Add regression test for CVE-2017-17052

testcases/cve/cve-2017-17052.c new file +5 -0

+
+#include <unistd.h>
+#include <pthread.h>
+#include <stdlib.h>
+#include <stdio.h>

Welcome to LTP :-)

Quoted 1 line

+#include "tst_safe_sysv_ipc.h"

It is better to use a shared mapping created with mmap. The SYSV safe macros are only for testing SYSV shared memory itself and otherwise should be avoided.

testcases/cve/cve-2017-17052.c new file +56 -0

+static void *mmap_thread(void *_arg)
+{
+	for (;;) {
+		SAFE_MMAP(NULL, 0x1000000, PROT_READ,
+				MAP_POPULATE|MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
+	}
+}
+
+static void *fork_thread(void *_arg)
+{
+	if (shm->exit) {
+		SAFE_SHMDT(shm);
+		exit(0);
+	}
+
+	usleep(rand() % 10000);
+	SAFE_FORK();
+}
+
+static void do_test_fork(void)
+{
+	volatile int i;
+	int status;
+
+	SAFE_FORK();
+	SAFE_FORK();
+	SAFE_FORK();
+
+	for(;;) {
+		if (SAFE_FORK() == 0) {
+			pthread_t t;
+
+			SAFE_PTHREAD_CREATE(&t, NULL, mmap_thread, NULL);
+			SAFE_PTHREAD_CREATE(&t, NULL, fork_thread, NULL);
+			usleep(rand() % 10000);
+			syscall(__NR_exit_group, 0);
+		}
+		SAFE_WAIT(&status);
+		if (shm->exit)
+			exit(0);
+	}
+}
+
+static void run(void)
+{
+	pid_t pid;
+	int status;
+	volatile int run = 0;
+
+	while (run < RUNS) {
+		pid = SAFE_FORK();
+
+		if (pid == 0) {
+			do_test_fork();
+		} else {
+			usleep(EXEC_USEC);

Apart from the SHM, that's already been commented here my only question is what is the outcome of the test on unpatched kernel? I suppose that we got TPASS when everything is going well, do we print the "something strange happened" message if the test fails, or does it fail elsewhere?

Well, on an unpatched kernel, it does not survive the test. In my QEMU testing, the kernel never survived this test until the end. Unfortunately, I was not able to test for this CVE without risking a crash.
That is the reason why there is no "the kernel is vulnerable" message.