testcases/kernel/syscalls/add_key/add_key02.c

/******************************************************************************
 * Copyright (c) Crackerjack Project., 2007				      *
 * Copyright (c) 2017 Google, Inc.                                            *
 *									      *
 * This program is free software;  you can redistribute it and/or modify      *
 * it under the terms of the GNU General Public License as published by       *
 * the Free Software Foundation; either version 2 of the License, or	      *
 * (at your option) any later version.					      *
 *									      *
 * This program is distributed in the hope that it will be useful,	      *
 * but WITHOUT ANY WARRANTY;  without even the implied warranty of	      *
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See		      *
 * the GNU General Public License for more details.			      *
 *									      *
 * You should have received a copy of the GNU General Public License	      *
 * along with this program;  if not, write to the Free Software	Foundation,   *
 * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA           *
 *									      *
 ******************************************************************************/

/*
 * Test that the add_key() syscall correctly handles a NULL payload with nonzero
 * length.  Specifically, it should fail with EFAULT rather than oopsing the
 * kernel with a NULL pointer dereference or failing with EINVAL, as it did
 * before (depending on the key type).  This is a regression test for commit
 * 5649645d725c ("KEYS: fix dereferencing NULL payload with nonzero length").
 *
 * Note that none of the key types that exhibited the NULL pointer dereference
 * are guaranteed to be built into the kernel, so we just test as many as we
 * can, in the hope of catching one.  We also test with the "user" key type for
 * good measure, although it was one of the types that failed with EINVAL rather
 * than dereferencing NULL.
 *
 * This has been assigned CVE-2017-15274.
 */

#include <errno.h>

#include "tst_test.h"
#include "lapi/keyctl.h"

struct tcase {
	const char *type;
	size_t plen;
} tcases[] = {
	/*
	 * The payload length we test for each key type needs to pass initial
	 * validation but is otherwise arbitrary.  Note: the "rxrpc_s" key type
	 * requires a payload of exactly 8 bytes.
	 */
	{ "asymmetric",		64 },
	{ "cifs.idmap",		64 },
	{ "cifs.spnego",	64 },
	{ "pkcs7_test",		64 },
	{ "rxrpc",		64 },
	{ "rxrpc_s",		 8 },
	{ "user",		64 },
	{ "logon",              64 },
};

static void verify_add_key(unsigned int i)
{
	TEST(add_key(tcases[i].type,
		"abc:def", NULL, tcases[i].plen, KEY_SPEC_PROCESS_KEYRING));

	if (TEST_RETURN != -1) {
		tst_res(TFAIL,
			"add_key() with key type '%s' unexpectedly succeeded",
			tcases[i].type);
		return;
	}

	if (TEST_ERRNO == EFAULT) {
		tst_res(TPASS, "received expected EFAULT with key type '%s'",
			tcases[i].type);
		return;
	}

	if (TEST_ERRNO == ENODEV) {
		tst_res(TCONF, "kernel doesn't support key type '%s'",
			tcases[i].type);
		return;
	}

	/*
	 * It's possible for the "asymmetric" key type to be supported, but with
	 * no asymmetric key parsers registered.  In that case, attempting to
	 * add a key of type asymmetric will fail with EBADMSG.
	 */
	if (TEST_ERRNO == EBADMSG && !strcmp(tcases[i].type, "asymmetric")) {
		tst_res(TCONF, "no asymmetric key parsers are registered");
		return;
	}

	tst_res(TFAIL | TTERRNO, "unexpected error with key type '%s'",
		tcases[i].type);
}

static struct tst_test test = {
	.tcnt = ARRAY_SIZE(tcases),
	.test = verify_add_key,
};