1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2019 SUSE LLC <mdoucha@suse.cz>
4 */
5
6 /*
7 * CVE-2017-1000112
8 *
9 * Check that UDP fragmentation offload doesn't cause memory corruption
10 * if the userspace process turns off UFO in between two send() calls.
11 * Kernel crash fixed in:
12 *
13 * commit 85f1bd9a7b5a79d5baa8bf44af19658f7bf77bfa
14 * Author: Willem de Bruijn <willemb@google.com>
15 * Date: Thu Aug 10 12:29:19 2017 -0400
16 *
17 * udp: consistently apply ufo or fragmentation
18 */
19
20 #define _GNU_SOURCE
21 #include <sys/types.h>
22 #include <sys/socket.h>
23 #include <netinet/in.h>
24 #include <sys/ioctl.h>
25 #include <net/if.h>
26 #include <sched.h>
27
28 #include "tst_test.h"
29 #include "tst_net.h"
30 #include "tst_taint.h"
31
32 #define BUFSIZE 4000
33
34 static struct sockaddr_in addr;
35
setup(void)36 static void setup(void)
37 {
38 int real_uid = getuid();
39 int real_gid = getgid();
40 int sock;
41 struct ifreq ifr;
42
43 tst_taint_init(TST_TAINT_W | TST_TAINT_D);
44
45 SAFE_UNSHARE(CLONE_NEWUSER);
46 SAFE_UNSHARE(CLONE_NEWNET);
47 SAFE_FILE_PRINTF("/proc/self/setgroups", "deny");
48 SAFE_FILE_PRINTF("/proc/self/uid_map", "0 %d 1", real_uid);
49 SAFE_FILE_PRINTF("/proc/self/gid_map", "0 %d 1", real_gid);
50
51 tst_init_sockaddr_inet_bin(&addr, INADDR_LOOPBACK, 12345);
52 sock = SAFE_SOCKET(AF_INET, SOCK_DGRAM, 0);
53 strcpy(ifr.ifr_name, "lo");
54 ifr.ifr_mtu = 1500;
55 SAFE_IOCTL(sock, SIOCSIFMTU, &ifr);
56 ifr.ifr_flags = IFF_UP;
57 SAFE_IOCTL(sock, SIOCSIFFLAGS, &ifr);
58 SAFE_CLOSE(sock);
59 }
60
run(void)61 static void run(void)
62 {
63 int sock, i;
64 char buf[BUFSIZE];
65 memset(buf, 0x42, BUFSIZE);
66
67 for (i = 0; i < 1000; i++) {
68 sock = SAFE_SOCKET(AF_INET, SOCK_DGRAM, 0);
69 SAFE_CONNECT(sock, (struct sockaddr *)&addr, sizeof(addr));
70 SAFE_SEND(1, sock, buf, BUFSIZE, MSG_MORE);
71 SAFE_SETSOCKOPT_INT(sock, SOL_SOCKET, SO_NO_CHECK, 1);
72 send(sock, buf, 1, 0);
73 SAFE_CLOSE(sock);
74
75 if (tst_taint_check()) {
76 tst_res(TFAIL, "Kernel is vulnerable");
77 return;
78 }
79 }
80
81 tst_res(TPASS, "Nothing bad happened, probably");
82 }
83
84 static struct tst_test test = {
85 .test_all = run,
86 .setup = setup,
87 .needs_kconfigs = (const char *[]) {
88 "CONFIG_USER_NS=y",
89 "CONFIG_NET_NS=y",
90 NULL
91 },
92 .tags = (const struct tst_tag[]) {
93 {"linux-git", "85f1bd9a7b5a"},
94 {"CVE", "2017-1000112"},
95 {}
96 }
97 };
98