1 /*
2 * Copyright (c) 2017 Google, Inc.
3 *
4 * This program is free software: you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, either version 2 of the License, or
7 * (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program, if not, see <http://www.gnu.org/licenses/>.
16 */
17
18 /*
19 * Regression test for commit ea6789980fda ("assoc_array: Fix a buggy
20 * node-splitting case"), or CVE-2017-12193.
21 *
22 * Reproducing this bug requires adding keys to a keyring in a certain way that
23 * triggers a corner case in the kernel's "associative array" implementation,
24 * which is the data structure used to hold keys in a keyring, indexed by type
25 * and description.
26 *
27 * Specifically, the root node of a keyring's associative array must be
28 * completely filled with keys that all cluster together within the same slot.
29 * Then a key must be added which goes in a different slot. On broken kernels,
30 * this caused a NULL pointer dereference in assoc_array_apply_edit().
31 *
32 * This can be done by carefully crafting key descriptions. However, an easier
33 * way is to just add 16 keyrings and then a non-keyring, since keyrings all go
34 * into their own top-level slot. This test takes the easier approach.
35 */
36
37 #include <errno.h>
38 #include <stdio.h>
39 #include <stdlib.h>
40 #include <sys/wait.h>
41
42 #include "tst_test.h"
43 #include "lapi/keyctl.h"
44
45 #define ASSOC_ARRAY_FAN_OUT 16
46
do_test(void)47 static void do_test(void)
48 {
49 int status;
50
51 TEST(keyctl(KEYCTL_JOIN_SESSION_KEYRING, NULL));
52 if (TEST_RETURN < 0)
53 tst_brk(TBROK | TTERRNO, "failed to join new session keyring");
54
55 if (SAFE_FORK() == 0) {
56 char description[32];
57 const char payload[] = "payload";
58 int i;
59
60 for (i = 0; i < ASSOC_ARRAY_FAN_OUT; i++) {
61 sprintf(description, "keyring%d", i);
62 TEST(add_key("keyring", description, NULL, 0,
63 KEY_SPEC_SESSION_KEYRING));
64 if (TEST_RETURN < 0) {
65 tst_brk(TBROK | TTERRNO,
66 "unable to create keyring %d", i);
67 }
68 }
69
70 TEST(add_key("user", "userkey", payload, sizeof(payload),
71 KEY_SPEC_SESSION_KEYRING));
72 if (TEST_RETURN < 0)
73 tst_brk(TBROK | TTERRNO, "unable to create user key");
74
75 exit(0);
76 }
77
78 SAFE_WAIT(&status);
79 if (WIFEXITED(status) && WEXITSTATUS(status) == 0)
80 tst_res(TPASS, "didn't crash while filling keyring");
81 else if (WIFSIGNALED(status) && WTERMSIG(status) == SIGKILL)
82 tst_res(TFAIL, "kernel oops while filling keyring");
83 else
84 tst_brk(TBROK, "Child %s", tst_strstatus(status));
85 }
86
87 static struct tst_test test = {
88 .test_all = do_test,
89 .forks_child = 1,
90 };
91