1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2018 SUSE
4 * Author: Nicolai Stange <[email protected]>
5 * LTP conversion: Richard Palethorpe <[email protected]>
6 *
7 * Originally found by syzkaller:
8 * https://groups.google.com/forum/#!topic/syzkaller-bugs/NKn_ivoPOpk
9 *
10 * Test for CVE-2017-18075 - pcrypt mishandles freeing instances.
11 *
12 * The test works by adding and then removing pcrypt-AEAD instances.
13 * See commit d76c68109f37 crypto: pcrypt - fix freeing pcrypt instances.
14 *
15 * If the bug is present then this will probably crash the kernel, but also
16 * sometimes the test simply times out.
17 */
18
19 #include <errno.h>
20 #include <time.h>
21
22 #include "tst_test.h"
23 #include "tst_safe_net.h"
24 #include "tst_taint.h"
25 #include "tst_crypto.h"
26
27 #define ATTEMPTS 10000
28
29 static struct tst_netlink_context *ctx;
30
setup(void)31 void setup(void)
32 {
33 ctx = NETLINK_CREATE_CONTEXT(NETLINK_CRYPTO);
34 }
35
run(void)36 void run(void)
37 {
38 int i;
39 struct crypto_user_alg a = {
40 .cru_driver_name = "pcrypt(authenc(hmac(sha256-generic),cbc(aes-generic)))",
41 .cru_type = CRYPTO_ALG_TYPE_AEAD,
42 .cru_mask = CRYPTO_ALG_TYPE_MASK,
43 };
44
45 for (i = 0; i < ATTEMPTS; ++i) {
46 TEST(tst_crypto_add_alg(ctx, &a));
47 if (TST_RET && TST_RET == -ENOENT) {
48 tst_brk(TCONF | TRERRNO,
49 "pcrypt, hmac, sha256, cbc or aes not supported");
50 }
51 if (TST_RET && TST_RET != -EEXIST)
52 tst_brk(TBROK | TRERRNO, "add_alg");
53
54 TEST(tst_crypto_del_alg(ctx, &a, 1000));
55 if (TST_RET)
56 tst_brk(TBROK | TRERRNO, "del_alg");
57
58 if (!tst_remaining_runtime()) {
59 tst_res(TINFO, "Time limit reached, stopping at "
60 "%d iterations", i);
61 break;
62 }
63 }
64
65 tst_res(TPASS, "Nothing bad appears to have happened");
66 }
67
cleanup(void)68 void cleanup(void)
69 {
70 NETLINK_DESTROY_CONTEXT(ctx);
71 }
72
73 static struct tst_test test = {
74 .setup = setup,
75 .test_all = run,
76 .cleanup = cleanup,
77 .needs_root = 1,
78 .max_runtime = 300,
79 .tags = (const struct tst_tag[]) {
80 {"linux-git", "d76c68109f37"},
81 {"CVE", "2017-18075"},
82 {}
83 }
84 };
85