1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2017 Richard Palethorpe <rpalethorpe@suse.com>
4 * Copyright (c) 2016 Jan Horn <jann@thejh.net>
5 */
6
7 /*\
8 * [Description]
9 *
10 * Test for CVE-2016-10044, which was fixed in kernel v4.8:
11 * 22f6b4d34fcf ("aio: mark AIO pseudo-fs noexec").
12 *
13 * The test checks that we can not implicitly mark AIO mappings as
14 * executable using the READ_IMPLIES_EXEC personality.
15 */
16
17 #include <stdio.h>
18 #include <stdint.h>
19 #include <string.h>
20 #include "lapi/personality.h"
21 #include "tst_test.h"
22 #include "tst_safe_stdio.h"
23 #include "lapi/syscalls.h"
24
25 static FILE * f;
26
cleanup(void)27 static void cleanup(void)
28 {
29 if (f)
30 SAFE_FCLOSE(f);
31 }
32
run(void)33 static void run(void)
34 {
35 void *ctx = 0;
36 char perms[8], line[BUFSIZ];
37
38 SAFE_PERSONALITY(READ_IMPLIES_EXEC);
39 if (tst_syscall(__NR_io_setup, 1, &ctx))
40 tst_brk(TBROK | TERRNO, "Failed to create AIO context");
41
42 f = SAFE_FOPEN("/proc/self/maps", "r");
43 while (fgets(line, BUFSIZ, f) != NULL) {
44 if (strstr(line, "[aio]") != NULL)
45 goto found_mapping;
46 }
47 tst_brk(TCONF, "Could not find mapping in /proc/self/maps");
48
49 found_mapping:
50 if (sscanf(line, "%*x-%*x %s", perms) != 1)
51 tst_brk(TBROK, "failed to find permission string in %s", line);
52 if (strchr(perms, (int)'x'))
53 tst_res(TFAIL, "AIO mapping is executable: %s!", perms);
54 else
55 tst_res(TPASS, "AIO mapping is not executable: %s", perms);
56
57 if (tst_syscall(__NR_io_destroy, ctx))
58 tst_brk(TBROK | TERRNO, "Failed to destroy AIO context");
59
60 SAFE_FCLOSE(f);
61 f = NULL;
62 }
63
64 static struct tst_test test = {
65 .test_all = run,
66 .cleanup = cleanup,
67 .tags = (const struct tst_tag[]) {
68 {"linux-git", "22f6b4d34fcf"},
69 {"CVE", "2016-10044"},
70 {}
71 }
72 };
73