cve/cve-2016-10044.c: fix two errors

PATCH New Xiao Yang 3 participants 9 messages Sep 22, 2017 – Oct 26, 2017

Share & tools

Xiao Yang

author

2017-09-22 09:21 UTC #0 lore raw

PATCH 1/1 cve/cve-2016-10044.c: fix two errors

1) If the number of nr_events exceeds the limit of available events defined in /proc/sys/fs/aio-max-nr, it returns EAGAIN. We should call io_destroy() to cleanup the AIO context after finishing test.

Steps to reproduce this error:

      #echo 4 > /proc/sys/fs/aio-max-nr
      # ./cve-2016-10044 -i 5
      tst_test.c:908: INFO: Timeout per run is 0h 05m 00s
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:49: BROK: Failed to create AIO context: EAGAIN/EWOULDBLOCK

2) The kernel created an AIO pseudo-fs and introduced cve-2016-10044 by the following patch:
'71ad7490c1f3("rework aio migrate pages to use aio fs")'

We should return TCONF rather than TBROK when an AIO pseudo-fs is not found in /proc/self/maps.

Signed-off-by Xiao Yang <[email protected]>

---
 testcases/cve/cve-2016-10044.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

testcases/cve/cve-2016-10044.c +4 -1

index 7928d27..a84590a 100644
@@ -53,7 +53,7 @@ static void run(void)
 		if (strstr(line, "/[aio]") != NULL)
 			goto found_mapping;
 	}
-	tst_brk(TBROK, "Could not find mapping in /proc/self/maps");
+	tst_brk(TCONF, "Could not find mapping in /proc/self/maps");
 
 found_mapping:
 	if (sscanf(line, "%*x-%*x %s7", perms) < 0)

@@ -63,6 +63,9 @@ found_mapping:
 	else
 		tst_res(TPASS, "AIO mapping is not executable: %s", perms);
 
+	if (tst_syscall(__NR_io_destroy, ctx))
+		tst_brk(TBROK | TERRNO, "Failed to destroy AIO context");
+
 	SAFE_FCLOSE(f);
 	f = NULL;
 }

Signature · 1 line

1.8.3.1

Richard Palethorpe

2017-09-22 11:06 UTC #1 lore raw

PATCH 1/1 cve/cve-2016-10044.c: fix two errors

Hello,

Quoted 14 lines · Xiao Yang

1) If the number of nr_events exceeds the limit of available events defined in /proc/sys/fs/aio-max-nr, it returns EAGAIN. We should call io_destroy() to cleanup the AIO context after finishing test.
Steps to reproduce this error:
      #echo 4 > /proc/sys/fs/aio-max-nr
      # ./cve-2016-10044 -i 5
      tst_test.c:908: INFO: Timeout per run is 0h 05m 00s
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:49: BROK: Failed to create AIO context: EAGAIN/EWOULDBLOCK

Quoted 6 lines

2) The kernel created an AIO pseudo-fs and introduced cve-2016-10044 by the following patch:
'71ad7490c1f3("rework aio migrate pages to use aio fs")'
We should return TCONF rather than TBROK when an AIO pseudo-fs is not found in /proc/self/maps.

Maybe instead of doing this we could increase the required kernel version to 3.12 which appears to be where the patch was introduced?

Otherwise we may fail with TCONF because the format of the file has slightly changed and I am worried that nobody will notice. I don't think this will have been backported to earlier versions:
http://lkml.iu.edu/hypermail/linux/kernel/1312.0/04590.html

The rest LGTM. Thanks.

Quoted 31 lines

Signed-off-by Xiao Yang <[email protected]>

---
 testcases/cve/cve-2016-10044.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

testcases/cve/cve-2016-10044.c +4 -1

index 7928d27..a84590a 100644
@@ -53,7 +53,7 @@ static void run(void)
 		if (strstr(line, "/[aio]") != NULL)
 			goto found_mapping;
 	}
-	tst_brk(TBROK, "Could not find mapping in /proc/self/maps");
+	tst_brk(TCONF, "Could not find mapping in /proc/self/maps");
 
 found_mapping:
 	if (sscanf(line, "%*x-%*x %s7", perms) < 0)

@@ -63,6 +63,9 @@ found_mapping:
 	else
 		tst_res(TPASS, "AIO mapping is not executable: %s", perms);
 
+	if (tst_syscall(__NR_io_destroy, ctx))
+		tst_brk(TBROK | TERRNO, "Failed to destroy AIO context");
+
 	SAFE_FCLOSE(f);
 	f = NULL;
 }

Signature · 1 line

1.8.3.1

Signature · 2 lines

Thank you,
Richard.

Xiao Yang

author

2017-09-25 10:47 UTC #2 lore raw

PATCH 1/1 cve/cve-2016-10044.c: fix two errors

Quoted 24 lines · Richard Palethorpe

Hello,
Quoted 14 lines · Xiao Yang
1) If the number of nr_events exceeds the limit of available events defined in /proc/sys/fs/aio-max-nr, it returns EAGAIN. We should call io_destroy() to cleanup the AIO context after finishing test.
Steps to reproduce this error:
      #echo 4 > /proc/sys/fs/aio-max-nr
      # ./cve-2016-10044 -i 5
      tst_test.c:908: INFO: Timeout per run is 0h 05m 00s
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:49: BROK: Failed to create AIO context: EAGAIN/EWOULDBLOCK
Quoted 6 lines
2) The kernel created an AIO pseudo-fs and introduced cve-2016-10044 by the following patch:
'71ad7490c1f3("rework aio migrate pages to use aio fs")'
We should return TCONF rather than TBROK when an AIO pseudo-fs is not found in /proc/self/maps.

Quoted 7 lines

Maybe instead of doing this we could increase the required kernel version to 3.12 which appears to be where the patch was introduced?
Otherwise we may fail with TCONF because the format of the file has slightly changed and I am worried that nobody will notice. I don't think this will have been backported to earlier versions:
http://lkml.iu.edu/hypermail/linux/kernel/1312.0/04590.html

Hi Richard,

On RHEL7, the above patch has been backported to v3.10.0, so increasing the required
kernel version to 3.12 does not seem better.

The old format of file is set to 'anon_inode:[aio]' by the following patch set:
'55708698c5f1("fs/anon_inode: Introduce a new lib function anon_inode_getfile_private()")' '36bc08cc0170("fs/aio: Add support to aio ring pages migration")'

The current format of file is set to '/[aio]' by the following patch:
'71ad7490c1f3("rework aio migrate pages to use aio fs")'

Could we change the keyword into '[aio]' to match as many formats as possible, and return TCONF if the mapping file does not exist.

Thanks,
Xiao Yang.

Quoted 33 lines

The rest LGTM. Thanks.

Quoted 30 lines

Signed-off-by Xiao Yang <[email protected]>

---
 testcases/cve/cve-2016-10044.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

testcases/cve/cve-2016-10044.c +4 -1

index 7928d27..a84590a 100644
@@ -53,7 +53,7 @@ static void run(void)
 		if (strstr(line, "/[aio]") != NULL)
 			goto found_mapping;
 	}
-	tst_brk(TBROK, "Could not find mapping in /proc/self/maps");
+	tst_brk(TCONF, "Could not find mapping in /proc/self/maps");
 
 found_mapping:
 	if (sscanf(line, "%*x-%*x %s7", perms) < 0)

@@ -63,6 +63,9 @@ found_mapping:
 	else
 		tst_res(TPASS, "AIO mapping is not executable: %s", perms);
 
+	if (tst_syscall(__NR_io_destroy, ctx))
+		tst_brk(TBROK | TERRNO, "Failed to destroy AIO context");
+
 	SAFE_FCLOSE(f);
 	f = NULL;
 }

Signature · 1 line

1.8.3.1

Richard Palethorpe

2017-09-25 11:16 UTC #3 lore raw

PATCH 1/1 cve/cve-2016-10044.c: fix two errors

Hello,

Quoted 42 lines · Xiao Yang

Quoted 24 lines · Richard Palethorpe
Hello,
Quoted 14 lines · Xiao Yang
1) If the number of nr_events exceeds the limit of available events defined in /proc/sys/fs/aio-max-nr, it returns EAGAIN. We should call io_destroy() to cleanup the AIO context after finishing test.
Steps to reproduce this error:
      #echo 4 > /proc/sys/fs/aio-max-nr
      # ./cve-2016-10044 -i 5
      tst_test.c:908: INFO: Timeout per run is 0h 05m 00s
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:49: BROK: Failed to create AIO context: EAGAIN/EWOULDBLOCK
Quoted 6 lines
2) The kernel created an AIO pseudo-fs and introduced cve-2016-10044 by the following patch:
'71ad7490c1f3("rework aio migrate pages to use aio fs")'
We should return TCONF rather than TBROK when an AIO pseudo-fs is not found in /proc/self/maps.
Quoted 7 lines
Maybe instead of doing this we could increase the required kernel version to 3.12 which appears to be where the patch was introduced?
Otherwise we may fail with TCONF because the format of the file has slightly changed and I am worried that nobody will notice. I don't think this will have been backported to earlier versions:
http://lkml.iu.edu/hypermail/linux/kernel/1312.0/04590.html
Hi Richard,
On RHEL7, the above patch has been backported to v3.10.0, so increasing the required
kernel version to 3.12 does not seem better.
The old format of file is set to 'anon_inode:[aio]' by the following patch set:
'55708698c5f1("fs/anon_inode: Introduce a new lib function anon_inode_getfile_private()")' '36bc08cc0170("fs/aio: Add support to aio ring pages migration")'

Quoted 5 lines

The current format of file is set to '/[aio]' by the following patch:
'71ad7490c1f3("rework aio migrate pages to use aio fs")'
Could we change the keyword into '[aio]' to match as many formats as possible, and return TCONF if the mapping file does not exist.

OK, that makes sense to me.

Signature · 2 lines

Thank you,
Richard.

Xiao Yang

author

2017-09-26 02:04 UTC #4 lore raw

PATCH v2 1/1 cve/cve-2016-10044.c: fix two errors

Steps to reproduce this error:

      #echo 4 > /proc/sys/fs/aio-max-nr
      # ./cve-2016-10044 -i 5
      tst_test.c:908: INFO: Timeout per run is 0h 05m 00s
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:49: BROK: Failed to create AIO context: EAGAIN/EWOULDBLOCK

2) This case fails with TBROK on an old kernel(e.g. v2.6.32) because the mapping file does not exist.

The old format of file is set to 'anon_inode:[aio]' by the following
patch set:
'55708698c5f1("fs/anon_inode: Introduce a new lib function anon_inode_getfile_private()")' '36bc08cc0170("fs/aio: Add support to aio ring pages migration")'

The current format of file is set to '/[aio]' by the following patch:
'71ad7490c1f3("rework aio migrate pages to use aio fs")'

We change the keyword into '[aio]' to match as many formats as possible, and return TCONF if the mapping file does not exist.

Signed-off-by Xiao Yang <[email protected]>

---
 testcases/cve/cve-2016-10044.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

testcases/cve/cve-2016-10044.c +5 -2

index 7928d27..14fa0a4 100644
@@ -50,10 +50,10 @@ static void run(void)
 
 	f = SAFE_FOPEN("/proc/self/maps", "r");
 	while (fgets(line, BUFSIZ, f) != NULL) {
-		if (strstr(line, "/[aio]") != NULL)
+		if (strstr(line, "[aio]") != NULL)
 			goto found_mapping;
 	}
-	tst_brk(TBROK, "Could not find mapping in /proc/self/maps");
+	tst_brk(TCONF, "Could not find mapping in /proc/self/maps");
 
 found_mapping:
 	if (sscanf(line, "%*x-%*x %s7", perms) < 0)

@@ -63,6 +63,9 @@ found_mapping:
 	else
 		tst_res(TPASS, "AIO mapping is not executable: %s", perms);
 
+	if (tst_syscall(__NR_io_destroy, ctx))
+		tst_brk(TBROK | TERRNO, "Failed to destroy AIO context");
+
 	SAFE_FCLOSE(f);
 	f = NULL;
 }

Signature · 1 line

1.8.3.1

Xiao Yang

author

2017-10-05 02:11 UTC #5 lore raw

PATCH v2 1/1 cve/cve-2016-10044.c: fix two errors

Hi,

Ping :-)

Thanks,
Xiao Yang.

Quoted 60 lines · Xiao Yang

1) If the number of nr_events exceeds the limit of available events defined in /proc/sys/fs/aio-max-nr, it returns EAGAIN. We should call io_destroy() to cleanup the AIO context after finishing test.
Steps to reproduce this error:
      #echo 4 > /proc/sys/fs/aio-max-nr
      # ./cve-2016-10044 -i 5
      tst_test.c:908: INFO: Timeout per run is 0h 05m 00s
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:49: BROK: Failed to create AIO context: EAGAIN/EWOULDBLOCK
2) This case fails with TBROK on an old kernel(e.g. v2.6.32) because the mapping file does not exist.
The old format of file is set to 'anon_inode:[aio]' by the following
patch set:
'55708698c5f1("fs/anon_inode: Introduce a new lib function anon_inode_getfile_private()")' '36bc08cc0170("fs/aio: Add support to aio ring pages migration")'
The current format of file is set to '/[aio]' by the following patch:
'71ad7490c1f3("rework aio migrate pages to use aio fs")'
We change the keyword into '[aio]' to match as many formats as possible, and return TCONF if the mapping file does not exist.
Signed-off-by Xiao Yang <[email protected]>
---
 testcases/cve/cve-2016-10044.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
testcases/cve/cve-2016-10044.c +5 -2
index 7928d27..14fa0a4 100644
@@ -50,10 +50,10 @@ static void run(void)
 
 	f = SAFE_FOPEN("/proc/self/maps", "r");
 	while (fgets(line, BUFSIZ, f) != NULL) {
-		if (strstr(line, "/[aio]") != NULL)
+		if (strstr(line, "[aio]") != NULL)
 			goto found_mapping;
 	}
-	tst_brk(TBROK, "Could not find mapping in /proc/self/maps");
+	tst_brk(TCONF, "Could not find mapping in /proc/self/maps");
 
 found_mapping:
 	if (sscanf(line, "%*x-%*x %s7", perms) < 0)
@@ -63,6 +63,9 @@ found_mapping:
 	else
 		tst_res(TPASS, "AIO mapping is not executable: %s", perms);
 
+	if (tst_syscall(__NR_io_destroy, ctx))
+		tst_brk(TBROK | TERRNO, "Failed to destroy AIO context");
+
 	SAFE_FCLOSE(f);
 	f = NULL;
 }

Xiao Yang

author

2017-10-13 07:48 UTC #6 lore raw

PATCH v2 1/1 cve/cve-2016-10044.c: fix two errors

In reply to Xiao Yang

Hi Cyril,

Could you help me review this patch? Thanks a lot. :-)

Thanks,
Xiao Yang

Quoted 60 lines · Xiao Yang

1) If the number of nr_events exceeds the limit of available events
    defined in /proc/sys/fs/aio-max-nr, it returns EAGAIN.  We should
    call io_destroy() to cleanup the AIO context after finishing test.

    Steps to reproduce this error:
       #echo 4>  /proc/sys/fs/aio-max-nr
       # ./cve-2016-10044 -i 5
       tst_test.c:908: INFO: Timeout per run is 0h 05m 00s
       cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
       cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
       cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
       cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
       cve-2016-10044.c:49: BROK: Failed to create AIO context: EAGAIN/EWOULDBLOCK
2) This case fails with TBROK on an old kernel(e.g. v2.6.32) because the mapping file does not exist.
The old format of file is set to 'anon_inode:[aio]' by the following
patch set:
'55708698c5f1("fs/anon_inode: Introduce a new lib function anon_inode_getfile_private()")' '36bc08cc0170("fs/aio: Add support to aio ring pages migration")'
The current format of file is set to '/[aio]' by the following patch:
'71ad7490c1f3("rework aio migrate pages to use aio fs")'
We change the keyword into '[aio]' to match as many formats as possible, and return TCONF if the mapping file does not exist.
Signed-off-by Xiao Yang<[email protected]>
---
  testcases/cve/cve-2016-10044.c | 7 +++++--
  1 file changed, 5 insertions(+), 2 deletions(-)
testcases/cve/cve-2016-10044.c +5 -2
index 7928d27..14fa0a4 100644
@@ -50,10 +50,10 @@ static void run(void)
 
  	f = SAFE_FOPEN("/proc/self/maps", "r");
  	while (fgets(line, BUFSIZ, f) != NULL) {
-		if (strstr(line, "/[aio]") != NULL)
+		if (strstr(line, "[aio]") != NULL)
  			goto found_mapping;
  	}
-	tst_brk(TBROK, "Could not find mapping in /proc/self/maps");
+	tst_brk(TCONF, "Could not find mapping in /proc/self/maps");
 
  found_mapping:
  	if (sscanf(line, "%*x-%*x %s7", perms)<  0)
@@ -63,6 +63,9 @@ found_mapping:
  	else
  		tst_res(TPASS, "AIO mapping is not executable: %s", perms);
 
+	if (tst_syscall(__NR_io_destroy, ctx))
+		tst_brk(TBROK | TERRNO, "Failed to destroy AIO context");
+
  	SAFE_FCLOSE(f);
  	f = NULL;
  }

Xiao Yang

author

2017-10-26 09:02 UTC #7 lore raw

PATCH v2 1/1 cve/cve-2016-10044.c: fix two errors

In reply to Xiao Yang

Hi Cyril,

Could you help me review this patch? Thanks a lot. :-)

Thanks,
Xiao Yang

Quoted 60 lines · Xiao Yang

1) If the number of nr_events exceeds the limit of available events defined in /proc/sys/fs/aio-max-nr, it returns EAGAIN. We should call io_destroy() to cleanup the AIO context after finishing test.
Steps to reproduce this error:
      #echo 4 > /proc/sys/fs/aio-max-nr
      # ./cve-2016-10044 -i 5
      tst_test.c:908: INFO: Timeout per run is 0h 05m 00s
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:62: FAIL: AIO mapping is executable: rwxs!
      cve-2016-10044.c:49: BROK: Failed to create AIO context: EAGAIN/EWOULDBLOCK
2) This case fails with TBROK on an old kernel(e.g. v2.6.32) because the mapping file does not exist.
The old format of file is set to 'anon_inode:[aio]' by the following
patch set:
'55708698c5f1("fs/anon_inode: Introduce a new lib function anon_inode_getfile_private()")' '36bc08cc0170("fs/aio: Add support to aio ring pages migration")'
The current format of file is set to '/[aio]' by the following patch:
'71ad7490c1f3("rework aio migrate pages to use aio fs")'
We change the keyword into '[aio]' to match as many formats as possible, and return TCONF if the mapping file does not exist.
Signed-off-by Xiao Yang <[email protected]>
---
 testcases/cve/cve-2016-10044.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
testcases/cve/cve-2016-10044.c +5 -2
index 7928d27..14fa0a4 100644
@@ -50,10 +50,10 @@ static void run(void)
 
 	f = SAFE_FOPEN("/proc/self/maps", "r");
 	while (fgets(line, BUFSIZ, f) != NULL) {
-		if (strstr(line, "/[aio]") != NULL)
+		if (strstr(line, "[aio]") != NULL)
 			goto found_mapping;
 	}
-	tst_brk(TBROK, "Could not find mapping in /proc/self/maps");
+	tst_brk(TCONF, "Could not find mapping in /proc/self/maps");
 
 found_mapping:
 	if (sscanf(line, "%*x-%*x %s7", perms) < 0)
@@ -63,6 +63,9 @@ found_mapping:
 	else
 		tst_res(TPASS, "AIO mapping is not executable: %s", perms);
 
+	if (tst_syscall(__NR_io_destroy, ctx))
+		tst_brk(TBROK | TERRNO, "Failed to destroy AIO context");
+
 	SAFE_FCLOSE(f);
 	f = NULL;
 }

Cyril Hrubis

2017-10-26 10:23 UTC #8 lore raw

PATCH v2 1/1 cve/cve-2016-10044.c: fix two errors

Hi!

Quoted 1 line

Could you help me review this patch? Thanks a lot. :-)

Sorry for the delay, pushed.

Signature · 2 lines

Cyril Hrubis
[email protected]