From patchwork Thu Feb 17 12:16:00 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Martin Doucha X-Patchwork-Id: 1594207 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=suse.cz header.i=@suse.cz header.a=rsa-sha256 header.s=susede2_rsa header.b=EpHDoJsc; dkim=fail reason="signature verification failed" header.d=suse.cz header.i=@suse.cz header.a=ed25519-sha256 header.s=susede2_ed25519 header.b=Zwfzsx5V; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.linux.it (client-ip=2001:1418:10:5::2; helo=picard.linux.it; envelope-from=ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it; receiver=) Received: from picard.linux.it (picard.linux.it [IPv6:2001:1418:10:5::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4Jzv1g3yYxz9sFk for ; Thu, 17 Feb 2022 23:16:07 +1100 (AEDT) Received: from picard.linux.it (localhost [IPv6:::1]) by picard.linux.it (Postfix) with ESMTP id A8E923CA08E for ; Thu, 17 Feb 2022 13:16:04 +0100 (CET) X-Original-To: ltp@lists.linux.it Delivered-To: ltp@picard.linux.it Received: from in-6.smtp.seeweb.it (in-6.smtp.seeweb.it [217.194.8.6]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by picard.linux.it (Postfix) with ESMTPS id E27953C93A9 for ; Thu, 17 Feb 2022 13:16:02 +0100 (CET) Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.220.29]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by in-6.smtp.seeweb.it (Postfix) with ESMTPS id 41108140163B for ; Thu, 17 Feb 2022 13:16:01 +0100 (CET) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 505AF1F383; Thu, 17 Feb 2022 12:16:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_rsa; t=1645100161; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=CoCRu4jHnDrQ6xq0vND1zJx5DGVHrN5R/igdb/I/w9A=; b=EpHDoJscG/coGzTiHBlHyREXJ5NkMVmu5HMJRgY7+O6RbR6itWm2rjOkby+KVUbsNieCTE qf+pgc3Syz7gSZWh9pxbigMG3W520wXbYvjasaAYNlgcCoWg0yT+8FRiMcW5r4BrtfkyT7 nT1SIvHiz7HvF6LGfrBAc/sYQKYs31s= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_ed25519; t=1645100161; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=CoCRu4jHnDrQ6xq0vND1zJx5DGVHrN5R/igdb/I/w9A=; b=Zwfzsx5Vpm2Q9NFA1TkpGhYs3c/BVwBLMEJE57UqL/OgkF8yVT4fyDXU0PnurTeeRn78Qt /RcdXA+bvOnqhtDw== Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 3CFE513BE2; Thu, 17 Feb 2022 12:16:01 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id 9YXvDYE8DmJhdQAAMHmgww (envelope-from ); Thu, 17 Feb 2022 12:16:01 +0000 From: Martin Doucha To: Marcos Paulo de Souza , ltp@lists.linux.it Date: Thu, 17 Feb 2022 13:16:00 +0100 Message-Id: <20220217121600.3002-1-mdoucha@suse.cz> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Virus-Scanned: clamav-milter 0.102.4 at in-6.smtp.seeweb.it X-Virus-Status: Clean X-Spam-Status: No, score=0.1 required=7.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=disabled version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on in-6.smtp.seeweb.it Subject: [LTP] [PATCH] Add test for CVE 2021-22600 X-BeenThere: ltp@lists.linux.it X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux Test Project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it Sender: "ltp" Fixes #917 Signed-off-by: Martin Doucha --- On a vulnerable system, the test will get stuck in the last setsockopt() call and become unkillable. Reproducer works reliably on affected SLE kernels. runtest/syscalls | 1 + .../kernel/syscalls/setsockopt/.gitignore | 1 + .../kernel/syscalls/setsockopt/setsockopt09.c | 111 ++++++++++++++++++ 3 files changed, 113 insertions(+) create mode 100644 testcases/kernel/syscalls/setsockopt/setsockopt09.c diff --git a/runtest/syscalls b/runtest/syscalls index ce6f89f88..6c88454cc 100644 --- a/runtest/syscalls +++ b/runtest/syscalls @@ -1391,6 +1391,7 @@ setsockopt05 setsockopt05 setsockopt06 setsockopt06 setsockopt07 setsockopt07 setsockopt08 setsockopt08 +setsockopt09 setsockopt09 settimeofday01 settimeofday01 settimeofday02 settimeofday02 diff --git a/testcases/kernel/syscalls/setsockopt/.gitignore b/testcases/kernel/syscalls/setsockopt/.gitignore index 95a5e43f8..fd3235bb3 100644 --- a/testcases/kernel/syscalls/setsockopt/.gitignore +++ b/testcases/kernel/syscalls/setsockopt/.gitignore @@ -6,3 +6,4 @@ /setsockopt06 /setsockopt07 /setsockopt08 +/setsockopt09 diff --git a/testcases/kernel/syscalls/setsockopt/setsockopt09.c b/testcases/kernel/syscalls/setsockopt/setsockopt09.c new file mode 100644 index 000000000..2b8dc5171 --- /dev/null +++ b/testcases/kernel/syscalls/setsockopt/setsockopt09.c @@ -0,0 +1,111 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * Copyright (c) 2022 SUSE LLC + * Author: Marcos Paulo de Souza + * LTP port: Martin Doucha + */ + +/* + * CVE-2021-22600 + * + * Check for possible double free of rx_owner_map after switching packet + * interface versions. Kernel crash fixed in: + * + * commit ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 + * Author: Willem de Bruijn + * Date: Wed Dec 15 09:39:37 2021 -0500 + * + * net/packet: rx_owner_map depends on pg_vec + */ + +#define _GNU_SOURCE +#include +#include +#include +#include + +#include "tst_test.h" +#include "lapi/if_packet.h" + +static int sock = -1; + +static void setup(void) +{ + int real_uid = getuid(); + int real_gid = getgid(); + + SAFE_TRY_FILE_PRINTF("/proc/sys/user/max_user_namespaces", "%d", 10); + + SAFE_UNSHARE(CLONE_NEWUSER); + SAFE_UNSHARE(CLONE_NEWNET); + SAFE_FILE_PRINTF("/proc/self/setgroups", "deny"); + SAFE_FILE_PRINTF("/proc/self/uid_map", "0 %d 1", real_uid); + SAFE_FILE_PRINTF("/proc/self/gid_map", "0 %d 1", real_gid); +} + +static void run(void) +{ + unsigned int version = TPACKET_V3; + struct tpacket_req3 req = { + .tp_block_size = 16384, + .tp_block_nr = 256, + .tp_frame_size = TPACKET_ALIGNMENT << 7, + .tp_retire_blk_tov = 64, + .tp_feature_req_word = TP_FT_REQ_FILL_RXHASH + }; + + req.tp_frame_nr = req.tp_block_size * req.tp_block_nr; + req.tp_frame_nr /= req.tp_frame_size; + + sock = SAFE_SOCKET(AF_PACKET, SOCK_RAW, 0); + TEST(setsockopt(sock, SOL_PACKET, PACKET_VERSION, &version, + sizeof(version))); + + if (TST_RET == -1 && TST_ERR == EINVAL) + tst_brk(TCONF | TTERRNO, "TPACKET_V3 not supported"); + + if (TST_RET) { + tst_brk(TBROK | TTERRNO, + "setsockopt(PACKET_VERSION, TPACKET_V3"); + } + + /* Allocate owner map and then free it again */ + SAFE_SETSOCKOPT(sock, SOL_PACKET, PACKET_RX_RING, &req, sizeof(req)); + req.tp_block_nr = 0; + req.tp_frame_nr = 0; + SAFE_SETSOCKOPT(sock, SOL_PACKET, PACKET_RX_RING, &req, sizeof(req)); + + /* Switch interface version and trigger double free of owner map */ + SAFE_SETSOCKOPT_INT(sock, SOL_PACKET, PACKET_VERSION, TPACKET_V2); + SAFE_SETSOCKOPT(sock, SOL_PACKET, PACKET_RX_RING, &req, sizeof(req)); + + tst_res(TPASS, "Nothing bad happened, probably"); +} + +static void cleanup(void) +{ + if (sock >= 0) + SAFE_CLOSE(sock); +} + +static struct tst_test test = { + .test_all = run, + .setup = setup, + .cleanup = cleanup, + .timeout = 5, + .taint_check = TST_TAINT_W | TST_TAINT_D, + .needs_kconfigs = (const char *[]) { + "CONFIG_USER_NS=y", + "CONFIG_NET_NS=y", + NULL + }, + .save_restore = (const char * const[]) { + "?/proc/sys/user/max_user_namespaces", + NULL, + }, + .tags = (const struct tst_tag[]) { + {"linux-git", "ec6af094ea28"}, + {"CVE", "2021-22600"}, + {} + } +};