[LTP] [PATCH v4] io_uring/pintheft: Add CVE-2026-43494 regression test

[Martin Doucha]

Hi!

On 5/24/26 20:16, Petr Vorel wrote:
>> +	rds_fd = socket(AF_RDS, SOCK_SEQPACKET | SOCK_CLOEXEC, 0);
>> +	if (rds_fd < 0) {
>> +		if (errno == EAFNOSUPPORT || errno == ESOCKTNOSUPPORT ||
>> +		    errno == EPROTONOSUPPORT || errno == ENOPROTOOPT)
>> +			tst_brk(TCONF | TERRNO, "RDS is not available");
>> +
>> +		tst_brk(TBROK | TERRNO, "socket(AF_RDS) failed");
> 
> Just a quick Sunday evening comment (not yet looking into the reproducer itself).
> I wonder if we need this complicated check when we already have kconfig based
> checks at the end. Could we just simply use SAFE_SOCKET() here? Or have you
> encountered problems with older kernels?

I've checked, SAFE_SOCKET() will fail on kernel-default-base due to the 
usual kconfig-RPM mismatch.

>> +	if (clone_buffers(ring_fd2, ring_fd1)) {
>> +		if (errno == EINVAL || errno == EOPNOTSUPP)
>> +			tst_brk(TCONF | TERRNO, "IORING_REGISTER_CLONE_BUFFERS is not supported");
> Also here do we need it? IMHO CONFIG_IO_URING should be enough.
> And if errno is really needed, it'd IMHO be better to be in handled in
> clone_buffers(), not separately.

IORING_REGISTER_CLONE_BUFFERS was added in kernel v6.12 so the feature 
check is also needed.

-- 
Martin Doucha   mdoucha@suse.cz
SW Quality Engineer
SUSE LINUX, s.r.o.
CORSO IIa
Krizikova 148/34
186 00 Prague 8
Czech Republic