Re: [LTP] cve: add pwnescape reproducer

[Petr Vorel <pvorel@suse.cz>]

Hi Andrea, all,

> Hi Andrea, all,

> I'm verifying it at least on some of SLES versions.

> FYI on 4.12 and 4.4 based SLES kernels with backported 6785011f8b16 (i.e. fixed
> kernels) the test fails:
> pwnescape.c:213: TBROK: control datagram was not forwarded back

OK, when I double checked the error was on version without the fix.

Therefore I merged your patchset with these changes:

+++ testcases/cve/pwnescape.c
@@ -21,6 +21,12 @@
  * The test loads the tun module when run as root and runs inside a
  * private network namespace so that it needs no other privileges.
  *
+ * The frames carry two VID 0 VLAN tags because the TAP driver rejects
+ * checksum metadata starting less than ``sizeof(struct iphdr)`` bytes into
+ * the frame. Without the tags the IPv4 header would start at frame offset
+ * 14, so ``csum_start`` could not point at it. With the tags it starts at
+ * offset 22.
+ *
  * [Algorithm]
  *
  * - create a TAP device with MAC 02:00:00:00:00:01, address
@@ -215,15 +221,19 @@ static void run(void)
 		tst_brk(TBROK, "control datagram IHL corrupted (%u)", ihl);
 
 	send_datagram(&test_frame, offsetof(struct pkt_frame, ip));
-	if (capture_fragment(TEST_ID, &ihl) && ihl != GOOD_IHL) {
-		tst_res(TFAIL,
-			"IPv4 header IHL corrupted by checksum completion (%u)",
+	if (!capture_fragment(TEST_ID, &ihl)) {
+		tst_res(TPASS,
+			"kernel dropped the datagram with checksum metadata inside the IPv4 header");
+		return;
+	}
+
+	if (ihl != GOOD_IHL) {
+		tst_res(TFAIL, "IPv4 header IHL corrupted by checksum completion (%u)",
 			ihl);
 		return;
 	}
 
-	tst_res(TPASS,
-		"kernel dropped the datagram with checksum metadata inside the IPv4 header");
+	tst_res(TPASS, "IPv4 header not corrupted by checksum completion");
 }
 
 static void setup(void)
@@ -242,8 +252,12 @@ static void setup(void)
 	 * namespace that owns the netns the file was opened in
 	 */
 	tap_fd = open("/dev/net/tun", O_RDWR);
-	if (tap_fd < 0)
-		tst_brk(TCONF | TERRNO, "open /dev/net/tun failed");
+	if (tap_fd == -1) {
+		if (errno == ENOENT || errno == ENODEV)
+			tst_brk(TCONF | TERRNO, "TUN support is missing");
+
+		tst_brk(TBROK | TERRNO, "open /dev/net/tun failed");
+	}
 
 	memset(&ifr, 0, sizeof(ifr));
 	strncpy(ifr.ifr_name, TAP_NAME, IFNAMSIZ - 1);
@@ -307,6 +321,7 @@ static struct tst_test test = {
 	},
 	.tags = (const struct tst_tag[]) {
 		{"linux-git", "6785011f8b16"},
+		{"CVE", "2026-99999"},
 		{}
 	},
 };


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp