1 /* SPDX-License-Identifier: MIT */
2 /*
3 * repro-CVE-2020-29373 -- Reproducer for CVE-2020-29373.
4 *
5 * Copyright (c) 2021 SUSE
6 * Author: Nicolai Stange <[email protected]>
7 *
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * as published by the Free Software Foundation; either version 2
11 * of the License, or (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include <unistd.h>
23 #include <stdio.h>
24 #include <string.h>
25 #include <sys/mman.h>
26 #include <sys/socket.h>
27 #include <sys/un.h>
28 #include <fcntl.h>
29 #include <errno.h>
30 #include <inttypes.h>
31 #include <stdlib.h>
32 #include <sys/types.h>
33 #include <sys/wait.h>
34 #include "liburing.h"
35
36 /*
37 * This attempts to make the kernel issue a sendmsg() to
38 * path from io_uring's async io_sq_wq_submit_work().
39 *
40 * Unfortunately, IOSQE_ASYNC is available only from kernel version
41 * 5.6 onwards. To still force io_uring to process the request
42 * asynchronously from io_sq_wq_submit_work(), queue a couple of
43 * auxiliary requests all failing with EAGAIN before. This is
44 * implemented by writing repeatedly to an auxiliary O_NONBLOCK
45 * AF_UNIX socketpair with a small SO_SNDBUF.
46 */
try_sendmsg_async(const char * const path)47 static int try_sendmsg_async(const char * const path)
48 {
49 int snd_sock, r;
50 struct io_uring ring;
51 char sbuf[16] = {};
52 struct iovec siov = { .iov_base = &sbuf, .iov_len = sizeof(sbuf) };
53 struct sockaddr_un addr = {};
54 struct msghdr msg = {
55 .msg_name = &addr,
56 .msg_namelen = sizeof(addr),
57 .msg_iov = &siov,
58 .msg_iovlen = 1,
59 };
60 struct io_uring_cqe *cqe;
61 struct io_uring_sqe *sqe;
62
63 snd_sock = socket(AF_UNIX, SOCK_DGRAM, 0);
64 if (snd_sock < 0) {
65 perror("socket(AF_UNIX)");
66 return -1;
67 }
68
69 addr.sun_family = AF_UNIX;
70 strcpy(addr.sun_path, path);
71
72 r = io_uring_queue_init(512, &ring, 0);
73 if (r < 0) {
74 fprintf(stderr, "ring setup failed: %d\n", r);
75 goto close_iour;
76 }
77
78 sqe = io_uring_get_sqe(&ring);
79 if (!sqe) {
80 fprintf(stderr, "get sqe failed\n");
81 r = -EFAULT;
82 goto close_iour;
83 }
84
85 /* the actual one supposed to fail with -ENOENT. */
86 io_uring_prep_sendmsg(sqe, snd_sock, &msg, 0);
87 sqe->flags = IOSQE_ASYNC;
88 sqe->user_data = 255;
89
90 r = io_uring_submit(&ring);
91 if (r != 1) {
92 fprintf(stderr, "sqe submit failed: %d\n", r);
93 r = -EFAULT;
94 goto close_iour;
95 }
96
97 r = io_uring_wait_cqe(&ring, &cqe);
98 if (r < 0) {
99 fprintf(stderr, "wait completion %d\n", r);
100 r = -EFAULT;
101 goto close_iour;
102 }
103 if (cqe->user_data != 255) {
104 fprintf(stderr, "user data %d\n", r);
105 r = -EFAULT;
106 goto close_iour;
107 }
108 if (cqe->res != -ENOENT) {
109 r = 3;
110 fprintf(stderr,
111 "error: cqe %i: res=%i, but expected -ENOENT\n",
112 (int)cqe->user_data, (int)cqe->res);
113 }
114 io_uring_cqe_seen(&ring, cqe);
115
116 close_iour:
117 io_uring_queue_exit(&ring);
118 close(snd_sock);
119 return r;
120 }
121
main(int argc,char * argv[])122 int main(int argc, char *argv[])
123 {
124 int r;
125 char tmpdir[] = "/tmp/tmp.XXXXXX";
126 int rcv_sock;
127 struct sockaddr_un addr = {};
128 pid_t c;
129 int wstatus;
130
131 if (!mkdtemp(tmpdir)) {
132 perror("mkdtemp()");
133 return 1;
134 }
135
136 rcv_sock = socket(AF_UNIX, SOCK_DGRAM, 0);
137 if (rcv_sock < 0) {
138 perror("socket(AF_UNIX)");
139 r = 1;
140 goto rmtmpdir;
141 }
142
143 addr.sun_family = AF_UNIX;
144 snprintf(addr.sun_path, sizeof(addr.sun_path), "%s/sock", tmpdir);
145
146 r = bind(rcv_sock, (struct sockaddr *)&addr,
147 sizeof(addr));
148 if (r < 0) {
149 perror("bind()");
150 close(rcv_sock);
151 r = 1;
152 goto rmtmpdir;
153 }
154
155 c = fork();
156 if (!c) {
157 close(rcv_sock);
158
159 r = chroot(tmpdir);
160 if (r) {
161 if (errno == EPERM) {
162 fprintf(stderr, "chroot not allowed, skip\n");
163 return 0;
164 }
165
166 perror("chroot()");
167 return 1;
168 }
169
170 r = try_sendmsg_async(addr.sun_path);
171 if (r < 0) {
172 /* system call failure */
173 r = 1;
174 } else if (r) {
175 /* test case failure */
176 r += 1;
177 }
178 return r;
179 }
180
181 if (waitpid(c, &wstatus, 0) == (pid_t)-1) {
182 perror("waitpid()");
183 r = 1;
184 goto rmsock;
185 }
186 if (!WIFEXITED(wstatus)) {
187 fprintf(stderr, "child got terminated\n");
188 r = 1;
189 goto rmsock;
190 }
191 r = WEXITSTATUS(wstatus);
192 if (r)
193 fprintf(stderr, "error: Test failed\n");
194 rmsock:
195 close(rcv_sock);
196 unlink(addr.sun_path);
197 rmtmpdir:
198 rmdir(tmpdir);
199 return r;
200 }
201