1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2020 SUSE LLC <mdoucha@suse.cz>
4 */
5
6 /*
7 * CVE-2017-2636
8 *
9 * Check for race between flush_tx_queue() and n_hdlc_send_frames(). Kernel
10 * crash fixed in:
11 *
12 * commit 82f2341c94d270421f383641b7cd670e474db56b
13 * Author: Alexander Popov <alex.popov@linux.com>
14 * Date: Tue Feb 28 19:54:40 2017 +0300
15 *
16 * tty: n_hdlc: get rid of racy n_hdlc.tbuf
17 */
18
19 #define _GNU_SOURCE
20 #include <termios.h>
21 #include "lapi/ioctl.h"
22 #include "lapi/tty.h"
23
24 #include "tst_test.h"
25 #include "tst_fuzzy_sync.h"
26
27 #define BUF_SIZE 1
28
29 static struct tst_fzsync_pair fzsync_pair;
30 static volatile int ptmx = -1;
31 static char buf[BUF_SIZE];
32
setup(void)33 static void setup(void)
34 {
35 fzsync_pair.exec_loops = 100000;
36 tst_fzsync_pair_init(&fzsync_pair);
37 }
38
thread_run(void * arg)39 static void *thread_run(void *arg)
40 {
41 while (tst_fzsync_run_b(&fzsync_pair)) {
42 tst_fzsync_start_race_b(&fzsync_pair);
43 ioctl(ptmx, TCFLSH, TCIOFLUSH);
44 tst_fzsync_end_race_b(&fzsync_pair);
45 }
46
47 return arg;
48 }
49
run(void)50 static void run(void)
51 {
52 int ldisc = N_HDLC;
53
54 tst_fzsync_pair_reset(&fzsync_pair, thread_run);
55
56 while (tst_fzsync_run_a(&fzsync_pair)) {
57 ptmx = SAFE_OPEN("/dev/ptmx", O_RDWR);
58 TEST(ioctl(ptmx, TIOCSETD, &ldisc));
59
60 if (TST_RET == -1 && TST_ERR == EINVAL) {
61 tst_brk(TCONF, "HDLC line discipline not available");
62 } else if (TST_RET == -1) {
63 tst_brk(TBROK | TTERRNO, "Cannot set line discipline");
64 } else if (TST_RET != 0) {
65 tst_brk(TBROK | TTERRNO,
66 "Invalid ioctl() return value %ld", TST_RET);
67 }
68
69 SAFE_IOCTL(ptmx, TCXONC, TCOOFF);
70 SAFE_WRITE(1, ptmx, buf, BUF_SIZE);
71
72 tst_fzsync_start_race_a(&fzsync_pair);
73 ioctl(ptmx, TCXONC, TCOON);
74 tst_fzsync_end_race_a(&fzsync_pair);
75
76 SAFE_CLOSE(ptmx);
77
78 if (tst_taint_check()) {
79 tst_res(TFAIL, "Kernel is vulnerable");
80 return;
81 }
82 }
83
84 tst_res(TPASS, "Nothing bad happened, probably");
85 }
86
cleanup(void)87 static void cleanup(void)
88 {
89 tst_fzsync_pair_cleanup(&fzsync_pair);
90
91 if (ptmx >= 0)
92 SAFE_CLOSE(ptmx);
93 }
94
95 static struct tst_test test = {
96 .test_all = run,
97 .setup = setup,
98 .cleanup = cleanup,
99 .taint_check = TST_TAINT_W | TST_TAINT_D,
100 .tags = (const struct tst_tag[]) {
101 {"linux-git", "82f2341c94d27"},
102 {"CVE", "2017-2636"},
103 {}
104 }
105 };
106