Re: [LTP] [PATCH v1] fsconfig: New case cover CVE-2022-0185

Wei Gao via ltp
2023-02-06T10:38:50Z

On Wed, Feb 01, 2023 at 01:49:43PM +0100, Petr Vorel wrote:
> Hi Wei,
>
> ...
> > +++ b/include/lapi/fsmount.h
> > @@ -11,12 +11,15 @@
> > #include "config.h"
> > #include <sys/syscall.h>
> > #include <sys/types.h>
> > -#include <sys/mount.h>
>
> > #ifndef HAVE_FSOPEN
> > # ifdef HAVE_LINUX_MOUNT_H
> > # include <linux/mount.h>
> > +# else
> > +# include <sys/mount.h>
> > # endif
> > +#else
> > +# include <sys/mount.h>
> > #endif
> Does <linux/mount.h> conflicts with <sys/mount.h>? Or why is this needed?
>
> > #include "lapi/fcntl.h"
> > diff --git a/runtest/syscalls b/runtest/syscalls
> > index ae37a1192..b4cde8071 100644
> > --- a/runtest/syscalls
> > +++ b/runtest/syscalls
> > @@ -383,6 +383,7 @@ fremovexattr02 fremovexattr02
>
> > fsconfig01 fsconfig01
> > fsconfig02 fsconfig02
> > +fsconfig03 fsconfig03
>
> NOTE: you also need to add a new record in testcases/kernel/syscalls/fsconfig/.gitignore.
>
> > diff --git a/testcases/kernel/syscalls/fsconfig/fsconfig03.c b/testcases/kernel/syscalls/fsconfig/fsconfig03.c
> > new file mode 100644
> > index 000000000..e076c2f09
> > --- /dev/null
> > +++ b/testcases/kernel/syscalls/fsconfig/fsconfig03.c
> > @@ -0,0 +1,58 @@
> > +// SPDX-License-Identifier: GPL-2.0-or-later
> > +/*
> > + * Copyright (c) 2023 Wei Gao <wegao@suse.com>
> > + */
> > +
> > +/*\
> NOTE, there should be docparse label:
> * [Description]
> > + * Test add some coverage to CVE-2022-0185.
> > + * Try to trigger a crash.
> > + * References links:
> > + * https://www.openwall.com/lists/oss-security/2022/01/25/14
> > + * https://github.com/Crusaders-of-Rust/CVE-2022-0185
> > + */
> > +
> > +#include "tst_test.h"
> > +#include "lapi/fsmount.h"
> > +
> > +#define MNTPOINT "mntpoint"
> > +
> > +static int fd = -1;
> > +
> > +static void setup(void)
> > +{
> > + fsopen_supported_by_kernel();
> > +
> > + TEST(fd = fsopen(tst_device->fs_type, 0));
> > + if (fd == -1)
> > + tst_brk(TBROK | TTERRNO, "fsopen() failed");
> Sooner or later we should add SAFE_FSOPEN(), but that can wait.
>
> > +
> > +}
> > +
> > +static void cleanup(void)
> > +{
> > + if (fd != -1)
> > + SAFE_CLOSE(fd);
> > +}
> > +
> > +static void run(void)
> > +{
> > + char *val = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
> > +
> > + for (unsigned int i = 0; i < 2; i++) {
> > + TEST(fsconfig(fd, FSCONFIG_SET_STRING, "\x00", val, 0));
> > + if (TST_RET == -1)
> > + tst_brk(TFAIL | TTERRNO, "fsconfig(FSCONFIG_SET_STRING) failed");
> TST_EXP_PASS() or other could here be used (it should be changes also in fsconfig01.c).
>
> Hm, there is a kernel fix from 5.17 [1]. But test fails when I run it on 6.2.0-rc5:
>
> tst_supported_fs_types.c:165: TINFO: Skipping FUSE based ntfs as requested by the test
> tst_supported_fs_types.c:157: TINFO: Skipping tmpfs as requested by the test
> tst_test.c:1634: TINFO: === Testing on ext3 ===
> tst_test.c:1093: TINFO: Formatting /dev/loop0 with ext3 opts='' extra opts=''
> mke2fs 1.46.5 (30-Dec-2021)
> fsconfig03.c:44: TFAIL: fsconfig(FSCONFIG_SET_STRING) failed: EINVAL (22)
>
> Isn't it the opposite: we expect to fail, thus TST_EXP_FAIL() should here be
> used?
>
I have not test on 6.2.0 kernel, i need reproduce this firstly.
> > + }
> > + tst_res(TPASS, "Try fsconfig overflow on %s done!", tst_device->fs_type);
> > +}
> > +
> > +static struct tst_test test = {
> > + .test_all = run,
> > + .setup = setup,
> > + .cleanup = cleanup,
> > + .needs_root = 1,
> > + .format_device = 1,
> > + .mntpoint = MNTPOINT,
> > + .all_filesystems = 1,
> > + .skip_filesystems = (const char *const []){"fuse", "ext2", "xfs", "tmpfs", NULL},
>
> I wonder why this is should not be run on XFS and ext2.
ext2: this if failed on one of my specific machine, so normally this should run.
xfs: this always error happen with error code "TFAIL: fsconfig(FSCONFIG_SET_STRING) failed: EINVAL (22)", i
need debug kernel to check what's happen.
>
> Also, while we have CVE and kernel fix [1], it should be marked in struct tst_test:
>
> .tags = (const struct tst_tag[]) {
> {"linux-git", "722d94847de2"},
> {"CVE", "2020-29373"},
> {"CVE", "2022-0185"},
> {}
> }
>
> Kind regards,
> Petr
>
> [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=722d94847de2
>
>
> > +};