1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2020 SUSE
4 *
5 * Test transmitting data over a PTY/TTY line discipline and reading from the
6 * virtual netdev created by the line discipline. Also hangup the PTY while
7 * data is in flight to try to cause a race between the netdev being deleted
8 * and the discipline receive function writing to the netdev.
9 *
10 * For SLCAN we check stack data is not leaked in the frame padding
11 * (CVE-2020-11494).
12 *
13 * Test flow:
14 * 1. Create PTY with ldisc X which creates netdev Y
15 * 2. Open raw packet socket and bind to netdev Y
16 * 3. Send data on ptmx and read packets from socket
17 * 4. Hangup while transmission in progress
18 *
19 * Note that not all line disciplines call unthrottle when they are ready to
20 * read more bytes. So it is possible to fill all the write buffers causing
21 * write to block forever (because once write sleeps it needs unthrottle to
22 * wake it). So we write with O_NONBLOCK.
23 *
24 * Also the max buffer size for PTYs is 8192, so even if the protocol MTU is
25 * greater everything may still be processed in 8129 byte chunks. At least
26 * until we are in the netdev code which can have a bigger buffer. Of course
27 * the MTU still decides exactly where the packet delimiter goes, this just
28 * concerns choosing the best packet size to cause a race.
29 *
30 * Note on line discipline encapsulation formats:
31 * - For SLIP frames we just write the data followed by a delimiter char
32 * - SLCAN we write some ASCII described in drivers/net/can/slcan.c which is
33 * converted to the actual frame by the kernel
34 */
35
36 #define _GNU_SOURCE
37 #include "config.h"
38 #include "tst_test.h"
39 #include "tst_buffers.h"
40 #include "lapi/tty.h"
41
42 #if defined(HAVE_LINUX_IF_PACKET_H) && defined(HAVE_LINUX_IF_ETHER_H)
43
44 #include <linux/if_packet.h>
45 #include <linux/if_ether.h>
46 #include <linux/tty.h>
47
48 /*
49 * define instead of including <linux/can.h> to support kernel headers
50 * before change from v4.2-rc1
51 * a2f11835994e ("can.h: make padding given by gcc explicit").
52 */
53
54 #define CAN_MTU (sizeof(struct can_frame))
55 #define CAN_MAX_DLEN 8
56
57 typedef uint32_t canid_t;
58
59 struct can_frame {
60 canid_t can_id;
61 uint8_t can_dlc;
62 uint8_t __pad;
63 uint8_t __res0;
64 uint8_t __res1;
65 uint8_t data[CAN_MAX_DLEN] __attribute__((aligned(8)));
66 };
67
68 #include <stddef.h>
69 #include <stdlib.h>
70 #include <stdio.h>
71 #include <errno.h>
72 #include <unistd.h>
73 #include <termios.h>
74 #include <sys/types.h>
75 #include <sys/socket.h>
76 #include <net/if.h>
77 #include "lapi/ioctl.h"
78
79 #include "tst_safe_stdio.h"
80
81 #define str(s) #s
82 #define SLCAN_FRAME "t00185f5f5f5f5f5f5f5f\r"
83
84 struct ldisc_info {
85 int n;
86 char *name;
87 int mtu;
88 };
89
90 static struct ldisc_info ldiscs[] = {
91 {N_SLIP, "N_SLIP", 8192},
92 {N_SLCAN, "N_SLCAN", CAN_MTU},
93 };
94
95 static int ptmx, pts, sk, mtu, no_check;
96
set_ldisc(int tty,const struct ldisc_info * ldisc)97 static int set_ldisc(int tty, const struct ldisc_info *ldisc)
98 {
99 TEST(ioctl(tty, TIOCSETD, &ldisc->n));
100
101 if (!TST_RET)
102 return 0;
103
104 if (TST_ERR == EINVAL) {
105 tst_res(TCONF | TTERRNO,
106 "You don't appear to have the %s TTY line discipline",
107 ldisc->name);
108 } else {
109 tst_res(TFAIL | TTERRNO,
110 "Failed to set the %s line discipline", ldisc->name);
111 }
112
113 return 1;
114 }
115
open_pty(const struct ldisc_info * ldisc)116 static int open_pty(const struct ldisc_info *ldisc)
117 {
118 char pts_path[PATH_MAX];
119
120 ptmx = SAFE_OPEN("/dev/ptmx", O_RDWR);
121 if (grantpt(ptmx))
122 tst_brk(TBROK | TERRNO, "grantpt(ptmx)");
123 if (unlockpt(ptmx))
124 tst_brk(TBROK | TERRNO, "unlockpt(ptmx)");
125 if (ptsname_r(ptmx, pts_path, sizeof(pts_path)))
126 tst_brk(TBROK | TERRNO, "ptsname_r(ptmx, ...)");
127
128 SAFE_FCNTL(ptmx, F_SETFL, O_NONBLOCK);
129
130 tst_res(TINFO, "PTS path is %s", pts_path);
131 pts = SAFE_OPEN(pts_path, O_RDWR);
132
133 return set_ldisc(pts, ldisc);
134 }
135
try_write(int fd,const char * data,ssize_t size,ssize_t * written)136 static ssize_t try_write(int fd, const char *data,
137 ssize_t size, ssize_t *written)
138 {
139 ssize_t ret = write(fd, data, size);
140
141 if (ret < 0)
142 return -(errno != EAGAIN);
143
144 return !written || (*written += ret) >= size;
145 }
146
write_pty(const struct ldisc_info * ldisc)147 static void write_pty(const struct ldisc_info *ldisc)
148 {
149 char *data;
150 ssize_t written, ret;
151 size_t len = 0;
152
153 switch (ldisc->n) {
154 case N_SLIP:
155 len = mtu;
156 break;
157 case N_SLCAN:
158 len = sizeof(SLCAN_FRAME) - 1;
159 break;
160 }
161
162 data = tst_alloc(len);
163
164 switch (ldisc->n) {
165 case N_SLIP:
166 memset(data, '_', len - 1);
167 data[len - 1] = 0300;
168 break;
169 case N_SLCAN:
170 memcpy(data, SLCAN_FRAME, len);
171 break;
172 }
173
174
175 written = 0;
176 ret = TST_RETRY_FUNC(try_write(ptmx, data, len, &written),
177 TST_RETVAL_NOTNULL);
178 if (ret < 0)
179 tst_brk(TBROK | TERRNO, "Failed 1st write to PTY");
180 tst_res(TPASS, "Wrote PTY %s %d (1)", ldisc->name, ptmx);
181
182 written = 0;
183 ret = TST_RETRY_FUNC(try_write(ptmx, data, len, &written),
184 TST_RETVAL_NOTNULL);
185 if (ret < 0)
186 tst_brk(TBROK | TERRNO, "Failed 2nd write to PTY");
187
188 if (tcflush(ptmx, TCIFLUSH))
189 tst_brk(TBROK | TERRNO, "tcflush(ptmx, TCIFLUSH)");
190
191 tst_res(TPASS, "Wrote PTY %s %d (2)", ldisc->name, ptmx);
192
193 while (try_write(ptmx, data, len, NULL) >= 0)
194 ;
195
196 tst_res(TPASS, "Writing to PTY interrupted by hangup");
197
198 tst_free_all();
199 }
200
open_netdev(const struct ldisc_info * ldisc)201 static void open_netdev(const struct ldisc_info *ldisc)
202 {
203 struct ifreq ifreq = { 0 };
204 struct sockaddr_ll lla = { 0 };
205
206 SAFE_IOCTL(pts, SIOCGIFNAME, ifreq.ifr_name);
207 tst_res(TINFO, "Netdev is %s", ifreq.ifr_name);
208
209 sk = SAFE_SOCKET(PF_PACKET, SOCK_RAW, 0);
210
211 ifreq.ifr_mtu = ldisc->mtu;
212 if (ioctl(sk, SIOCSIFMTU, &ifreq))
213 tst_res(TWARN | TERRNO, "Failed to set netdev MTU to maximum");
214 SAFE_IOCTL(sk, SIOCGIFMTU, &ifreq);
215 mtu = ifreq.ifr_mtu;
216 tst_res(TINFO, "Netdev MTU is %d (we set %d)", mtu, ldisc->mtu);
217
218 SAFE_IOCTL(sk, SIOCGIFFLAGS, &ifreq);
219 ifreq.ifr_flags |= IFF_UP | IFF_RUNNING;
220 SAFE_IOCTL(sk, SIOCSIFFLAGS, &ifreq);
221 SAFE_IOCTL(sk, SIOCGIFFLAGS, &ifreq);
222
223 if (!(ifreq.ifr_flags & IFF_UP))
224 tst_brk(TBROK, "Netdev did not come up");
225
226 SAFE_IOCTL(sk, SIOCGIFINDEX, &ifreq);
227
228 lla.sll_family = PF_PACKET;
229 lla.sll_protocol = htons(ETH_P_ALL);
230 lla.sll_ifindex = ifreq.ifr_ifindex;
231 SAFE_BIND(sk, (struct sockaddr *)&lla, sizeof(struct sockaddr_ll));
232
233 tst_res(TINFO, "Bound netdev %d to socket %d", ifreq.ifr_ifindex, sk);
234 }
235
check_data(const struct ldisc_info * ldisc,const char * data,ssize_t len)236 static void check_data(const struct ldisc_info *ldisc,
237 const char *data, ssize_t len)
238 {
239 ssize_t i = 0, j;
240 struct can_frame frm;
241
242 if (no_check)
243 return;
244
245 if (ldisc->n == N_SLCAN) {
246 memcpy(&frm, data, len);
247
248 if (frm.can_id != 1) {
249 tst_res(TFAIL, "can_id = %d != 1",
250 frm.can_id);
251 no_check = 1;
252 }
253
254 if (frm.can_dlc != CAN_MAX_DLEN) {
255 tst_res(TFAIL, "can_dlc = %d != " str(CAN_MAX_DLEN),
256 frm.can_dlc);
257 no_check = 1;
258 }
259
260 i = offsetof(struct can_frame, __pad);
261 if (frm.__pad != frm.__res0 || frm.__res0 != frm.__res1) {
262 tst_res_hexd(TFAIL, data + i,
263 offsetof(struct can_frame, data) - i,
264 "Padding bytes may contain stack data");
265 no_check = 1;
266 }
267
268 i = offsetof(struct can_frame, data);
269 }
270
271 do {
272 if (i >= len)
273 return;
274 } while (data[i++] == '_');
275
276 j = i--;
277
278 while (j < len && j - i < 65 && data[j++] != '_')
279 ;
280 j--;
281
282 tst_res_hexd(TFAIL, data + i, j - i,
283 "Corrupt data (max 64 of %ld bytes shown): data[%ld..%ld] = ",
284 len, i, j);
285 no_check = 1;
286
287 if (no_check)
288 tst_res(TINFO, "Will continue test without data checking");
289 }
290
try_read(int fd,char * data,ssize_t size)291 static void try_read(int fd, char *data, ssize_t size)
292 {
293 ssize_t ret, n = 0;
294 int retry = mtu;
295
296 while (retry--) {
297 ret = read(fd, data + n, size - n);
298
299 if (ret < 0)
300 break;
301
302 if ((n += ret) >= size)
303 return;
304 }
305
306 tst_brk(TBROK | TERRNO, "Read %zd of %zd bytes", n, size);
307 }
308
read_netdev(const struct ldisc_info * ldisc)309 static void read_netdev(const struct ldisc_info *ldisc)
310 {
311 int rlen, plen = 0;
312 char *data;
313
314 switch (ldisc->n) {
315 case N_SLIP:
316 plen = mtu - 1;
317 break;
318 case N_SLCAN:
319 plen = CAN_MTU;
320 break;
321 }
322 data = tst_alloc(plen);
323
324 tst_res(TINFO, "Reading from socket %d", sk);
325
326 try_read(sk, data, plen);
327 check_data(ldisc, data, plen);
328 tst_res(TPASS, "Read netdev %s %d (1)", ldisc->name, sk);
329
330 try_read(sk, data, plen);
331 check_data(ldisc, data, plen);
332 tst_res(TPASS, "Read netdev %s %d (2)", ldisc->name, sk);
333
334 TST_CHECKPOINT_WAKE(0);
335 while ((rlen = read(sk, data, plen)) > 0)
336 check_data(ldisc, data, rlen);
337
338 tst_res(TPASS, "Reading data from netdev interrupted by hangup");
339
340 close(sk);
341 tst_free_all();
342 }
343
do_test(unsigned int n)344 static void do_test(unsigned int n)
345 {
346 struct ldisc_info *ldisc = &ldiscs[n];
347
348 if (open_pty(ldisc))
349 return;
350
351 open_netdev(ldisc);
352
353 if (!SAFE_FORK()) {
354 read_netdev(ldisc);
355 return;
356 }
357
358 if (!SAFE_FORK()) {
359 write_pty(ldisc);
360 return;
361 }
362
363 if (!SAFE_FORK()) {
364 TST_CHECKPOINT_WAIT2(0, 100000);
365 SAFE_IOCTL(pts, TIOCVHANGUP);
366 tst_res(TINFO, "Sent hangup ioctl to PTS");
367 SAFE_IOCTL(ptmx, TIOCVHANGUP);
368 tst_res(TINFO, "Sent hangup ioctl to PTM");
369 return;
370 }
371
372 tst_reap_children();
373 }
374
cleanup(void)375 static void cleanup(void)
376 {
377 ioctl(pts, TIOCVHANGUP);
378 ioctl(ptmx, TIOCVHANGUP);
379 close(sk);
380
381 tst_reap_children();
382 }
383
384 static struct tst_test test = {
385 .test = do_test,
386 .cleanup = cleanup,
387 .tcnt = 2,
388 .forks_child = 1,
389 .needs_checkpoints = 1,
390 .needs_root = 1,
391 .tags = (const struct tst_tag[]){
392 {"linux-git", "b9258a2cece4ec1f020715fe3554bc2e360f6264"},
393 {"CVE", "CVE-2020-11494"},
394 {}
395 }
396 };
397
398 #else
399
400 TST_TEST_TCONF("Need <linux/if_packet.h> and <linux/if_ether.h>");
401
402 #endif
403