1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2017 Fujitsu Ltd.
4 * Author: Guangwen Feng <[email protected]>
5 */
6
7 /*
8 * Test for CVE-2016-7042, this regression test can crash the buggy kernel
9 * when the stack-protector is enabled, and the bug was fixed in:
10 *
11 * commit 03dab869b7b239c4e013ec82aea22e181e441cfc
12 * Author: David Howells <[email protected]>
13 * Date: Wed Oct 26 15:01:54 2016 +0100
14 *
15 * KEYS: Fix short sprintf buffer in /proc/keys show function
16 */
17
18 #include <errno.h>
19 #include <stdio.h>
20
21 #include "tst_test.h"
22 #include "lapi/keyctl.h"
23
24 #define PATH_KEYS "/proc/keys"
25
26 static key_serial_t key;
27 static int fd;
28
do_test(void)29 static void do_test(void)
30 {
31 char buf[BUFSIZ];
32
33 key = add_key("user", "ltptestkey", "a", 1, KEY_SPEC_SESSION_KEYRING);
34 if (key == -1)
35 tst_brk(TBROK, "Failed to add key");
36
37 if (keyctl(KEYCTL_UPDATE, key, "b", 1))
38 tst_brk(TBROK, "Failed to update key");
39
40 fd = SAFE_OPEN(PATH_KEYS, O_RDONLY);
41
42 tst_res(TINFO, "Attempting to crash the system");
43
44 SAFE_READ(0, fd, buf, BUFSIZ);
45
46 tst_res(TPASS, "Bug not reproduced");
47
48 SAFE_CLOSE(fd);
49
50 if (keyctl(KEYCTL_UNLINK, key, KEY_SPEC_SESSION_KEYRING))
51 tst_brk(TBROK, "Failed to unlink key");
52 key = 0;
53 }
54
setup(void)55 static void setup(void)
56 {
57 if (access(PATH_KEYS, F_OK))
58 tst_brk(TCONF, "%s does not exist", PATH_KEYS);
59 }
60
cleanup(void)61 static void cleanup(void)
62 {
63 if (key > 0 && keyctl(KEYCTL_UNLINK, key, KEY_SPEC_SESSION_KEYRING))
64 tst_res(TWARN, "Failed to unlink key");
65
66 if (fd > 0)
67 SAFE_CLOSE(fd);
68 }
69
70 static struct tst_test test = {
71 .setup = setup,
72 .cleanup = cleanup,
73 .test_all = do_test,
74 .tags = (const struct tst_tag[]) {
75 {"linux-git", "03dab869b7b2"},
76 {"CVE", "2016-7042"},
77 {}
78 }
79 };
80