[LTP] Add test for CVE 2026-53362

[Martin Doucha]

On 7/22/26 09:36, Andrea Cervesato wrote:
>>> +	/* Splice input pipe buffer page into socket */
>>> +	memset(buf, 0, TEST_MSGSIZE);
>>> +	buf[TEST_MSGSIZE - 6] = 1;
>>> +	SAFE_WRITE(SAFE_WRITE_ALL, pipefds[1][1], buf, TEST_MSGSIZE);
>>> +	splice(pipefds[1][0], NULL, sockfd, NULL, TEST_MSGSIZE, SPLICE_F_MORE);
>>> +	tee(pipefds[0][0], pipefds[1][1], PATTERN_SIZE, 0);
>>> +	splice(pipefds[1][0], NULL, sockfd, NULL, PATTERN_SIZE, SPLICE_F_MORE);
>>
>> The file already includes "lapi/splice.h", which provides
>> `SAFE_SPLICE()`. Both splice() calls here use the bare syscall
>> instead, so their return value is discarded. If either call fails or
>> returns short, the reproduction sequence silently doesn't happen and
>> the iteration would just report TPASS without having exercised
>> anything. Would SAFE_SPLICE() be preferable here?
> 
> mmmh is this the case where splice() is supposed to fail but triggering
> the CVE into the kernel? if so, we probably need to add a short comment
> so we know that SAFE_SPLICE() is not a good choice.

Both splice() calls are supposed to succeed but it doesn't really matter 
if they fail a few times during the test run. Yes, if they fail all the 
time, the bug will not get triggered. So if you want to be extra 
careful, feel free to change the splice()s to SAFE_SPLICE() during merge.

-- 
Martin Doucha   mdoucha@suse.cz
SW Quality Engineer
SUSE LINUX, s.r.o.
CORSO IIa
Krizikova 148/34
186 00 Prague 8
Czech Republic