fffffff,
> +		ASSOCLEN_LIMIT,
> +		0xffffffff,
> +	};
> +	size_t i;
> +	int reqfd;
> +
> +	for (i = 0; i < ARRAY_SIZE(assoclens); i++) {
> +		reqfd = tst_alg_accept(algfd);
> +
> +		TEST(send_assoclen(reqfd, assoclens[i]));
> +
> +		if (assoclens[i] < ASSOCLEN_LIMIT) {
> +			if (TST_RET == SEND_SIZE) {
> +				tst_res(TPASS, "sendmsg() accepted assoclen=%#x",
> +					assoclens[i]);
> +			} else if (TST_RET < 0) {
> +				tst_res(TFAIL | TTERRNO,
> +					"sendmsg() failed for valid assoclen=%#x",
> +					assoclens[i]);
> +			} else {
> +				tst_res(TFAIL,
> +					"sendmsg() returned %ld for valid assoclen=%#x",
> +					TST_RET, assoclens[i]);
> +			}
> +		} else if (TST_RET >= 0) {
> +			tst_res(TFAIL, "sendmsg() accepted assoclen=%#x",
> +				assoclens[i]);
> +		} else if (TST_ERR != EINVAL) {
> +			tst_res(TFAIL | TTERRNO,
> +				"sendmsg() failed for assoclen=%#x with unexpected error",
> +				assoclens[i]);
> +		} else {
> +			tst_res(TPASS, "sendmsg() rejected assoclen=%#x with EINVAL",
> +				assoclens[i]);
> +		}
> +
> +		SAFE_CLOSE(reqfd);
> +	}
> +}

Move assoclens[] to file scope and use .test = run with .tcnt =
ARRAY_SIZE(assoclens) in struct tst_test instead of looping inside
.test_all. Replace the manual TEST() and if/else result checks with
TST_EXP_VAL(send_assoclen(reqfd, assoclens[i]), SEND_SIZE, ...) for the
valid length and TST_EXP_FAIL2(send_assoclen(reqfd, assoclens[i]), EINVAL,
...) for the rejected lengths.

Verdict - Needs revision

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp