1 /*
2 * Copyright (c) 2017 Richard Palethorpe <rpalethorpe@suse.com>
3 *
4 * This program is free software: you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, either version 2 of the License, or
7 * (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program. If not, see <http://www.gnu.org/licenses/>.
16 */
17 /* Test for CVE-2017-7308 on a raw socket's ring buffer
18 *
19 * Try to set tpacket_req3.tp_sizeof_priv to a value with the high bit set. So
20 * that tp_block_size < tp_sizeof_priv. If the vulnerability is present then
21 * this will cause an integer arithmetic overflow and the absurd
22 * tp_sizeof_priv value will be allowed. If it has been fixed then setsockopt
23 * will fail with EINVAL.
24 *
25 * We also try a good configuration to make sure it is not failing with EINVAL
26 * for some other reason.
27 *
28 * For a better and more interesting discussion of this CVE see:
29 * https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html
30 */
31
32 #include <errno.h>
33 #include "tst_test.h"
34 #include "tst_safe_net.h"
35 #include "config.h"
36
37 #ifdef HAVE_LINUX_IF_PACKET_H
38 # include <linux/if_packet.h>
39 #endif
40
41 #ifdef HAVE_LINUX_IF_ETHER_H
42 # include <linux/if_ether.h>
43 #endif
44
45 #ifndef ETH_P_ALL
46 # define ETH_P_ALL 0x0003
47 #endif
48
49 #ifndef PACKET_RX_RING
50 # define PACKET_RX_RING 5
51 #endif
52
53 #ifndef PACKET_VERSION
54 # define PACKET_VERSION 10
55 #endif
56
57 #ifndef HAVE_STRUCT_TPACKET_REQ3
58 # define TPACKET_V3 2
59
60 struct tpacket_req3 {
61 unsigned int tp_block_size;
62 unsigned int tp_block_nr;
63 unsigned int tp_frame_size;
64 unsigned int tp_frame_nr;
65 unsigned int tp_retire_blk_tov;
66 unsigned int tp_sizeof_priv;
67 unsigned int tp_feature_req_word;
68 };
69 #endif
70
71 static int sk;
72 static long pgsz;
73
setup(void)74 static void setup(void)
75 {
76 pgsz = SAFE_SYSCONF(_SC_PAGESIZE);
77 }
78
cleanup(void)79 static void cleanup(void)
80 {
81 if (sk > 0)
82 SAFE_CLOSE(sk);
83 }
84
create_skbuf(unsigned int sizeof_priv)85 static int create_skbuf(unsigned int sizeof_priv)
86 {
87 int ver = TPACKET_V3;
88 struct tpacket_req3 req = {};
89
90 req.tp_block_size = pgsz;
91 req.tp_block_nr = 2;
92 req.tp_frame_size = req.tp_block_size;
93 req.tp_frame_nr = req.tp_block_nr;
94 req.tp_retire_blk_tov = 100;
95
96 req.tp_sizeof_priv = sizeof_priv;
97
98 sk = SAFE_SOCKET(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
99 TEST(setsockopt(sk, SOL_PACKET, PACKET_VERSION, &ver, sizeof(ver)));
100 if (TEST_RETURN && TEST_ERRNO == EINVAL)
101 tst_brk(TCONF | TTERRNO, "TPACKET_V3 not supported");
102 if (TEST_RETURN)
103 tst_brk(TBROK | TTERRNO, "setsockopt(sk, SOL_PACKET, PACKET_VERSION, TPACKET_V3)");
104
105 return setsockopt(sk, SOL_PACKET, PACKET_RX_RING, &req, sizeof(req));
106 }
107
good_size(void)108 static void good_size(void)
109 {
110 TEST(create_skbuf(512));
111 if (TEST_RETURN)
112 tst_brk(TBROK | TTERRNO, "Can't create ring buffer with good settings");
113
114 tst_res(TPASS, "Can create ring buffer with good settinegs");
115 }
116
bad_size(void)117 static void bad_size(void)
118 {
119 TEST(create_skbuf(3U << 30));
120 if (TEST_RETURN && TEST_ERRNO != EINVAL)
121 tst_brk(TBROK | TTERRNO, "Unexpected setsockopt() error");
122 if (TEST_RETURN)
123 tst_res(TPASS | TTERRNO, "Refused bad tp_sizeof_priv value");
124 else
125 tst_res(TFAIL, "Allowed bad tp_sizeof_priv value");
126 }
127
run(unsigned int i)128 static void run(unsigned int i)
129 {
130 if (i == 0)
131 good_size();
132 else
133 bad_size();
134
135 SAFE_CLOSE(sk);
136 }
137
138 static struct tst_test test = {
139 .test = run,
140 .tcnt = 2,
141 .needs_root = 1,
142 .setup = setup,
143 .cleanup = cleanup,
144 .min_kver = "3.2",
145 };
146