1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) Crackerjack Project., 2007
4 * Copyright (c) 2017 Google, Inc.
5 *
6 * Test that the add_key() syscall correctly handles a NULL payload with nonzero
7 * length. Specifically, it should fail with EFAULT rather than oopsing the
8 * kernel with a NULL pointer dereference or failing with EINVAL, as it did
9 * before (depending on the key type). This is a regression test for commit
10 * 5649645d725c ("KEYS: fix dereferencing NULL payload with nonzero length").
11 *
12 * Note that none of the key types that exhibited the NULL pointer dereference
13 * are guaranteed to be built into the kernel, so we just test as many as we
14 * can, in the hope of catching one. We also test with the "user" key type for
15 * good measure, although it was one of the types that failed with EINVAL rather
16 * than dereferencing NULL.
17 *
18 * This has been assigned CVE-2017-15274.
19 */
20
21 #include <errno.h>
22
23 #include "tst_test.h"
24 #include "lapi/keyctl.h"
25
26 struct tcase {
27 const char *type;
28 size_t plen;
29 } tcases[] = {
30 /*
31 * The payload length we test for each key type needs to pass initial
32 * validation but is otherwise arbitrary. Note: the "rxrpc_s" key type
33 * requires a payload of exactly 8 bytes.
34 */
35 { "asymmetric", 64 },
36 { "cifs.idmap", 64 },
37 { "cifs.spnego", 64 },
38 { "pkcs7_test", 64 },
39 { "rxrpc", 64 },
40 { "rxrpc_s", 8 },
41 { "user", 64 },
42 { "logon", 64 },
43 { "big_key", 64 },
44 };
45
verify_add_key(unsigned int i)46 static void verify_add_key(unsigned int i)
47 {
48 TEST(add_key(tcases[i].type,
49 "abc:def", NULL, tcases[i].plen, KEY_SPEC_PROCESS_KEYRING));
50
51 if (TST_RET != -1) {
52 tst_res(TFAIL,
53 "add_key() with key type '%s' unexpectedly succeeded",
54 tcases[i].type);
55 return;
56 }
57
58 if (TST_ERR == EFAULT) {
59 tst_res(TPASS, "received expected EFAULT with key type '%s'",
60 tcases[i].type);
61 return;
62 }
63
64 if (TST_ERR == ENODEV) {
65 tst_res(TCONF, "kernel doesn't support key type '%s'",
66 tcases[i].type);
67 return;
68 }
69
70 /*
71 * It's possible for the "asymmetric" key type to be supported, but with
72 * no asymmetric key parsers registered. In that case, attempting to
73 * add a key of type asymmetric will fail with EBADMSG.
74 */
75 if (TST_ERR == EBADMSG && !strcmp(tcases[i].type, "asymmetric")) {
76 tst_res(TCONF, "no asymmetric key parsers are registered");
77 return;
78 }
79
80 tst_res(TFAIL | TTERRNO, "unexpected error with key type '%s'",
81 tcases[i].type);
82 }
83
84 static struct tst_test test = {
85 .tcnt = ARRAY_SIZE(tcases),
86 .test = verify_add_key,
87 .tags = (const struct tst_tag[]) {
88 {"linux-git", "5649645d725c"},
89 {"CVE", "2017-15274"},
90 {}
91 }
92 };
93