xref: /aosp_15_r20/external/ltp/testcases/cve/cve-2022-4378.c (revision 49cdfc7efb34551c7342be41a7384b9c40d7cab7)
1*49cdfc7eSAndroid Build Coastguard Worker // SPDX-License-Identifier: GPL-2.0-or-later
2*49cdfc7eSAndroid Build Coastguard Worker /*
3*49cdfc7eSAndroid Build Coastguard Worker  * Copyright (C) 2022 SUSE LLC <[email protected]>
4*49cdfc7eSAndroid Build Coastguard Worker  */
5*49cdfc7eSAndroid Build Coastguard Worker 
6*49cdfc7eSAndroid Build Coastguard Worker /*\
7*49cdfc7eSAndroid Build Coastguard Worker  * CVE 2022-4378
8*49cdfc7eSAndroid Build Coastguard Worker  *
9*49cdfc7eSAndroid Build Coastguard Worker  * Check that writing several pages worth of whitespace into /proc/sys files
10*49cdfc7eSAndroid Build Coastguard Worker  * does not cause kernel stack overflow. Kernel bug fixed in:
11*49cdfc7eSAndroid Build Coastguard Worker  *
12*49cdfc7eSAndroid Build Coastguard Worker  * commit bce9332220bd677d83b19d21502776ad555a0e73
13*49cdfc7eSAndroid Build Coastguard Worker  * Author: Linus Torvalds <[email protected]>
14*49cdfc7eSAndroid Build Coastguard Worker  * Date:   Mon Dec 5 12:09:06 2022 -0800
15*49cdfc7eSAndroid Build Coastguard Worker  *
16*49cdfc7eSAndroid Build Coastguard Worker  * proc: proc_skip_spaces() shouldn't think it is working on C strings
17*49cdfc7eSAndroid Build Coastguard Worker  */
18*49cdfc7eSAndroid Build Coastguard Worker 
19*49cdfc7eSAndroid Build Coastguard Worker #include <stdlib.h>
20*49cdfc7eSAndroid Build Coastguard Worker #include "tst_test.h"
21*49cdfc7eSAndroid Build Coastguard Worker 
22*49cdfc7eSAndroid Build Coastguard Worker static char *buf;
23*49cdfc7eSAndroid Build Coastguard Worker static unsigned int bufsize;
24*49cdfc7eSAndroid Build Coastguard Worker static int fd = -1;
25*49cdfc7eSAndroid Build Coastguard Worker 
26*49cdfc7eSAndroid Build Coastguard Worker static struct testcase {
27*49cdfc7eSAndroid Build Coastguard Worker 	const char *path;
28*49cdfc7eSAndroid Build Coastguard Worker 	int err;
29*49cdfc7eSAndroid Build Coastguard Worker } testcase_list[] = {
30*49cdfc7eSAndroid Build Coastguard Worker 	{"/proc/sys/net/ipv4/icmp_ratelimit", EINVAL},
31*49cdfc7eSAndroid Build Coastguard Worker 	{"/proc/sys/net/ipv4/icmp_ratemask", EINVAL},
32*49cdfc7eSAndroid Build Coastguard Worker 	{"/proc/sys/net/ipv4/icmp_echo_ignore_all", EINVAL},
33*49cdfc7eSAndroid Build Coastguard Worker 	{"/proc/sys/net/ipv4/tcp_probe_interval", EINVAL},
34*49cdfc7eSAndroid Build Coastguard Worker 	{"/proc/sys/net/ipv4/tcp_keepalive_time", EINVAL},
35*49cdfc7eSAndroid Build Coastguard Worker 	{"/proc/sys/net/ipv4/tcp_notsent_lowat", EINVAL},
36*49cdfc7eSAndroid Build Coastguard Worker 	{"/proc/sys/net/ipv4/ip_local_reserved_ports", 0}
37*49cdfc7eSAndroid Build Coastguard Worker };
38*49cdfc7eSAndroid Build Coastguard Worker 
setup(void)39*49cdfc7eSAndroid Build Coastguard Worker static void setup(void)
40*49cdfc7eSAndroid Build Coastguard Worker {
41*49cdfc7eSAndroid Build Coastguard Worker 	tst_setup_netns();
42*49cdfc7eSAndroid Build Coastguard Worker 
43*49cdfc7eSAndroid Build Coastguard Worker 	bufsize = 2 * SAFE_SYSCONF(_SC_PAGESIZE);
44*49cdfc7eSAndroid Build Coastguard Worker 	buf = SAFE_MALLOC(bufsize);
45*49cdfc7eSAndroid Build Coastguard Worker 	memset(buf, '\n', bufsize);
46*49cdfc7eSAndroid Build Coastguard Worker }
47*49cdfc7eSAndroid Build Coastguard Worker 
run(unsigned int n)48*49cdfc7eSAndroid Build Coastguard Worker static void run(unsigned int n)
49*49cdfc7eSAndroid Build Coastguard Worker {
50*49cdfc7eSAndroid Build Coastguard Worker 	const struct testcase *tc = testcase_list + n;
51*49cdfc7eSAndroid Build Coastguard Worker 
52*49cdfc7eSAndroid Build Coastguard Worker 	if (access(tc->path, W_OK)) {
53*49cdfc7eSAndroid Build Coastguard Worker 		tst_res(TCONF | TERRNO, "Skipping %s", tc->path);
54*49cdfc7eSAndroid Build Coastguard Worker 		return;
55*49cdfc7eSAndroid Build Coastguard Worker 	}
56*49cdfc7eSAndroid Build Coastguard Worker 
57*49cdfc7eSAndroid Build Coastguard Worker 	tst_res(TINFO, "Writing whitespace to %s", tc->path);
58*49cdfc7eSAndroid Build Coastguard Worker 
59*49cdfc7eSAndroid Build Coastguard Worker 	fd = SAFE_OPEN(tc->path, O_WRONLY);
60*49cdfc7eSAndroid Build Coastguard Worker 	TEST(write(fd, buf, bufsize));
61*49cdfc7eSAndroid Build Coastguard Worker 	SAFE_CLOSE(fd);
62*49cdfc7eSAndroid Build Coastguard Worker 
63*49cdfc7eSAndroid Build Coastguard Worker 	if (TST_RET >= 0 && tc->err == 0) {
64*49cdfc7eSAndroid Build Coastguard Worker 		tst_res(TPASS, "write() passed as expected");
65*49cdfc7eSAndroid Build Coastguard Worker 	} else if (TST_RET >= 0) {
66*49cdfc7eSAndroid Build Coastguard Worker 		tst_res(TFAIL, "write() unexpectedly passed");
67*49cdfc7eSAndroid Build Coastguard Worker 	} else if (TST_RET != -1) {
68*49cdfc7eSAndroid Build Coastguard Worker 		tst_res(TFAIL | TTERRNO, "Invalid write() return value %ld",
69*49cdfc7eSAndroid Build Coastguard Worker 			TST_RET);
70*49cdfc7eSAndroid Build Coastguard Worker 	} else if (TST_ERR != tc->err) {
71*49cdfc7eSAndroid Build Coastguard Worker 		tst_res(TFAIL | TTERRNO, "write() returned unexpected error");
72*49cdfc7eSAndroid Build Coastguard Worker 	} else {
73*49cdfc7eSAndroid Build Coastguard Worker 		tst_res(TPASS | TTERRNO, "write() failed as expected");
74*49cdfc7eSAndroid Build Coastguard Worker 	}
75*49cdfc7eSAndroid Build Coastguard Worker 
76*49cdfc7eSAndroid Build Coastguard Worker 	if (tst_taint_check())
77*49cdfc7eSAndroid Build Coastguard Worker 		tst_res(TFAIL, "Kernel is vulnerable");
78*49cdfc7eSAndroid Build Coastguard Worker }
79*49cdfc7eSAndroid Build Coastguard Worker 
cleanup(void)80*49cdfc7eSAndroid Build Coastguard Worker static void cleanup(void)
81*49cdfc7eSAndroid Build Coastguard Worker {
82*49cdfc7eSAndroid Build Coastguard Worker 	if (fd >= 0)
83*49cdfc7eSAndroid Build Coastguard Worker 		SAFE_CLOSE(fd);
84*49cdfc7eSAndroid Build Coastguard Worker 
85*49cdfc7eSAndroid Build Coastguard Worker 	if (buf)
86*49cdfc7eSAndroid Build Coastguard Worker 		free(buf);
87*49cdfc7eSAndroid Build Coastguard Worker }
88*49cdfc7eSAndroid Build Coastguard Worker 
89*49cdfc7eSAndroid Build Coastguard Worker static struct tst_test test = {
90*49cdfc7eSAndroid Build Coastguard Worker 	.test = run,
91*49cdfc7eSAndroid Build Coastguard Worker 	.tcnt = ARRAY_SIZE(testcase_list),
92*49cdfc7eSAndroid Build Coastguard Worker 	.setup = setup,
93*49cdfc7eSAndroid Build Coastguard Worker 	.cleanup = cleanup,
94*49cdfc7eSAndroid Build Coastguard Worker 	.taint_check = TST_TAINT_W | TST_TAINT_D,
95*49cdfc7eSAndroid Build Coastguard Worker 	.needs_kconfigs = (const char *[]) {
96*49cdfc7eSAndroid Build Coastguard Worker 		"CONFIG_USER_NS=y",
97*49cdfc7eSAndroid Build Coastguard Worker 		"CONFIG_NET_NS=y",
98*49cdfc7eSAndroid Build Coastguard Worker 		NULL
99*49cdfc7eSAndroid Build Coastguard Worker 	},
100*49cdfc7eSAndroid Build Coastguard Worker 	.save_restore = (const struct tst_path_val[]) {
101*49cdfc7eSAndroid Build Coastguard Worker 		{"/proc/sys/user/max_user_namespaces", "1024", TST_SR_SKIP},
102*49cdfc7eSAndroid Build Coastguard Worker 		{}
103*49cdfc7eSAndroid Build Coastguard Worker 	},
104*49cdfc7eSAndroid Build Coastguard Worker 	.tags = (const struct tst_tag[]) {
105*49cdfc7eSAndroid Build Coastguard Worker 		{"linux-git", "bce9332220bd"},
106*49cdfc7eSAndroid Build Coastguard Worker 		{"CVE", "2022-4378"},
107*49cdfc7eSAndroid Build Coastguard Worker 		{}
108*49cdfc7eSAndroid Build Coastguard Worker 	}
109*49cdfc7eSAndroid Build Coastguard Worker };
110