1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2017 Google, Inc.
4 * Copyright (c) Linux Test Project, 2017-2024
5 */
6
7 /*\
8 * [Description]
9 *
10 * Regression test for commit 63a0b0509e70 ("KEYS: fix freeing uninitialized
11 * memory in key_update()"). Try to reproduce the crash in two different ways:
12 *
13 * 1. Try to update a key of a type that has a ->preparse() method but not an
14 * ->update() method. Examples are the "asymmetric" and "dns_resolver" key
15 * types. It crashes reliably for the "asymmetric" key type, since the
16 * "asymmetric" key type's ->free_preparse() method will dereference a
17 * pointer in the uninitialized memory, whereas other key types often just
18 * free a pointer which tends be NULL in practice, depending on how the stack
19 * is laid out. However, to actually be able to add an "asymmetric" key, we
20 * need a specially-formatted payload and several kernel config options. We
21 * do try it, but for completeness we also try the "dns_resolver" key type
22 * (though that's not guaranteed to be available either).
23 *
24 * 2. Race keyctl_update() with another task removing write permission from the
25 * key using keyctl_setperm(). This can cause a crash with almost any key
26 * type. "user" is a good one to try, since it's always available if
27 * keyrings are supported at all. However, depending on how the stack is
28 * laid out the crash may not actually occur.
29 */
30
31 #include <errno.h>
32 #include <stdlib.h>
33
34 #include "tst_test.h"
35 #include "lapi/keyctl.h"
36
37 #define MODULE "dns_resolver"
38
39 /*
40 * A valid payload for the "asymmetric" key type. This is an x509 certificate
41 * in DER format, generated using:
42 *
43 * openssl req -x509 -newkey rsa:512 -batch -nodes -outform der \
44 * | ~/linux/scripts/bin2c
45 */
46 static const char x509_cert[] =
47 "\x30\x82\x01\xd3\x30\x82\x01\x7d\xa0\x03\x02\x01\x02\x02\x09\x00"
48 "\x92\x2a\x76\xff\x0c\x00\xfb\x9a\x30\x0d\x06\x09\x2a\x86\x48\x86"
49 "\xf7\x0d\x01\x01\x0b\x05\x00\x30\x45\x31\x0b\x30\x09\x06\x03\x55"
50 "\x04\x06\x13\x02\x41\x55\x31\x13\x30\x11\x06\x03\x55\x04\x08\x0c"
51 "\x0a\x53\x6f\x6d\x65\x2d\x53\x74\x61\x74\x65\x31\x21\x30\x1f\x06"
52 "\x03\x55\x04\x0a\x0c\x18\x49\x6e\x74\x65\x72\x6e\x65\x74\x20\x57"
53 "\x69\x64\x67\x69\x74\x73\x20\x50\x74\x79\x20\x4c\x74\x64\x30\x1e"
54 "\x17\x0d\x31\x37\x30\x37\x32\x38\x32\x31\x34\x31\x33\x34\x5a\x17"
55 "\x0d\x31\x37\x30\x38\x32\x37\x32\x31\x34\x31\x33\x34\x5a\x30\x45"
56 "\x31\x0b\x30\x09\x06\x03\x55\x04\x06\x13\x02\x41\x55\x31\x13\x30"
57 "\x11\x06\x03\x55\x04\x08\x0c\x0a\x53\x6f\x6d\x65\x2d\x53\x74\x61"
58 "\x74\x65\x31\x21\x30\x1f\x06\x03\x55\x04\x0a\x0c\x18\x49\x6e\x74"
59 "\x65\x72\x6e\x65\x74\x20\x57\x69\x64\x67\x69\x74\x73\x20\x50\x74"
60 "\x79\x20\x4c\x74\x64\x30\x5c\x30\x0d\x06\x09\x2a\x86\x48\x86\xf7"
61 "\x0d\x01\x01\x01\x05\x00\x03\x4b\x00\x30\x48\x02\x41\x00\xde\x0b"
62 "\x1c\x24\xe2\x0d\xf8\x17\xf2\xc3\x6f\xc9\x72\x3e\x9d\xb0\x2d\x47"
63 "\xe4\xc4\x85\x87\xed\xde\x06\xe3\xf3\xe9\x4c\x35\x6c\xe4\xcb\x0e"
64 "\x44\x28\x23\x66\x76\xec\x4e\xdf\x10\x93\x92\x1e\x52\xfb\xdf\x5c"
65 "\x08\xe7\x24\x04\x66\xe3\x06\x05\x27\x56\xfb\x3e\x91\x31\x02\x03"
66 "\x01\x00\x01\xa3\x50\x30\x4e\x30\x1d\x06\x03\x55\x1d\x0e\x04\x16"
67 "\x04\x14\x6f\x39\x3a\x46\xdf\x29\x63\xde\x54\x7b\x6c\x31\x06\xd0"
68 "\x9f\x36\x16\xfb\x9c\xbf\x30\x1f\x06\x03\x55\x1d\x23\x04\x18\x30"
69 "\x16\x80\x14\x6f\x39\x3a\x46\xdf\x29\x63\xde\x54\x7b\x6c\x31\x06"
70 "\xd0\x9f\x36\x16\xfb\x9c\xbf\x30\x0c\x06\x03\x55\x1d\x13\x04\x05"
71 "\x30\x03\x01\x01\xff\x30\x0d\x06\x09\x2a\x86\x48\x86\xf7\x0d\x01"
72 "\x01\x0b\x05\x00\x03\x41\x00\x73\xf0\x4b\x62\x56\xed\xf0\x8b\x7e"
73 "\xc4\x75\x78\x98\xa2\x7a\x6e\x75\x1f\xde\x9b\xa0\xbe\x1a\x1f\x86"
74 "\x44\x13\xcd\x45\x06\x7f\x86\xde\xf6\x36\x4e\xb6\x15\xfa\xf5\xb0"
75 "\x34\xd2\x5e\x0b\xb3\x2c\x03\x5a\x5a\x28\x97\x5e\x7b\xdf\x63\x75"
76 "\x83\x8d\x69\xda\xd6\x59\xbd"
77 ;
78
79 static int fips_enabled;
80
new_session_keyring(void)81 static void new_session_keyring(void)
82 {
83 TEST(keyctl(KEYCTL_JOIN_SESSION_KEYRING, NULL));
84 if (TST_RET < 0)
85 tst_brk(TBROK | TTERRNO, "failed to join new session keyring");
86 }
87
test_update_nonupdatable(const char * type,const void * payload,size_t plen)88 static void test_update_nonupdatable(const char *type,
89 const void *payload, size_t plen)
90 {
91 key_serial_t keyid;
92
93 new_session_keyring();
94
95 int is_asymmetric = !strcmp(type, "asymmetric");
96
97 TEST(add_key(type, "desc", payload, plen, KEY_SPEC_SESSION_KEYRING));
98 if (TST_RET < 0) {
99 if (TST_ERR == EINVAL && is_asymmetric && fips_enabled) {
100 tst_res(TCONF, "key size not allowed in FIPS mode");
101 return;
102 }
103 if (TST_ERR == ENODEV) {
104 tst_res(TCONF, "kernel doesn't support key type '%s'",
105 type);
106 return;
107 }
108 if (TST_ERR == EBADMSG && is_asymmetric) {
109 tst_res(TCONF, "kernel is missing x509 cert parser "
110 "(CONFIG_X509_CERTIFICATE_PARSER)");
111 return;
112 }
113 if (TST_ERR == ENOENT && is_asymmetric) {
114 tst_res(TCONF, "kernel is missing crypto algorithms "
115 "needed to parse x509 cert (CONFIG_CRYPTO_RSA "
116 "and/or CONFIG_CRYPTO_SHA256)");
117 return;
118 }
119 tst_res(TFAIL | TTERRNO, "unexpected error adding '%s' key",
120 type);
121 return;
122 }
123 keyid = TST_RET;
124
125 /*
126 * Non-updatable keys don't start with write permission, so we must
127 * explicitly grant it.
128 */
129 TEST(keyctl(KEYCTL_SETPERM, keyid, KEY_POS_ALL));
130 if (TST_RET != 0) {
131 tst_res(TFAIL | TTERRNO,
132 "failed to grant write permission to '%s' key", type);
133 return;
134 }
135
136 tst_res(TINFO, "Try to update the '%s' key...", type);
137 TEST(keyctl(KEYCTL_UPDATE, keyid, payload, plen));
138 if (TST_RET == 0) {
139 tst_res(TFAIL,
140 "updating '%s' key unexpectedly succeeded", type);
141 return;
142 }
143 if (TST_ERR != EOPNOTSUPP) {
144 tst_res(TFAIL | TTERRNO,
145 "updating '%s' key unexpectedly failed", type);
146 return;
147 }
148 tst_res(TPASS, "updating '%s' key expectedly failed with EOPNOTSUPP",
149 type);
150 }
151
152 /*
153 * Try to update a key, racing with removing write permission.
154 * This may crash buggy kernels.
155 */
test_update_setperm_race(void)156 static void test_update_setperm_race(void)
157 {
158 static const char payload[] = "payload";
159 key_serial_t keyid;
160 int i;
161
162 new_session_keyring();
163
164 TEST(add_key("user", "desc", payload, sizeof(payload),
165 KEY_SPEC_SESSION_KEYRING));
166 if (TST_RET < 0) {
167 tst_res(TFAIL | TTERRNO, "failed to add 'user' key");
168 return;
169 }
170 keyid = TST_RET;
171
172 if (SAFE_FORK() == 0) {
173 uint32_t perm = KEY_POS_ALL;
174
175 for (i = 0; i < 10000; i++) {
176 perm ^= KEY_POS_WRITE;
177 TEST(keyctl(KEYCTL_SETPERM, keyid, perm));
178 if (TST_RET != 0)
179 tst_brk(TBROK | TTERRNO, "setperm failed");
180 }
181 exit(0);
182 }
183
184 tst_res(TINFO, "Try to update the 'user' key...");
185 for (i = 0; i < 10000; i++) {
186 TEST(keyctl(KEYCTL_UPDATE, keyid, payload, sizeof(payload)));
187 if (TST_RET != 0 && TST_ERR != EACCES) {
188 tst_res(TFAIL | TTERRNO, "failed to update 'user' key");
189 return;
190 }
191 }
192 tst_reap_children();
193 tst_res(TPASS, "didn't crash while racing to update 'user' key");
194 }
195
setup(void)196 static void setup(void)
197 {
198 #ifndef __ANDROID__
199 /* There is no way to trigger automatic dns_resolver module loading. */
200 tst_cmd((const char*[]){"modprobe", MODULE, NULL}, NULL, NULL, 0);
201 #endif
202
203 fips_enabled = tst_fips_enabled();
204 }
205
do_test(unsigned int i)206 static void do_test(unsigned int i)
207 {
208 /*
209 * We need to pass check in dns_resolver_preparse(),
210 * give it dummy server list request.
211 * From v6.8-rc1 commit acc657692aed438e9931438f8c923b2b107aebf9:
212 * the incoming data for add_key() sysdall should be not less than 6
213 * bytes, because struct dns_server_list_v1_header is 6 bytes.
214 * The minimum payload will be tested here for boundary testing.
215 */
216 static char dns_res_payload[] = { 0x00, 0x00, 0x01, 0xff, 0x00, 0x00 };
217
218 switch (i) {
219 case 0:
220 test_update_nonupdatable("asymmetric",
221 x509_cert, sizeof(x509_cert));
222 break;
223 case 1:
224 test_update_nonupdatable(MODULE, dns_res_payload,
225 sizeof(dns_res_payload));
226 break;
227 case 2:
228 test_update_setperm_race();
229 break;
230 }
231 }
232
233 static struct tst_test test = {
234 .needs_root = 1,
235 .tcnt = 3,
236 .setup = setup,
237 .test = do_test,
238 .forks_child = 1,
239 .tags = (const struct tst_tag[]) {
240 {"linux-git", "63a0b0509e70"},
241 {"linux-git", "acc657692aed"},
242 {}
243 }
244 };
245