1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (C) 2021 SUSE LLC
4 * Author: Nicolai Stange <nstange@suse.de>
5 * LTP port: Martin Doucha <mdoucha@suse.cz>
6 *
7 * CVE-2020-29373
8 *
9 * Check that io_uring does not bypass chroot. Fixed in:
10 *
11 * commit 9392a27d88b9707145d713654eb26f0c29789e50
12 * Author: Jens Axboe <axboe@kernel.dk>
13 * Date: Thu Feb 6 21:42:51 2020 -0700
14 *
15 * io-wq: add support for inheriting ->fs
16 *
17 * commit ff002b30181d30cdfbca316dadd099c3ca0d739c
18 * Author: Jens Axboe <axboe@kernel.dk>
19 * Date: Fri Feb 7 16:05:21 2020 -0700
20 *
21 * io_uring: grab ->fs as part of async preparation
22 *
23 * stable 5.4 specific backport:
24 *
25 * commit c4a23c852e80a3921f56c6fbc851a21c84a6d06b
26 * Author: Nicolai Stange <nstange@suse.de>
27 * Date: Wed Jan 27 14:34:43 2021 +0100
28 */
29
30 #include <stdio.h>
31 #include <sys/socket.h>
32 #include <sys/un.h>
33 #include "tst_test.h"
34 #include "tst_safe_io_uring.h"
35
36 #define CHROOT_DIR "test_root"
37 #define SOCK_NAME "sock"
38 #define SPAM_MARK 0xfa7
39 #define BEEF_MARK 0xbeef
40
41 static struct sockaddr_un addr;
42 static int sendsock = -1, recvsock = -1, sockpair[2] = {-1, -1};
43 static struct io_uring_params params;
44 static struct tst_io_uring uring = { .fd = -1 };
45 static char buf[16];
46 static struct iovec iov = {
47 .iov_base = buf,
48 .iov_len = sizeof(buf)
49 };
50
51 static struct msghdr spam_header = {
52 .msg_name = NULL,
53 .msg_namelen = 0,
54 .msg_iov = &iov,
55 .msg_iovlen = 1
56 };
57
58 static struct msghdr beef_header = {
59 .msg_name = &addr,
60 .msg_namelen = sizeof(addr),
61 .msg_iov = &iov,
62 .msg_iovlen = 1
63 };
64
setup(void)65 static void setup(void)
66 {
67 char *tmpdir = tst_get_tmpdir();
68 int ret;
69
70 addr.sun_family = AF_UNIX;
71 ret = snprintf(addr.sun_path, sizeof(addr.sun_path), "%s/%s", tmpdir,
72 SOCK_NAME);
73 free(tmpdir);
74
75 if (ret >= (int)sizeof(addr.sun_path))
76 tst_brk(TBROK, "Tempdir path is too long");
77
78 io_uring_setup_supported_by_kernel();
79
80 sendsock = SAFE_SOCKET(AF_UNIX, SOCK_DGRAM, 0);
81 recvsock = SAFE_SOCKET(AF_UNIX, SOCK_DGRAM, 0);
82 SAFE_BIND(recvsock, (struct sockaddr *)&addr, sizeof(addr));
83
84 SAFE_MKDIR(CHROOT_DIR, 0755);
85 SAFE_CHROOT(CHROOT_DIR);
86 }
87
drain_fallback(void)88 static void drain_fallback(void)
89 {
90 uint32_t i, count, tail;
91 int beef_found = 0;
92 struct io_uring_sqe *sqe_ptr = uring.sqr_entries;
93 const struct io_uring_cqe *cqe_ptr;
94
95 SAFE_SOCKETPAIR(AF_UNIX, SOCK_DGRAM, 0, sockpair);
96 SAFE_SETSOCKOPT_INT(sockpair[0], SOL_SOCKET, SO_SNDBUF,
97 32+sizeof(buf));
98 SAFE_FCNTL(sockpair[0], F_SETFL, O_NONBLOCK);
99
100 /* Add spam requests to force async processing of the real test */
101 for (i = 0, tail = *uring.sqr_tail; i < 255; i++, tail++, sqe_ptr++) {
102 memset(sqe_ptr, 0, sizeof(*sqe_ptr));
103 sqe_ptr->opcode = IORING_OP_SENDMSG;
104 sqe_ptr->flags = IOSQE_IO_DRAIN;
105 sqe_ptr->fd = sockpair[0];
106 sqe_ptr->addr = (__u64)&spam_header;
107 sqe_ptr->user_data = SPAM_MARK;
108 uring.sqr_array[tail & *uring.sqr_mask] = i;
109 }
110
111 /* Add the real test to queue */
112 memset(sqe_ptr, 0, sizeof(*sqe_ptr));
113 sqe_ptr->opcode = IORING_OP_SENDMSG;
114 sqe_ptr->flags = IOSQE_IO_DRAIN;
115 sqe_ptr->fd = sendsock;
116 sqe_ptr->addr = (__u64)&beef_header;
117 sqe_ptr->user_data = BEEF_MARK;
118 uring.sqr_array[tail & *uring.sqr_mask] = i;
119 count = ++i;
120 tail++;
121
122 __atomic_store(uring.sqr_tail, &tail, __ATOMIC_RELEASE);
123 SAFE_IO_URING_ENTER(1, uring.fd, count, count, IORING_ENTER_GETEVENTS,
124 NULL);
125
126 /* Check test results */
127 __atomic_load(uring.cqr_tail, &tail, __ATOMIC_ACQUIRE);
128
129 for (i = *uring.cqr_head; i != tail; i++, count--) {
130 cqe_ptr = uring.cqr_entries + (i & *uring.cqr_mask);
131 TST_ERR = -cqe_ptr->res;
132
133 if (cqe_ptr->user_data == SPAM_MARK) {
134 if (cqe_ptr->res >= 0 || cqe_ptr->res == -EAGAIN)
135 continue;
136
137 tst_res(TFAIL | TTERRNO,
138 "Spam request failed unexpectedly");
139 continue;
140 }
141
142 if (cqe_ptr->user_data != BEEF_MARK) {
143 tst_res(TFAIL, "Unexpected entry in completion queue");
144 count++;
145 continue;
146 }
147
148 beef_found = 1;
149
150 if (cqe_ptr->res >= 0) {
151 tst_res(TFAIL, "Write outside chroot succeeded.");
152 } else if (cqe_ptr->res != -ENOENT) {
153 tst_res(TFAIL | TTERRNO,
154 "Write outside chroot failed unexpectedly");
155 } else {
156 tst_res(TPASS | TTERRNO,
157 "Write outside chroot failed as expected");
158 }
159 }
160
161 __atomic_store(uring.cqr_head, &i, __ATOMIC_RELEASE);
162
163 if (!beef_found)
164 tst_res(TFAIL, "Write outside chroot result not found");
165
166 if (count)
167 tst_res(TFAIL, "Wrong number of entries in completion queue");
168
169 SAFE_CLOSE(sockpair[0]);
170 SAFE_CLOSE(sockpair[1]);
171 }
172
check_result(void)173 static void check_result(void)
174 {
175 const struct io_uring_cqe *cqe_ptr;
176
177 cqe_ptr = uring.cqr_entries + (*uring.cqr_head & *uring.cqr_mask);
178 ++*uring.cqr_head;
179 TST_ERR = -cqe_ptr->res;
180
181 if (cqe_ptr->user_data != BEEF_MARK) {
182 tst_res(TFAIL, "Unexpected entry in completion queue");
183 return;
184 }
185
186 if (cqe_ptr->res == -EINVAL) {
187 tst_res(TINFO, "IOSQE_ASYNC is not supported, using fallback");
188 drain_fallback();
189 return;
190 }
191
192 tst_res(TINFO, "IOSQE_ASYNC is supported");
193
194 if (cqe_ptr->res >= 0) {
195 tst_res(TFAIL, "Write outside chroot succeeded.");
196 return;
197 }
198
199 if (cqe_ptr->res != -ENOENT) {
200 tst_res(TFAIL | TTERRNO,
201 "Write outside chroot failed unexpectedly");
202 return;
203 }
204
205 tst_res(TPASS | TTERRNO, "Write outside chroot failed as expected");
206 }
207
run(void)208 static void run(void)
209 {
210 uint32_t tail;
211 struct io_uring_sqe *sqe_ptr;
212
213 SAFE_IO_URING_INIT(512, ¶ms, &uring);
214 sqe_ptr = uring.sqr_entries;
215 tail = *uring.sqr_tail;
216
217 memset(sqe_ptr, 0, sizeof(*sqe_ptr));
218 sqe_ptr->opcode = IORING_OP_SENDMSG;
219 sqe_ptr->flags = IOSQE_ASYNC;
220 sqe_ptr->fd = sendsock;
221 sqe_ptr->addr = (__u64)&beef_header;
222 sqe_ptr->user_data = BEEF_MARK;
223 uring.sqr_array[tail & *uring.sqr_mask] = 0;
224 tail++;
225
226 __atomic_store(uring.sqr_tail, &tail, __ATOMIC_RELEASE);
227 SAFE_IO_URING_ENTER(1, uring.fd, 1, 1, IORING_ENTER_GETEVENTS, NULL);
228 check_result();
229 SAFE_IO_URING_CLOSE(&uring);
230 }
231
cleanup(void)232 static void cleanup(void)
233 {
234 if (uring.fd >= 0)
235 SAFE_IO_URING_CLOSE(&uring);
236
237 if (sockpair[0] >= 0) {
238 SAFE_CLOSE(sockpair[0]);
239 SAFE_CLOSE(sockpair[1]);
240 }
241
242 if (recvsock >= 0)
243 SAFE_CLOSE(recvsock);
244
245 if (sendsock >= 0)
246 SAFE_CLOSE(sendsock);
247 }
248
249 static struct tst_test test = {
250 .test_all = run,
251 .setup = setup,
252 .cleanup = cleanup,
253 .needs_tmpdir = 1,
254 .caps = (struct tst_cap []) {
255 TST_CAP(TST_CAP_REQ, CAP_SYS_CHROOT),
256 {}
257 },
258 .save_restore = (const struct tst_path_val[]) {
259 {"/proc/sys/kernel/io_uring_disabled", "0",
260 TST_SR_SKIP_MISSING | TST_SR_TCONF_RO},
261 {}
262 },
263 .tags = (const struct tst_tag[]) {
264 {"linux-git", "9392a27d88b9"},
265 {"linux-git", "ff002b30181d"},
266 {"linux-git", "d87683620489"},
267 {"linux-stable-git", "c4a23c852e80"},
268 {"linux-stable-git", "cac68d12c531"},
269 {"CVE", "2020-29373"},
270 {}
271 }
272 };
273