From patchwork Tue Aug 25 16:07:32 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Martin Doucha X-Patchwork-Id: 1351160 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.linux.it (client-ip=2001:1418:10:5::2; helo=picard.linux.it; envelope-from=ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=suse.cz Received: from picard.linux.it (picard.linux.it [IPv6:2001:1418:10:5::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4BbYnG6WpZz9sSP for ; Wed, 26 Aug 2020 02:08:18 +1000 (AEST) Received: from picard.linux.it (localhost [IPv6:::1]) by picard.linux.it (Postfix) with ESMTP id 456653C2EEA for ; Tue, 25 Aug 2020 18:08:16 +0200 (CEST) X-Original-To: ltp@lists.linux.it Delivered-To: ltp@picard.linux.it Received: from in-5.smtp.seeweb.it (in-5.smtp.seeweb.it [IPv6:2001:4b78:1:20::5]) by picard.linux.it (Postfix) with ESMTP id 0565A3C1A4E for ; Tue, 25 Aug 2020 18:07:37 +0200 (CEST) Received: from mx2.suse.de (mx2.suse.de [195.135.220.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by in-5.smtp.seeweb.it (Postfix) with ESMTPS id 4BD1A600774 for ; Tue, 25 Aug 2020 18:07:37 +0200 (CEST) Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 35D9AB039 for ; Tue, 25 Aug 2020 16:08:07 +0000 (UTC) From: Martin Doucha To: ltp@lists.linux.it Date: Tue, 25 Aug 2020 18:07:32 +0200 Message-Id: <20200825160735.24602-2-mdoucha@suse.cz> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200825160735.24602-1-mdoucha@suse.cz> References: <20200825160735.24602-1-mdoucha@suse.cz> MIME-Version: 1.0 X-Virus-Scanned: clamav-milter 0.102.4 at in-5.smtp.seeweb.it X-Virus-Status: Clean X-Spam-Status: No, score=0.0 required=7.0 tests=SPF_HELO_NONE,SPF_PASS autolearn=disabled version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on in-5.smtp.seeweb.it Subject: [LTP] [PATCH v2 1/4] Add SAFE_SYSINFO() macro X-BeenThere: ltp@lists.linux.it X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux Test Project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it Sender: "ltp" Signed-off-by: Martin Doucha Reviewed-by: Petr Vorel --- Changes since v1: New patch include/tst_safe_macros.h | 5 +++++ lib/safe_macros.c | 20 ++++++++++++++++++++ 2 files changed, 25 insertions(+) diff --git a/include/tst_safe_macros.h b/include/tst_safe_macros.h index 000381c4f..053c3bcf9 100644 --- a/include/tst_safe_macros.h +++ b/include/tst_safe_macros.h @@ -12,6 +12,7 @@ #include #include #include +#include #include #include #include @@ -598,4 +599,8 @@ long tst_safe_ptrace(const char *file, const int lineno, int req, pid_t pid, #define SAFE_PTRACE(req, pid, addr, data) \ tst_safe_ptrace(__FILE__, __LINE__, req, pid, addr, data) +int safe_sysinfo(const char *file, const int lineno, struct sysinfo *info); +#define SAFE_SYSINFO(info) \ + safe_sysinfo(__FILE__, __LINE__, (info)) + #endif /* SAFE_MACROS_H__ */ diff --git a/lib/safe_macros.c b/lib/safe_macros.c index dde9b7b5e..5ef9ee1c5 100644 --- a/lib/safe_macros.c +++ b/lib/safe_macros.c @@ -11,6 +11,7 @@ #include #include #include +#include #include #include #include @@ -1088,3 +1089,22 @@ int safe_mincore(const char *file, const int lineno, void *start, return rval; } + +int safe_sysinfo(const char *file, const int lineno, struct sysinfo *info) +{ + int ret; + + errno = 0; + ret = sysinfo(info); + + if (ret == -1) { + tst_brkm_(file, lineno, TBROK | TERRNO, NULL, + "sysinfo() failed"); + } else if (ret) { + tst_brkm_(file, lineno, TBROK | TERRNO, NULL, + "Invalid sysinfo() return value %d", ret); + + } + + return ret; +} From patchwork Tue Aug 25 16:07:33 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Martin Doucha X-Patchwork-Id: 1351158 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.linux.it (client-ip=213.254.12.146; helo=picard.linux.it; envelope-from=ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=suse.cz Received: from picard.linux.it (picard.linux.it [213.254.12.146]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4BbYmx0pMlz9sSP for ; Wed, 26 Aug 2020 02:08:01 +1000 (AEST) Received: from picard.linux.it (localhost [IPv6:::1]) by picard.linux.it (Postfix) with ESMTP id 8291F3C2EDB for ; Tue, 25 Aug 2020 18:07:58 +0200 (CEST) X-Original-To: ltp@lists.linux.it Delivered-To: ltp@picard.linux.it Received: from in-5.smtp.seeweb.it (in-5.smtp.seeweb.it [217.194.8.5]) by picard.linux.it (Postfix) with ESMTP id DB23A3C2497 for ; Tue, 25 Aug 2020 18:07:37 +0200 (CEST) Received: from mx2.suse.de (mx2.suse.de [195.135.220.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by in-5.smtp.seeweb.it (Postfix) with ESMTPS id 406ED600770 for ; Tue, 25 Aug 2020 18:07:37 +0200 (CEST) Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 45496B0A5 for ; Tue, 25 Aug 2020 16:08:07 +0000 (UTC) From: Martin Doucha To: ltp@lists.linux.it Date: Tue, 25 Aug 2020 18:07:33 +0200 Message-Id: <20200825160735.24602-3-mdoucha@suse.cz> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200825160735.24602-1-mdoucha@suse.cz> References: <20200825160735.24602-1-mdoucha@suse.cz> MIME-Version: 1.0 X-Virus-Scanned: clamav-milter 0.102.4 at in-5.smtp.seeweb.it X-Virus-Status: Clean X-Spam-Status: No, score=0.0 required=7.0 tests=SPF_HELO_NONE,SPF_PASS autolearn=disabled version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on in-5.smtp.seeweb.it Subject: [LTP] [PATCH v2 2/4] Add tst_pollute_memory() helper function X-BeenThere: ltp@lists.linux.it X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux Test Project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it Sender: "ltp" tst_pollute_memory() fills available RAM up to specified limit with given fill byte. Useful for testing data disclosure vulnerablities. Signed-off-by: Martin Doucha Reviewed-by: Petr Vorel --- Changes since v1: New patch include/tst_memutils.h | 22 +++++++++++++++ lib/tst_memutils.c | 62 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 84 insertions(+) create mode 100644 include/tst_memutils.h create mode 100644 lib/tst_memutils.c diff --git a/include/tst_memutils.h b/include/tst_memutils.h new file mode 100644 index 000000000..91dad07cd --- /dev/null +++ b/include/tst_memutils.h @@ -0,0 +1,22 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* + * Copyright (c) 2020 SUSE LLC + */ + +#ifndef TST_MEMUTILS_H__ +#define TST_MEMUTILS_H__ + +/* + * Fill up to maxsize physical memory with fillchar, then free it for reuse. + * If maxsize is zero, fill as much memory as possible. This function is + * intended for data disclosure vulnerability tests to reduce the probability + * that a vulnerable kernel will leak a block of memory that was full of + * zeroes by chance. + * + * The function keeps a safety margin to avoid invoking OOM killer and + * respects the limitations of available address space. (Less than 3GB can be + * polluted on a 32bit system regardless of available physical RAM.) + */ +void tst_pollute_memory(size_t maxsize, int fillchar); + +#endif /* TST_MEMUTILS_H__ */ diff --git a/lib/tst_memutils.c b/lib/tst_memutils.c new file mode 100644 index 000000000..f134d90c9 --- /dev/null +++ b/lib/tst_memutils.c @@ -0,0 +1,62 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * Copyright (c) 2020 SUSE LLC + */ + +#include +#include +#include +#include + +#define TST_NO_DEFAULT_MAIN +#include "tst_test.h" + +#define BLOCKSIZE (16 * 1024 * 1024) + +void tst_pollute_memory(size_t maxsize, int fillchar) +{ + size_t i, map_count = 0, safety = 0, blocksize = BLOCKSIZE; + void **map_blocks; + struct sysinfo info; + + SAFE_SYSINFO(&info); + safety = 4096 * SAFE_SYSCONF(_SC_PAGESIZE) / info.mem_unit; + + if (info.freeswap > safety) + safety = 0; + + /* Not enough free memory to avoid invoking OOM killer */ + if (info.freeram <= safety) + return; + + if (!maxsize) + maxsize = SIZE_MAX; + + if (info.freeram - safety < maxsize / info.mem_unit) + maxsize = (info.freeram - safety) * info.mem_unit; + + blocksize = MIN(maxsize, blocksize); + map_count = maxsize / blocksize; + map_blocks = SAFE_MALLOC(map_count * sizeof(void *)); + + /* + * Keep allocating until the first failure. The address space may be + * too fragmented or just smaller than maxsize. + */ + for (i = 0; i < map_count; i++) { + map_blocks[i] = mmap(NULL, blocksize, PROT_READ | PROT_WRITE, + MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); + + if (map_blocks[i] == MAP_FAILED) { + map_count = i; + break; + } + + memset(map_blocks[i], fillchar, blocksize); + } + + for (i = 0; i < map_count; i++) + SAFE_MUNMAP(map_blocks[i], blocksize); + + free(map_blocks); +} From patchwork Tue Aug 25 16:07:34 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Martin Doucha X-Patchwork-Id: 1351159 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.linux.it (client-ip=213.254.12.146; helo=picard.linux.it; envelope-from=ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=suse.cz Received: from picard.linux.it (picard.linux.it [213.254.12.146]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4BbYn54VH1z9sSP for ; Wed, 26 Aug 2020 02:08:09 +1000 (AEST) Received: from picard.linux.it (localhost [IPv6:::1]) by picard.linux.it (Postfix) with ESMTP id 1DE773C2EC6 for ; Tue, 25 Aug 2020 18:08:07 +0200 (CEST) X-Original-To: ltp@lists.linux.it Delivered-To: ltp@picard.linux.it Received: from in-6.smtp.seeweb.it (in-6.smtp.seeweb.it [IPv6:2001:4b78:1:20::6]) by picard.linux.it (Postfix) with ESMTP id EABF33C13D8 for ; Tue, 25 Aug 2020 18:07:37 +0200 (CEST) Received: from mx2.suse.de (mx2.suse.de [195.135.220.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by in-6.smtp.seeweb.it (Postfix) with ESMTPS id 416A21400B62 for ; Tue, 25 Aug 2020 18:07:37 +0200 (CEST) Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 58AB0B5A2 for ; Tue, 25 Aug 2020 16:08:07 +0000 (UTC) From: Martin Doucha To: ltp@lists.linux.it Date: Tue, 25 Aug 2020 18:07:34 +0200 Message-Id: <20200825160735.24602-4-mdoucha@suse.cz> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200825160735.24602-1-mdoucha@suse.cz> References: <20200825160735.24602-1-mdoucha@suse.cz> MIME-Version: 1.0 X-Virus-Scanned: clamav-milter 0.102.4 at in-6.smtp.seeweb.it X-Virus-Status: Clean X-Spam-Status: No, score=0.0 required=7.0 tests=SPF_HELO_NONE,SPF_PASS autolearn=disabled version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on in-6.smtp.seeweb.it Subject: [LTP] [PATCH v2 3/4] ioctl_sg01: Pollute free memory in setup X-BeenThere: ltp@lists.linux.it X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux Test Project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it Sender: "ltp" The test wasn't reliable if most of available memory was full of zeroes. Pollute free memory to increase the chance of detecting data leak. Signed-off-by: Martin Doucha Reviewed-by: Petr Vorel --- Changes since v1: - Split patch - Use tst_pollute_memory() instead of allocating and pre-polluting a fixed-size block of memory in setup(). testcases/kernel/syscalls/ioctl/ioctl_sg01.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/testcases/kernel/syscalls/ioctl/ioctl_sg01.c b/testcases/kernel/syscalls/ioctl/ioctl_sg01.c index daaa96be5..8c9fd0dae 100644 --- a/testcases/kernel/syscalls/ioctl/ioctl_sg01.c +++ b/testcases/kernel/syscalls/ioctl/ioctl_sg01.c @@ -7,9 +7,7 @@ * CVE-2018-1000204 * * Test ioctl(SG_IO) and check that kernel doesn't leak data. Requires - * a read-accessible SCSI-compatible device (e.g. SATA disk). Running oom* - * test program before this one may increase the chance of successfully - * reproducing the bug. + * a read-accessible generic SCSI device (e.g. a DVD drive). * * Leak fixed in: * @@ -29,8 +27,9 @@ #include #include #include "tst_test.h" +#include "tst_memutils.h" -#define BUF_SIZE 128 * 4096 +#define BUF_SIZE (128 * 4096) #define CMD_SIZE 6 static int devfd = -1; @@ -80,6 +79,10 @@ static void setup(void) tst_brk(TCONF, "Could not find any usable SCSI device"); tst_res(TINFO, "Found SCSI device %s", devpath); + + /* Pollute some memory to avoid false negatives */ + tst_pollute_memory(0, 0x42); + devfd = SAFE_OPEN(devpath, O_RDONLY); query.interface_id = 'S'; query.dxfer_direction = SG_DXFER_FROM_DEV; From patchwork Tue Aug 25 16:07:35 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Martin Doucha X-Patchwork-Id: 1351156 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.linux.it (client-ip=213.254.12.146; helo=picard.linux.it; envelope-from=ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=suse.cz Received: from picard.linux.it (picard.linux.it [213.254.12.146]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4BbYmn28wQz9sTX for ; Wed, 26 Aug 2020 02:07:52 +1000 (AEST) Received: from picard.linux.it (localhost [IPv6:::1]) by picard.linux.it (Postfix) with ESMTP id EF02F3C262C for ; Tue, 25 Aug 2020 18:07:48 +0200 (CEST) X-Original-To: ltp@lists.linux.it Delivered-To: ltp@picard.linux.it Received: from in-6.smtp.seeweb.it (in-6.smtp.seeweb.it [217.194.8.6]) by picard.linux.it (Postfix) with ESMTP id C81CD3C1A4E for ; Tue, 25 Aug 2020 18:07:37 +0200 (CEST) Received: from mx2.suse.de (mx2.suse.de [195.135.220.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by in-6.smtp.seeweb.it (Postfix) with ESMTPS id 42D411400B65 for ; Tue, 25 Aug 2020 18:07:37 +0200 (CEST) Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 69735B5A9 for ; Tue, 25 Aug 2020 16:08:07 +0000 (UTC) From: Martin Doucha To: ltp@lists.linux.it Date: Tue, 25 Aug 2020 18:07:35 +0200 Message-Id: <20200825160735.24602-5-mdoucha@suse.cz> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200825160735.24602-1-mdoucha@suse.cz> References: <20200825160735.24602-1-mdoucha@suse.cz> MIME-Version: 1.0 X-Virus-Scanned: clamav-milter 0.102.4 at in-6.smtp.seeweb.it X-Virus-Status: Clean X-Spam-Status: No, score=0.0 required=7.0 tests=SPF_HELO_NONE,SPF_PASS autolearn=disabled version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on in-6.smtp.seeweb.it Subject: [LTP] [PATCH v2 4/4] ioctl_sg01: Loop data leak check 100 times X-BeenThere: ltp@lists.linux.it X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux Test Project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ltp-bounces+incoming=patchwork.ozlabs.org@lists.linux.it Sender: "ltp" Even with pre-polluted memory, running the test just once might result in a false negative. Loop it a few times to increase reliability. Signed-off-by: Martin Doucha Reviewed-by: Petr Vorel --- Changes since v1: - New patch (split) testcases/kernel/syscalls/ioctl/ioctl_sg01.c | 21 +++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/testcases/kernel/syscalls/ioctl/ioctl_sg01.c b/testcases/kernel/syscalls/ioctl/ioctl_sg01.c index 8c9fd0dae..8ad2ffed5 100644 --- a/testcases/kernel/syscalls/ioctl/ioctl_sg01.c +++ b/testcases/kernel/syscalls/ioctl/ioctl_sg01.c @@ -100,19 +100,22 @@ static void cleanup(void) static void run(void) { - size_t i; + size_t i, j; memset(buffer, 0, BUF_SIZE); - TEST(ioctl(devfd, SG_IO, &query)); - if (TST_RET != 0 && TST_RET != -1) - tst_brk(TBROK | TTERRNO, "Invalid ioctl() return value"); + for (i = 0; i < 100; i++) { + TEST(ioctl(devfd, SG_IO, &query)); - /* Check the output buffer even if ioctl() failed, just in case. */ - for (i = 0; i < BUF_SIZE; i++) { - if (buffer[i]) { - tst_res(TFAIL, "Kernel memory leaked"); - return; + if (TST_RET != 0 && TST_RET != -1) + tst_brk(TBROK|TTERRNO, "Invalid ioctl() return value"); + + /* Check the buffer even if ioctl() failed, just in case. */ + for (j = 0; j < BUF_SIZE; j++) { + if (buffer[j]) { + tst_res(TFAIL, "Kernel memory leaked"); + return; + } } }