Re: [LTP] [PATCH v4] fsconfig03: New test CVE-2022-0185

Petr Vorel
2023-02-17T07:48:35Z

Hi all,

...
> +/*\
> + * [Description]
> + *
> + * Test for CVE-2022-0185.
> + *
> + * References links:
Here needs to be empty blank line (can be fixed before merge).

> + * - https://www.openwall.com/lists/oss-security/2022/01/25/14
> + * - https://github.com/Crusaders-of-Rust/CVE-2022-0185
> + */

Otherwise the final formatting will be without list:
References links: - https://www.openwall.com/lists/oss-security/2022/01/25/14 - https://github.com/Crusaders-of-Rust/CVE-2022-0185

We need some checker which reports that, because nobody knows it.
I also forget on it when putting example for v2.

> +
> +#include "tst_test.h"
> +#include "lapi/fsmount.h"
> +
> +#define MNTPOINT "mntpoint"
> +
> +static int fd = -1;
> +
> +static void setup(void)
> +{
> + fsopen_supported_by_kernel();
> +}
> +
> +static void run(void)
> +{
> + char *val = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
> + long pagesize;
> +
> + TEST(fd = fsopen(tst_device->fs_type, 0));
> + if (fd == -1)
> + tst_brk(TBROK | TTERRNO, "fsopen() failed");

Yes, this is needed to be in test function (it's not enough to be in the
setup()).
> +
> + pagesize = sysconf(_SC_PAGESIZE);
> + if (pagesize == -1)
> + tst_brk(TBROK, "sysconf(_SC_PAGESIZE) failed");
> +
> + for (size_t i = 0; i < 5000; i++) {
> + /* use same logic in kernel legacy_parse_param function */
> + const size_t len = i * (strlen(val) + 2) + (strlen(val) + 1) + 2;
> +
> + if (!strcmp(tst_device->fs_type, "btrfs") && len <= (size_t)pagesize) {
> + TST_EXP_PASS_SILENT(fsconfig(fd, FSCONFIG_SET_STRING, "\x00", val, 0));
> + if (TST_ERR)
> + return;
> + } else {
> + TST_EXP_FAIL_SILENT(fsconfig(fd, FSCONFIG_SET_STRING, "\x00", val, 0),
> + EINVAL);
> + if (!TST_PASS)
> + return;
> + }
> + }
> +
> + if (fd != -1)
> + SAFE_CLOSE(fd);
Very good to catch open file descriptor leak (which would leak if this was in
cleanup()).

> +
> + tst_res(TPASS, "fsconfig() overflow on %s haven't triggerred crash",
> + tst_device->fs_type);
> +}

It looks to be ready from my site, I'll test it on various kernels to double
check any problem.

Kind regards,
Petr