Re: [PATCH] fstests: test dirty pipe vulnerability issue of CVE-2022-0847

[Dave Chinner <david@fromorbit.com>]

On Tue, Mar 08, 2022 at 11:55:01AM -0800, Darrick J. Wong wrote:
> On Wed, Mar 09, 2022 at 03:02:19AM +0800, Zorro Lang wrote:
> > On Tue, Mar 08, 2022 at 09:14:29AM -0800, Darrick J. Wong wrote:
> > > On Tue, Mar 08, 2022 at 05:22:48PM +0800, Zorro Lang wrote:
> > > > +chmod 0644 $localfile
> > > > +# Test privileged user (xfstests generally run with root)
> > > > +echo "Test privileged user:"
> > > > +$here/src/splice2pipe $localfile 1 "AAAAAAAABBBBBBBB"
> > > > +# Part of 0xff will be overwritten if there's CVE-2022-0847 bug
> > > > +hexdump -C $localfile
> > > 
> > > (I wonder offhand if fstests ought to be checking for the existence of
> > > hexdump(1) since at least Debian only has it in bsdmainutils package,
> > > but ... that's a separate question.)
> > 
> > Hmm... I never thought about that, due to the hexdump is in util-linux for
> > rhel and fedora. That means it's nearly always be there. If Debian or some other
> > system won't have it by default, we might say 'hexdump' is a necessary dependence
> > to run fstests in doc :)
> 
> Yeah.  The fstests documentation don't list bsdmainutils as a required
> package for Debian, so I think either we should update the documentation
> or do a treewide change to make all the tests that use hexdump(1)
> _require it.

I think it would be better to replace hexdump uses with 'od -x' as
od is part of coreutils. Hence we can either replace all the calls
to hexdump with direct calls to od -x, or add a simple wrapper like:

hexdump() {
	od -x $@
}

with whatever the format specification needed is to output the same
format as hexdump does...

Cheers,

Dave.
-- 
Dave Chinner
david@fromorbit.com