[LTP] [PATCH 2/2] cve/sctphantom: Add reproducer for CVE-2026-64564

[Andrea Cervesato]

Hi Petr,

> Nice reproducer, full of magic. Generally LGTM, few notes bellow?
> Acked-by: Petr Vorel <pvorel@suse.cz>
> Tested-by: Petr Vorel <pvorel@suse.cz>
> 
> > +static void setup(void)
> > +{
> > +	int fd;
> > +	const struct tst_path_val sysctls[] = {
> > +		{"/proc/sys/net/sctp/addip_enable", "1", TST_SR_TCONF},
> > +		{"/proc/sys/net/sctp/addip_noauth_enable", "1", TST_SR_TCONF},
> > +		{}
> > +	};
> Can't this be part of .save_restore in struct tst_test?

I had to move it inside setup/cleanup because we need to load sctp module
_before_ setting the addip_enable, which is available only after loading
the module.

> 
> > +	const struct tst_path_val *sysctl;
> > +
> > +	tst_modprobe("sctp", NULL);
> ...
> 
> > +
> > +/*
> > + * The freed transport is released by an RCU callback; once it is gone,
> > + * reading the association status dereferences the stale primary_path,
> > + * which KASAN reports as a use-after-free.
> > + */
> > +static void probe_uaf(void)
> > +{
> > +	uint8_t buf[512];
> > +	long delay = 1;
> > +	int i;
> > +
> > +	tst_res(TINFO, "probing the stale primary path via SCTP_STATUS");
> > +
> > +	for (i = 0; i < 12; i++) {
> > +		socklen_t len = sizeof(buf);
> > +
> > +		TEST(getsockopt(cli_fd, SOL_SCTP, SCTP_STATUS, buf, &len));
> What is the point of using TEST() macro here. Why not run getsockopt() directly?

Yeah I also removed it, but then messed up with undo history :-)
I will remove it again.

Regards,
--
Andrea Cervesato
SUSE QE Automation Engineer Linux
andrea.cervesato@suse.com