Caspar Zhang | 2b4138a | 2012-01-16 22:31:40 +0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2012 Red Hat, Inc. |
| 3 | * |
| 4 | * This program is free software; you can redistribute it and/or |
| 5 | * modify it under the terms of version 2 of the GNU General Public |
| 6 | * License as published by the Free Software Foundation. |
| 7 | * |
| 8 | * This program is distributed in the hope that it would be useful, |
| 9 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 10 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
| 11 | * |
| 12 | * Further, this software is distributed without any warranty that it |
| 13 | * is free of the rightful claim of any third person regarding |
| 14 | * infringement or the like. Any license provided herein, whether |
| 15 | * implied or otherwise, applies only to this software file. Patent |
| 16 | * licenses, if any, provided herein do not apply to combinations of |
| 17 | * this program with other software, or any other product whatsoever. |
| 18 | * |
| 19 | * You should have received a copy of the GNU General Public License |
| 20 | * along with this program; if not, write the Free Software |
| 21 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
| 22 | * 02110-1301, USA. |
| 23 | */ |
| 24 | /* |
| 25 | * This is a reproducer for CVE-2011-2496. |
| 26 | * |
| 27 | * The normal mmap paths all avoid creating a mapping where the pgoff |
| 28 | * inside the mapping could wrap around due to overflow. However, an |
| 29 | * expanding mremap() can take such a non-wrapping mapping and make it |
| 30 | * bigger and cause a wrapping condition. There is also another case |
| 31 | * where we expand mappings hiding in plain sight: the automatic stack |
| 32 | * expansion. |
| 33 | * |
| 34 | * This program tries to remap a mapping with a new size that would |
| 35 | * wrap pgoff. Notice that it only works on 32-bit arch for now. |
| 36 | */ |
| 37 | |
| 38 | #define _GNU_SOURCE |
| 39 | #include "config.h" |
| 40 | #include <sys/types.h> |
| 41 | #include <sys/mman.h> |
| 42 | #include <sys/stat.h> |
| 43 | #include <sys/syscall.h> |
| 44 | #include <errno.h> |
| 45 | #include <fcntl.h> |
| 46 | #include <limits.h> |
| 47 | #include <stdio.h> |
| 48 | #include <stdlib.h> |
| 49 | #include <unistd.h> |
| 50 | |
| 51 | #include "test.h" |
Caspar Zhang | 2b4138a | 2012-01-16 22:31:40 +0800 | [diff] [blame] | 52 | |
| 53 | char *TCID = "vma03"; |
| 54 | int TST_TOTAL = 1; |
| 55 | |
| 56 | #ifdef __NR_mmap2 |
| 57 | #define TESTFILE "testfile" |
| 58 | |
| 59 | static size_t pgsz; |
| 60 | static int fd; |
| 61 | |
| 62 | static void *mmap2(void *addr, size_t length, int prot, |
Wanlong Gao | 354ebb4 | 2012-12-07 10:10:04 +0800 | [diff] [blame] | 63 | int flags, int fd, off_t pgoffset); |
Caspar Zhang | 2b4138a | 2012-01-16 22:31:40 +0800 | [diff] [blame] | 64 | static void setup(void); |
| 65 | static void cleanup(void); |
| 66 | |
| 67 | int main(int argc, char *argv[]) |
| 68 | { |
Cyril Hrubis | 0b9589f | 2014-05-27 17:40:33 +0200 | [diff] [blame] | 69 | const char *msg; |
Caspar Zhang | 2b4138a | 2012-01-16 22:31:40 +0800 | [diff] [blame] | 70 | int lc; |
| 71 | void *map, *remap; |
| 72 | off_t pgoff; |
| 73 | |
| 74 | #if __WORDSIZE != 32 |
| 75 | tst_brkm(TCONF, NULL, "test is designed for 32-bit system only."); |
| 76 | #endif |
| 77 | msg = parse_opts(argc, argv, NULL, NULL); |
| 78 | if (msg != NULL) |
| 79 | tst_brkm(TBROK, NULL, "OPTION PARSING ERROR - %s", msg); |
| 80 | |
| 81 | pgsz = sysconf(_SC_PAGE_SIZE); |
| 82 | setup(); |
| 83 | |
| 84 | for (lc = 0; TEST_LOOPING(lc); lc++) { |
Caspar Zhang | d59a659 | 2013-03-07 14:59:12 +0800 | [diff] [blame] | 85 | tst_count = 0; |
Caspar Zhang | 2b4138a | 2012-01-16 22:31:40 +0800 | [diff] [blame] | 86 | |
| 87 | fd = open(TESTFILE, O_RDWR); |
| 88 | if (fd == -1) |
Wanlong Gao | 354ebb4 | 2012-12-07 10:10:04 +0800 | [diff] [blame] | 89 | tst_brkm(TBROK | TERRNO, NULL, "open %s", TESTFILE); |
Caspar Zhang | 2b4138a | 2012-01-16 22:31:40 +0800 | [diff] [blame] | 90 | |
| 91 | pgoff = ULONG_MAX - 1; |
Wanlong Gao | 354ebb4 | 2012-12-07 10:10:04 +0800 | [diff] [blame] | 92 | map = mmap2(NULL, pgsz, PROT_READ | PROT_WRITE, MAP_PRIVATE, |
| 93 | fd, pgoff); |
Caspar Zhang | 2b4138a | 2012-01-16 22:31:40 +0800 | [diff] [blame] | 94 | if (map == MAP_FAILED) |
Wanlong Gao | 354ebb4 | 2012-12-07 10:10:04 +0800 | [diff] [blame] | 95 | tst_brkm(TBROK | TERRNO, cleanup, "mmap2"); |
Caspar Zhang | 2b4138a | 2012-01-16 22:31:40 +0800 | [diff] [blame] | 96 | |
| 97 | remap = mremap(map, pgsz, 2 * pgsz, 0); |
| 98 | if (remap == MAP_FAILED) { |
| 99 | if (errno == EINVAL) |
Wanlong Gao | 354ebb4 | 2012-12-07 10:10:04 +0800 | [diff] [blame] | 100 | tst_resm(TPASS, "mremap failed as expected."); |
Caspar Zhang | 2b4138a | 2012-01-16 22:31:40 +0800 | [diff] [blame] | 101 | else |
Wanlong Gao | 354ebb4 | 2012-12-07 10:10:04 +0800 | [diff] [blame] | 102 | tst_resm(TFAIL | TERRNO, "mremap"); |
Shuang Qiu | c055410 | 2013-05-27 14:29:42 +0800 | [diff] [blame] | 103 | munmap(map, pgsz); |
Caspar Zhang | 2b4138a | 2012-01-16 22:31:40 +0800 | [diff] [blame] | 104 | } else { |
| 105 | tst_resm(TFAIL, "mremap succeeded unexpectedly."); |
Shuang Qiu | c055410 | 2013-05-27 14:29:42 +0800 | [diff] [blame] | 106 | munmap(remap, 2 * pgsz); |
Caspar Zhang | 2b4138a | 2012-01-16 22:31:40 +0800 | [diff] [blame] | 107 | } |
| 108 | |
| 109 | close(fd); |
| 110 | } |
| 111 | |
| 112 | cleanup(); |
| 113 | tst_exit(); |
| 114 | } |
| 115 | |
| 116 | static void *mmap2(void *addr, size_t length, int prot, |
Wanlong Gao | 354ebb4 | 2012-12-07 10:10:04 +0800 | [diff] [blame] | 117 | int flags, int fd, off_t pgoffset) |
Caspar Zhang | 2b4138a | 2012-01-16 22:31:40 +0800 | [diff] [blame] | 118 | { |
| 119 | return (void *)syscall(SYS_mmap2, addr, length, prot, |
Wanlong Gao | 354ebb4 | 2012-12-07 10:10:04 +0800 | [diff] [blame] | 120 | flags, fd, pgoffset); |
Caspar Zhang | 2b4138a | 2012-01-16 22:31:40 +0800 | [diff] [blame] | 121 | } |
| 122 | |
| 123 | static void setup(void) |
| 124 | { |
| 125 | tst_sig(FORK, DEF_HANDLER, cleanup); |
| 126 | |
| 127 | tst_tmpdir(); |
| 128 | |
| 129 | fd = creat(TESTFILE, 0644); |
| 130 | if (fd == -1) |
Wanlong Gao | 354ebb4 | 2012-12-07 10:10:04 +0800 | [diff] [blame] | 131 | tst_brkm(TBROK | TERRNO, NULL, "creat %s", TESTFILE); |
Caspar Zhang | 2b4138a | 2012-01-16 22:31:40 +0800 | [diff] [blame] | 132 | close(fd); |
| 133 | |
| 134 | TEST_PAUSE; |
| 135 | } |
| 136 | |
| 137 | static void cleanup(void) |
| 138 | { |
Caspar Zhang | 2b4138a | 2012-01-16 22:31:40 +0800 | [diff] [blame] | 139 | tst_rmdir(); |
| 140 | } |
| 141 | #else /* __NR_mmap2 */ |
| 142 | int main(int argc, char *argv[]) |
| 143 | { |
| 144 | tst_brkm(TCONF, NULL, "__NR_mmap2 is not defined on your system"); |
| 145 | } |
| 146 | #endif |