1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2020 SUSE
4 *
5 * Test transmitting data over a PTY/TTY line discipline and reading from the
6 * virtual netdev created by the line discipline. Also hangup the PTY while
7 * data is in flight to try to cause a race between the netdev being deleted
8 * and the discipline receive function writing to the netdev.
9 *
10 * For SLCAN we check stack data is not leaked in the frame padding
11 * (CVE-2020-11494).
12 *
13 * Test flow:
14 * 1. Create PTY with ldisc X which creates netdev Y
15 * 2. Open raw packet socket and bind to netdev Y
16 * 3. Send data on ptmx and read packets from socket
17 * 4. Hangup while transmission in progress
18 *
19 * Note that not all line disciplines call unthrottle when they are ready to
20 * read more bytes. So it is possible to fill all the write buffers causing
21 * write to block forever (because once write sleeps it needs unthrottle to
22 * wake it). So we write with O_NONBLOCK.
23 *
24 * Also the max buffer size for PTYs is 8192, so even if the protocol MTU is
25 * greater everything may still be processed in 8129 byte chunks. At least
26 * until we are in the netdev code which can have a bigger buffer. Of course
27 * the MTU still decides exactly where the packet delimiter goes, this just
28 * concerns choosing the best packet size to cause a race.
29 *
30 * Note on line discipline encapsulation formats:
31 * - For SLIP frames we just write the data followed by a delimiter char
32 * - SLCAN we write some ASCII described in drivers/net/can/slcan.c which is
33 * converted to the actual frame by the kernel
34 */
35
36 #define _GNU_SOURCE
37 #include "config.h"
38 #include "tst_test.h"
39 #include "tst_buffers.h"
40 #include "lapi/tty.h"
41
42 #if defined(HAVE_LINUX_IF_PACKET_H) && defined(HAVE_LINUX_IF_ETHER_H)
43
44 #include <linux/if_packet.h>
45 #include <linux/if_ether.h>
46 #include <linux/tty.h>
47
48 /*
49 * define instead of including <linux/can.h> to support kernel headers
50 * before change from v4.2-rc1
51 * a2f11835994e ("can.h: make padding given by gcc explicit").
52 */
53
54 #define CAN_MTU (sizeof(struct can_frame))
55 #define CAN_MAX_DLEN 8
56
57 typedef uint32_t canid_t;
58
59 struct can_frame {
60 canid_t can_id;
61 uint8_t can_dlc;
62 uint8_t __pad;
63 uint8_t __res0;
64 uint8_t __res1;
65 uint8_t data[CAN_MAX_DLEN] __attribute__((aligned(8)));
66 };
67
68 #include <stddef.h>
69 #include <stdlib.h>
70 #include <stdio.h>
71 #include <errno.h>
72 #include <unistd.h>
73 #include <termios.h>
74 #include <sys/types.h>
75 #include <sys/socket.h>
76 #include <net/if.h>
77 #include "lapi/ioctl.h"
78
79 #include "tst_safe_stdio.h"
80
81 #define SLCAN_FRAME "t00185f5f5f5f5f5f5f5f\r"
82
83 struct ldisc_info {
84 int n;
85 char *name;
86 int mtu;
87 };
88
89 static struct ldisc_info ldiscs[] = {
90 {N_SLIP, "N_SLIP", 8192},
91 {N_SLCAN, "N_SLCAN", CAN_MTU},
92 };
93
94 static int ptmx = -1, pts = -1, sk = -1, mtu, no_check;
95
setup(void)96 static void setup(void)
97 {
98 int fd = SAFE_OPEN("/dev/ptmx", O_RDWR);
99
100 TEST(ioctl(fd, TIOCVHANGUP));
101 SAFE_CLOSE(fd);
102
103 if (TST_RET && TST_ERR == ENOTTY)
104 tst_brk(TCONF | TTERRNO, "ioctl(TIOCVHANGUP) not supported");
105 else if (TST_RET)
106 tst_brk(TBROK | TTERRNO, "ioctl(TIOCVHANGUP) failed");
107 }
108
set_ldisc(int tty,const struct ldisc_info * ldisc)109 static int set_ldisc(int tty, const struct ldisc_info *ldisc)
110 {
111 TEST(ioctl(tty, TIOCSETD, &ldisc->n));
112
113 if (!TST_RET)
114 return 0;
115
116 if (TST_ERR == EINVAL) {
117 tst_res(TCONF | TTERRNO,
118 "You don't appear to have the %s TTY line discipline",
119 ldisc->name);
120 } else {
121 tst_res(TFAIL | TTERRNO,
122 "Failed to set the %s line discipline", ldisc->name);
123 }
124
125 return 1;
126 }
127
open_pty(const struct ldisc_info * ldisc)128 static int open_pty(const struct ldisc_info *ldisc)
129 {
130 char pts_path[PATH_MAX];
131
132 ptmx = SAFE_OPEN("/dev/ptmx", O_RDWR);
133 if (grantpt(ptmx))
134 tst_brk(TBROK | TERRNO, "grantpt(ptmx)");
135 if (unlockpt(ptmx))
136 tst_brk(TBROK | TERRNO, "unlockpt(ptmx)");
137 if (ptsname_r(ptmx, pts_path, sizeof(pts_path)))
138 tst_brk(TBROK | TERRNO, "ptsname_r(ptmx, ...)");
139
140 SAFE_FCNTL(ptmx, F_SETFL, O_NONBLOCK);
141
142 tst_res(TINFO, "PTS path is %s", pts_path);
143 pts = SAFE_OPEN(pts_path, O_RDWR);
144
145 return set_ldisc(pts, ldisc);
146 }
147
try_async_write(int fd,const char * data,ssize_t size,ssize_t * done)148 static ssize_t try_async_write(int fd, const char *data, ssize_t size,
149 ssize_t *done)
150 {
151 ssize_t off = done ? *done : 0;
152 ssize_t ret = write(fd, data + off, size - off);
153
154 if (ret < 0)
155 return -(errno != EAGAIN);
156
157 if (!done)
158 return 1;
159
160 *done += ret;
161 return *done >= size;
162 }
163
try_async_read(int fd,char * data,ssize_t size,ssize_t * done)164 static ssize_t try_async_read(int fd, char *data, ssize_t size,
165 ssize_t *done)
166 {
167 ssize_t off = done ? *done : 0;
168 ssize_t ret = read(fd, data + off, size - off);
169
170 if (ret < 0)
171 return -(errno != EAGAIN);
172
173 if (!done)
174 return 1;
175
176 *done += ret;
177 return *done >= size;
178 }
179
retry_async_write(int fd,const char * data,ssize_t size)180 static ssize_t retry_async_write(int fd, const char *data, ssize_t size)
181 {
182 ssize_t done = 0;
183
184 return TST_RETRY_FUNC(try_async_write(fd, data, size, &done),
185 TST_RETVAL_NOTNULL);
186 }
187
retry_async_read(int fd,char * data,ssize_t size)188 static ssize_t retry_async_read(int fd, char *data, ssize_t size)
189 {
190 ssize_t done = 0;
191
192 return TST_RETRY_FUNC(try_async_read(fd, data, size, &done),
193 TST_RETVAL_NOTNULL);
194 }
195
do_pty(const struct ldisc_info * ldisc)196 static void do_pty(const struct ldisc_info *ldisc)
197 {
198 char *data;
199 ssize_t ret;
200 size_t len = 0;
201
202 switch (ldisc->n) {
203 case N_SLIP:
204 len = mtu;
205 break;
206 case N_SLCAN:
207 len = sizeof(SLCAN_FRAME) - 1;
208 break;
209 }
210
211 data = tst_alloc(len);
212
213 switch (ldisc->n) {
214 case N_SLIP:
215 memset(data, '_', len - 1);
216 data[len - 1] = 0300;
217 break;
218 case N_SLCAN:
219 memcpy(data, SLCAN_FRAME, len);
220 break;
221 }
222
223 ret = retry_async_write(ptmx, data, len);
224 if (ret < 0)
225 tst_brk(TBROK | TERRNO, "Failed 1st write to PTY");
226 tst_res(TPASS, "Wrote PTY %s %d (1)", ldisc->name, ptmx);
227
228 ret = retry_async_write(ptmx, data, len);
229 if (ret < 0)
230 tst_brk(TBROK | TERRNO, "Failed 2nd write to PTY");
231
232 if (tcflush(ptmx, TCIFLUSH))
233 tst_brk(TBROK | TERRNO, "tcflush(ptmx, TCIFLUSH)");
234
235 tst_res(TPASS, "Wrote PTY %s %d (2)", ldisc->name, ptmx);
236
237 ret = retry_async_read(ptmx, data, len);
238 if (ret < 0)
239 tst_brk(TBROK | TERRNO, "Failed read of PTY");
240
241 tst_res(TPASS, "Read PTY %s %d", ldisc->name, ptmx);
242 TST_CHECKPOINT_WAKE(0);
243
244 while (1) {
245 if (retry_async_read(ptmx, data, len) < 0)
246 break;
247
248 if (retry_async_write(ptmx, data, len) < 0)
249 break;
250 }
251
252 tst_res(TPASS, "Transmission on PTY interrupted by hangup");
253
254 tst_free_all();
255 }
256
open_netdev(const struct ldisc_info * ldisc)257 static void open_netdev(const struct ldisc_info *ldisc)
258 {
259 struct ifreq ifreq = { 0 };
260 struct sockaddr_ll lla = { 0 };
261
262 SAFE_IOCTL(pts, SIOCGIFNAME, ifreq.ifr_name);
263 tst_res(TINFO, "Netdev is %s", ifreq.ifr_name);
264
265 sk = SAFE_SOCKET(PF_PACKET, SOCK_RAW, 0);
266
267 ifreq.ifr_mtu = ldisc->mtu;
268 if (ioctl(sk, SIOCSIFMTU, &ifreq))
269 tst_res(TWARN | TERRNO, "Failed to set netdev MTU to maximum");
270 SAFE_IOCTL(sk, SIOCGIFMTU, &ifreq);
271 mtu = ifreq.ifr_mtu;
272 tst_res(TINFO, "Netdev MTU is %d (we set %d)", mtu, ldisc->mtu);
273
274 SAFE_IOCTL(sk, SIOCGIFFLAGS, &ifreq);
275 ifreq.ifr_flags |= IFF_UP | IFF_RUNNING;
276 SAFE_IOCTL(sk, SIOCSIFFLAGS, &ifreq);
277 SAFE_IOCTL(sk, SIOCGIFFLAGS, &ifreq);
278
279 if (!(ifreq.ifr_flags & IFF_UP))
280 tst_brk(TBROK, "Netdev did not come up");
281
282 SAFE_IOCTL(sk, SIOCGIFINDEX, &ifreq);
283
284 lla.sll_family = PF_PACKET;
285 lla.sll_protocol = htons(ETH_P_ALL);
286 lla.sll_ifindex = ifreq.ifr_ifindex;
287 SAFE_BIND(sk, (struct sockaddr *)&lla, sizeof(struct sockaddr_ll));
288
289 tst_res(TINFO, "Bound netdev %d to socket %d", ifreq.ifr_ifindex, sk);
290 }
291
check_data(const struct ldisc_info * ldisc,const char * data,ssize_t len)292 static void check_data(const struct ldisc_info *ldisc,
293 const char *data, ssize_t len)
294 {
295 ssize_t i = 0, j;
296 struct can_frame frm;
297
298 if (no_check)
299 return;
300
301 if (ldisc->n == N_SLCAN) {
302 memcpy(&frm, data, len);
303
304 if (frm.can_id != 1) {
305 tst_res(TFAIL, "can_id = %d != 1",
306 frm.can_id);
307 no_check = 1;
308 }
309
310 if (frm.can_dlc != CAN_MAX_DLEN) {
311 tst_res(TFAIL, "can_dlc = %d != " TST_TO_STR_(CAN_MAX_DLEN),
312 frm.can_dlc);
313 no_check = 1;
314 }
315
316 i = offsetof(struct can_frame, __pad);
317 if (frm.__pad != frm.__res0 || frm.__res0 != frm.__res1) {
318 tst_res_hexd(TFAIL, data + i,
319 offsetof(struct can_frame, data) - i,
320 "Padding bytes may contain stack data");
321 no_check = 1;
322 }
323
324 i = offsetof(struct can_frame, data);
325 }
326
327 do {
328 if (i >= len)
329 return;
330 } while (data[i++] == '_');
331
332 j = i--;
333
334 while (j < len && j - i < 65 && data[j++] != '_')
335 ;
336 j--;
337
338 tst_res_hexd(TFAIL, data + i, j - i,
339 "Corrupt data (max 64 of %ld bytes shown): data[%ld..%ld] = ",
340 len, i, j);
341 no_check = 1;
342
343 if (no_check)
344 tst_res(TINFO, "Will continue test without data checking");
345 }
346
try_sync_read(int fd,char * data,ssize_t size)347 static ssize_t try_sync_read(int fd, char *data, ssize_t size)
348 {
349 ssize_t ret, n = 0;
350 int retry = mtu;
351
352 while (retry--) {
353 ret = read(fd, data + n, size - n);
354
355 if (ret < 0)
356 return ret;
357
358 if ((n += ret) >= size)
359 return ret;
360 }
361
362 tst_brk(TBROK | TERRNO, "Only read %zd of %zd bytes", n, size);
363
364 return n;
365 }
366
try_sync_write(int fd,const char * data,ssize_t size)367 static ssize_t try_sync_write(int fd, const char *data, ssize_t size)
368 {
369 ssize_t ret, n = 0;
370 int retry = mtu;
371
372 while (retry--) {
373 ret = write(fd, data + n, size - n);
374
375 if (ret < 0)
376 return ret;
377
378 if ((n += ret) >= size)
379 return ret;
380 }
381
382 tst_brk(TBROK | TERRNO, "Only wrote %zd of %zd bytes", n, size);
383
384 return n;
385 }
386
read_netdev(const struct ldisc_info * ldisc)387 static void read_netdev(const struct ldisc_info *ldisc)
388 {
389 int rlen, plen = 0;
390 char *data;
391
392 switch (ldisc->n) {
393 case N_SLIP:
394 plen = mtu - 1;
395 break;
396 case N_SLCAN:
397 plen = CAN_MTU;
398 break;
399 }
400 data = tst_alloc(plen);
401
402 tst_res(TINFO, "Reading from socket %d", sk);
403
404 TEST(try_sync_read(sk, data, plen));
405 if (TST_RET < 0)
406 tst_brk(TBROK | TTERRNO, "Read netdev %s %d (1)", ldisc->name, sk);
407 check_data(ldisc, data, plen);
408 tst_res(TPASS, "Read netdev %s %d (1)", ldisc->name, sk);
409
410 TEST(try_sync_read(sk, data, plen));
411 if (TST_RET < 0)
412 tst_brk(TBROK | TTERRNO, "Read netdev %s %d (2)", ldisc->name, sk);
413 check_data(ldisc, data, plen);
414 tst_res(TPASS, "Read netdev %s %d (2)", ldisc->name, sk);
415
416 TEST(try_sync_write(sk, data, plen));
417 if (TST_RET < 0)
418 tst_brk(TBROK | TTERRNO, "Write netdev %s %d", ldisc->name, sk);
419
420 tst_res(TPASS, "Write netdev %s %d", ldisc->name, sk);
421
422 while (1) {
423 if (try_sync_write(sk, data, plen) < 0)
424 break;
425
426 if ((rlen = try_sync_read(sk, data, plen)) < 0)
427 break;
428 check_data(ldisc, data, rlen);
429 }
430
431 tst_res(TPASS, "Data transmission on netdev interrupted by hangup");
432
433 close(sk);
434 tst_free_all();
435 }
436
do_test(unsigned int n)437 static void do_test(unsigned int n)
438 {
439 struct ldisc_info *ldisc = &ldiscs[n];
440
441 if (open_pty(ldisc))
442 return;
443
444 open_netdev(ldisc);
445
446 if (!SAFE_FORK()) {
447 read_netdev(ldisc);
448 return;
449 }
450
451 if (!SAFE_FORK()) {
452 do_pty(ldisc);
453 return;
454 }
455
456 if (!SAFE_FORK()) {
457 TST_CHECKPOINT_WAIT2(0, 100000);
458 SAFE_IOCTL(pts, TIOCVHANGUP);
459 tst_res(TINFO, "Sent hangup ioctl to PTS");
460 SAFE_IOCTL(ptmx, TIOCVHANGUP);
461 tst_res(TINFO, "Sent hangup ioctl to PTM");
462 return;
463 }
464
465 tst_reap_children();
466 }
467
cleanup(void)468 static void cleanup(void)
469 {
470 if (pts >= 0)
471 ioctl(pts, TIOCVHANGUP);
472
473 if (ptmx >= 0)
474 ioctl(ptmx, TIOCVHANGUP);
475
476 if (sk >= 0)
477 close(sk);
478
479 tst_reap_children();
480 }
481
482 static struct tst_test test = {
483 .setup = setup,
484 .test = do_test,
485 .cleanup = cleanup,
486 .tcnt = 2,
487 .forks_child = 1,
488 .needs_checkpoints = 1,
489 .needs_root = 1,
490 .tags = (const struct tst_tag[]){
491 {"linux-git", "b9258a2cece4ec1f020715fe3554bc2e360f6264"},
492 {"CVE", "CVE-2020-11494"},
493 {}
494 }
495 };
496
497 #else
498
499 TST_TEST_TCONF("Need <linux/if_packet.h> and <linux/if_ether.h>");
500
501 #endif
502