1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (C) 2019 Xiao Yang <ice_yangxiao@163.com>
4 *
5 * Description:
6 * Check various errnos for futex(FUTEX_CMP_REQUEUE).
7 * 1) futex(FUTEX_CMP_REQUEUE) with invalid val returns EINVAL.
8 * 2) futex(FUTEX_CMP_REQUEUE) with invalid val2 returns EINVAL.
9 * 3) futex(FUTEX_CMP_REQUEUE) with mismatched val3 returns EAGAIN.
10 *
11 * It's also a regression test for CVE-2018-6927:
12 * fbe0e839d1e2 ("futex: Prevent overflow by strengthen input validation")
13 */
14
15 #include <errno.h>
16 #include <linux/futex.h>
17 #include <sys/time.h>
18
19 #include "tst_test.h"
20 #include "futextest.h"
21
22 static futex_t *futexes;
23
24 static struct tcase {
25 int set_wakes;
26 int set_requeues;
27 int exp_val;
28 int exp_errno;
29 } tcases[] = {
30 {1, -1, FUTEX_INITIALIZER, EINVAL},
31 {-1, 1, FUTEX_INITIALIZER, EINVAL},
32 {1, 1, FUTEX_INITIALIZER + 1, EAGAIN},
33 };
34
verify_futex_cmp_requeue(unsigned int n)35 static void verify_futex_cmp_requeue(unsigned int n)
36 {
37 struct tcase *tc = &tcases[n];
38
39 TEST(futex_cmp_requeue(&futexes[0], tc->exp_val, &futexes[1],
40 tc->set_wakes, tc->set_requeues, 0));
41 if (TST_RET != -1) {
42 tst_res(TFAIL, "futex_cmp_requeue() succeeded unexpectedly");
43 return;
44 }
45
46 if (TST_ERR != tc->exp_errno) {
47 tst_res(TFAIL | TTERRNO,
48 "futex_cmp_requeue() failed unexpectedly, expected %s",
49 tst_strerrno(tc->exp_errno));
50 return;
51 }
52
53 tst_res(TPASS | TTERRNO, "futex_cmp_requeue() failed as expected");
54 }
55
setup(void)56 static void setup(void)
57 {
58 futexes = SAFE_MMAP(NULL, sizeof(futex_t) * 2, PROT_READ | PROT_WRITE,
59 MAP_ANONYMOUS | MAP_SHARED, -1, 0);
60
61 futexes[0] = FUTEX_INITIALIZER;
62 futexes[1] = FUTEX_INITIALIZER + 1;
63 }
64
cleanup(void)65 static void cleanup(void)
66 {
67 if (futexes)
68 SAFE_MUNMAP((void *)futexes, sizeof(futex_t) * 2);
69 }
70
71 static struct tst_test test = {
72 .setup = setup,
73 .cleanup = cleanup,
74 .test = verify_futex_cmp_requeue,
75 .tcnt = ARRAY_SIZE(tcases),
76 .tags = (const struct tst_tag[]) {
77 {"CVE", "2018-6927"},
78 {"linux-git", "fbe0e839d1e2"},
79 {}
80 }
81 };
82