Add regression test for CVE-2017-17053

PATCH Superseded Michael Moese 3 participants 11 messages Mar 9, 2018 – Mar 27, 2018 Library code

Share & tools

Michael Moese

author

2018-03-09 12:44 UTC #0 lore raw

v6 cover Add regression test for CVE-2017-17053

Add a regression test for CVE-2017-17053. This testcase is depending on some new library functions included in this series.

This patch series consists of reworked patches according to previous review comments, as well as a small new library wrapper function SAFE_SIGACTION() to install a signal handler.

Michael Moese (3):
Add library support for /proc/sys/kernel/tainted Add a library wrapper for sigaction() Add regression test for CVE-2017-17053

 doc/test-writing-guidelines.txt |  42 ++++++++++
 include/tst_safe_macros.h       |  20 +++++
 include/tst_taint.h             | 104 +++++++++++++++++++++++++
 lib/tst_taint.c                 | 106 +++++++++++++++++++++++++
 runtest/cve                     |   1 +
 testcases/cve/.gitignore        |   1 +
 testcases/cve/Makefile          |   2 +
 testcases/cve/cve-2017-17053.c  | 166 ++++++++++++++++++++++++++++++++++++++++
 8 files changed, 442 insertions(+)
 create mode 100644 include/tst_taint.h
 create mode 100644 lib/tst_taint.c
 create mode 100644 testcases/cve/cve-2017-17053.c

Signature · 1 line

2.13.6

Michael Moese

author

2018-03-09 12:44 UTC #1 lore raw

PATCH v6 1/3 Add library support for /proc/sys/kernel/tainted

Sometimes, it is important to detect if the kernel has issued a warning, died, or is tainted in another way. Linux provides this information in /proc/sys/kernel/tainted in the form of a bitfield. This patch provides library functions for testcases to detect, if it has tainted the kernel.

The following functions will be introduced:

- int tst_taint_init(unsigned int mask)
check if the flags supplied as mask are supported by the running kernel, and if so, if they are not yet set.

- int tst_taint_check()
check if one or more of the bits specified in the mask provided to tst_taint_init() before are set.
Returns 0 if those flags are not set, or the bitmask of set flags

These can be used in the following way:

First, during testcase setup:

void setup(void)

{
	...
	tst_taint_init(TST_TAINT_W | TST_TAINT_D);
}

Second, check if the test triggered a bug:

void run(void)

{
	...
	. test code here
	...
	if (tst_taint_check() != 0)
		tst_res(TFAIL, "kernel has issues");
	 else
		tst_res(TPASS, "kernel seems to be fine");
}

Signed-off-by Michael Moese <[email protected]>

---
 doc/test-writing-guidelines.txt |  42 ++++++++++++++++
 include/tst_taint.h             | 104 +++++++++++++++++++++++++++++++++++++++
 lib/tst_taint.c                 | 106 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 252 insertions(+)
 create mode 100644 include/tst_taint.h
 create mode 100644 lib/tst_taint.c

doc/test-writing-guidelines.txt +42 -0

index 4c60cd66b..5082a07be 100644
@@ -1320,6 +1320,48 @@ common.h:9: FAIL: check failed
 test.c:8: INFO: do_action(arg) failed
 -------------------------------------------------------------------------------
 
+2.2.24 Tainted kernels
+^^^^^^^^^^^^^^^^^^^^^^
+
+If you need to detect, if a testcase triggers a kernel warning, bug or oops,
+the following can be used to detect TAINT_W or TAINT_D:
+
+[source,c]
+-------------------------------------------------------------------------------
+#include "tst_test.h"
+#include "tst_taint.h"
+
+void setup(void)
+{
+	...
+	tst_taint_init(TST_TAINT_W | TST_TAINT_D);
+	...
+}
+...
+void run(void)
+{
+	...
+	if (tst_taint_check() == 0)
+		tst_res(TPASS, "kernel is not tainted");
+	else
+		tst_res(TFAIL, "kernel is tainted");
+}
+-------------------------------------------------------------------------------
+
+You have to call tst_taint_init() with non-zero flags first, preferably during
+setup(). The function will generate a TCONF if the requested flags are not
+fully supported on the running kernel, and TBROK if either a zero mask was
+supplied or if the kernel is already tainted before executing the test.
+
+Then you can call tst_taint_check() during run(), which returns 0 or the 
+tainted flags set in /proc/sys/kernel/tainted as specified earlier.
+
+Depending on your kernel version, not all tainted-flags will be supported.
+
+For reference to tainted kernels, see kernel documentation:
+Documentation/admin-guide/tainted-kernels.rst or
+https://www.kernel.org/doc/html/latest/admin-guide/tainted-kernels.html
+
 2.3 Writing a testcase in shell
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

include/tst_taint.h new file +104 -0

104 lines not on this page · raw message

lib/tst_taint.c new file +106 -0

106 lines not on this page · raw message

Signature · 1 line

2.13.6

Cyril Hrubis

2018-03-13 12:26 UTC #2 lore raw

PATCH v6 1/3 Add library support for /proc/sys/kernel/tainted

Hi!

lib/tst_taint.c line 16

Quoted 6 lines

lib/tst_taint.c new file +6 -0

+static unsigned int tst_taint_read(void)
+{
+	unsigned int val;
+
+	if (taint_mask == (unsigned int) -1)
+		tst_brk(TBROK, "need to call tst_taint_init() first");

I've removed this check, since all the entry points that could call this function either set the taint_mask or checks that it has been set.

And finally pushed, thanks.

Signature · 2 lines

Cyril Hrubis
[email protected]

Michael Moese

author

2018-03-09 12:44 UTC #3 lore raw

PATCH v6 2/3 Add a library wrapper for sigaction()

In reply to Michael Moese

In a multithreaded program, using signal() results in unspecified behavior. In this case, sigaction() has to be used to install a signal handler.
Therefore, SAFE_SIGACTION() is added.

Signed-off-by Michael Moese <[email protected]>

---
 include/tst_safe_macros.h | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

include/tst_safe_macros.h +20 -0

index 06bff13c7..bf12e0719 100644
@@ -397,6 +397,26 @@ static inline sighandler_t safe_signal(const char *file, const int lineno,
 #define SAFE_SIGNAL(signum, handler) \
 	safe_signal(__FILE__, __LINE__, (signum), (handler))
 
+
+
+static inline int safe_sigaction(const char *file, const int lineno,
+				 int signum, const struct sigaction *act,
+				 struct sigaction *oldact)
+{
+	int rval;
+
+	rval = sigaction(signum, act, oldact);
+
+	if (rval == -1) {
+		tst_brk_(file, lineno, TBROK | TERRNO,
+			"sigaction(%d, %p, %p) failed", signum, act, oldact);
+	}
+
+	return rval;
+}
+#define SAFE_SIGACTION(signum, act, oldact) \
+	safe_sigaction(__FILE__, __LINE__, (signum), (act), (oldact))
+
 #define SAFE_EXECLP(file, arg, ...) do {                   \
 	execlp((file), (arg), ##__VA_ARGS__);              \
 	tst_brk_(__FILE__, __LINE__, TBROK | TERRNO,       \

Signature · 1 line

2.13.6

Cyril Hrubis

2018-03-13 12:27 UTC #4 lore raw

PATCH v6 2/3 Add a library wrapper for sigaction()

Hi!

include/tst_safe_macros.h static inline sighandler_t safe_signal(const char *file, const int lineno, · line 412

Quoted 11 lines

include/tst_safe_macros.h +11 -0

+static inline int safe_sigaction(const char *file, const int lineno,
+				 int signum, const struct sigaction *act,
+				 struct sigaction *oldact)
+{
+	int rval;
+
+	rval = sigaction(signum, act, oldact);
+
+	if (rval == -1) {
+		tst_brk_(file, lineno, TBROK | TERRNO,
+			"sigaction(%d, %p, %p) failed", signum, act, oldact);

^
I've added tst_strsig() here as well to get better error messages.

And I had to move the function the C source to avoid tst_strsig() redefinition warnings...

And pushed, thanks.

Signature · 2 lines

Cyril Hrubis
[email protected]

Michael Moese

author

2018-03-09 12:44 UTC #5 lore raw

PATCH v6 3/3 Add regression test for CVE-2017-17053

In reply to Michael Moese

This patch adds a regression test for CVE-2017-17053, based on the reproducer in the message of this commit:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ccd5b3235180eef3cfec337df1c8554ab151b5cc

Be warned, if the running kernel is vulnerable to this CVE, it will die in most cases.

Signed-off-by Michael Moese <[email protected]>

---
 runtest/cve                    |   1 +
 testcases/cve/.gitignore       |   1 +
 testcases/cve/Makefile         |   2 +
 testcases/cve/cve-2017-17053.c | 166 +++++++++++++++++++++++++++++++++++++++++
 4 files changed, 170 insertions(+)
 create mode 100644 testcases/cve/cve-2017-17053.c

runtest/cve +1 -0

index 0c385c670..8c68ab496 100644
@@ -30,3 +30,4 @@ cve-2017-17807 request_key04
 cve-2017-1000364 stack_clash
 cve-2017-5754 meltdown
 cve-2017-17052 cve-2017-17052
+cve-2017-17053 cve-2017-17053

testcases/cve/.gitignore +1 -0

index c878069f1..c1ac83e3a 100644
@@ -12,3 +12,4 @@ cve-2017-5669
 meltdown
 stack_clash
 cve-2017-17052
+cve-2017-17053

testcases/cve/Makefile +2 -0

index 86100dbf2..3a05dd4fe 100644
@@ -37,6 +37,8 @@ meltdown: CFLAGS += -msse2
 endif
 
 cve-2017-17052:	CFLAGS += -pthread
+cve-2017-17053:	CFLAGS += -pthread
+
 cve-2015-3290:	CFLAGS += -pthread
 
 include $(top_srcdir)/include/mk/generic_leaf_target.mk

testcases/cve/cve-2017-17053.c new file +166 -0

166 lines not on this page · raw message

Signature · 1 line

2.13.6

Cyril Hrubis

2018-03-13 12:27 UTC #6 lore raw

PATCH v6 3/3 Add regression test for CVE-2017-17053

Hi!
Pushed, thanks.

Signature · 2 lines

Cyril Hrubis
[email protected]

Xiao Yang

2018-03-22 07:21 UTC #7 lore raw

v6 cover Add regression test for CVE-2017-17053

In reply to Michael Moese

Hi Michael,

Sorry to bother you.

tst_taint_init() always got TBROK before verifying CVE-2017-17053 on my enviorment, as below:
-----------------------------------------------------------------
[root@RHEL7U5RC_Intel64 cve]# ./cve-2017-17053
tst_test.c:987: INFO: Timeout per run is 0h 05m 00s
tst_taint.c:88: BROK: Kernel is already tainted: 512
......
-----------------------------------------------------------------

On my enviorment, __ioremap_caller() displayed the warning message and set /proc/sys/kernel/tainted to TST_TAINT_W(512) when too high physical address wasn't handled. Is this a usual case? should we break and skip CVE-2017-17053 due to this existed TST_TAINT_W?

Please see the the following warning message:
-----------------------------------------------------------------

[    0.059261] ioremap: invalid physical address fffffffffff90000
[    0.059263] ------------[ cut here ]------------
[    0.059268] WARNING: CPU: 0 PID: 1 at arch/x86/mm/ioremap.c:103 __ioremap_caller+0x2f2/0x340
[    0.059269] Modules linked in:
[    0.059272] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.10.0-860.el7.x86_64 #1
[    0.059273] Hardware name: LENOVO QiTianM7150/To be filled by O.E.M., BIOS 90KT20CUS 09/14/2010
[    0.059275] Call Trace:
[    0.059281]  [<ffffffffaed0d768>] dump_stack+0x19/0x1b
[    0.059284]  [<ffffffffae6916d8>] __warn+0xd8/0x100
[    0.059286]  [<ffffffffae69181d>] warn_slowpath_null+0x1d/0x20
[    0.059288]  [<ffffffffae66f442>] __ioremap_caller+0x2f2/0x340
[    0.059290]  [<ffffffffaed0064a>] ? acpi_os_map_memory+0xfd/0x155
[    0.059293]  [<ffffffffae7f7606>] ? kmem_cache_alloc_trace+0x1d6/0x200
[    0.059295]  [<ffffffffae66f4c4>] ioremap_cache+0x14/0x20
[    0.059297]  [<ffffffffaed0064a>] acpi_os_map_memory+0xfd/0x155
[    0.059301]  [<ffffffffae9ec576>] acpi_ex_system_memory_space_handler+0xdd/0x1ca
[    0.059304]  [<ffffffffae9e5fa3>] acpi_ev_address_space_dispatch+0x1c5/0x231
[    0.059306]  [<ffffffffae9e963a>] acpi_ex_access_region+0x20e/0x2a2
[    0.059309]  [<ffffffffae9cf86d>] ? acpi_os_release_lock+0xe/0x10
[    0.059312]  [<ffffffffae9fae9c>] ? acpi_ut_update_ref_count+0x99/0x2bf
[    0.059314]  [<ffffffffae9e99f5>] acpi_ex_field_datum_io+0x105/0x196
[    0.059316]  [<ffffffffae9e9c0e>] acpi_ex_extract_from_field+0x98/0x228
[    0.059318]  [<ffffffffae9fca3a>] ? acpi_ut_create_internal_object_dbg+0x23/0x8a
[    0.059321]  [<ffffffffae9e91bd>] acpi_ex_read_data_from_field+0x13c/0x178
[    0.059323]  [<ffffffffae9ec8fc>] acpi_ex_resolve_node_to_value+0x1a3/0x245
[    0.059325]  [<ffffffffae9ecbbb>] acpi_ex_resolve_to_value+0x21d/0x23a
[    0.059327]  [<ffffffffae9e26c3>] acpi_ds_evaluate_name_path+0x8d/0x11b
[    0.059329]  [<ffffffffae9e2aaa>] acpi_ds_exec_end_op+0x98/0x3f3
[    0.059332]  [<ffffffffae9f4fb8>] acpi_ps_parse_loop+0x526/0x583
[    0.059335]  [<ffffffffae9fd618>] ? acpi_ut_create_generic_state+0x37/0x54
[    0.059337]  [<ffffffffae9f5ac0>] acpi_ps_parse_aml+0x98/0x289
[    0.059339]  [<ffffffffae9f6313>] acpi_ps_execute_method+0x1c7/0x272
[    0.059341]  [<ffffffffae9f0a40>] acpi_ns_evaluate+0x1c1/0x258
[    0.059343]  [<ffffffffae9f3387>] acpi_evaluate_object+0x135/0x252
[    0.059346]  [<ffffffffae9cfc7e>] acpi_evaluate_integer+0x52/0x84
[    0.059348]  [<ffffffffae9cf811>] ? acpi_os_signal_semaphore+0x21/0x2d
[    0.059350]  [<ffffffffae9d3818>] acpi_bus_get_status_handle+0x1e/0x39
[    0.059353]  [<ffffffffae9d5d1b>] acpi_bus_check_add+0x81/0x1c2
[    0.059355]  [<ffffffffae6c0d02>] ? up+0x32/0x50
[    0.059358]  [<ffffffffae9f316c>] acpi_ns_walk_namespace+0xcb/0x184
[    0.059360]  [<ffffffffae9d5c9a>] ? acpi_add_single_object+0x4f9/0x4f9
[    0.059362]  [<ffffffffae9d5c9a>] ? acpi_add_single_object+0x4f9/0x4f9
[    0.059364]  [<ffffffffae9f36a2>] acpi_walk_namespace+0x95/0xc5
[    0.059367]  [<ffffffffaf3b722b>] ? acpi_sleep_proc_init+0x2a/0x2a
[    0.059369]  [<ffffffffae9d60dd>] acpi_bus_scan+0x5c/0x90
[    0.059371]  [<ffffffffaf3b76b1>] acpi_scan_init+0x89/0x1d8
[    0.059373]  [<ffffffffaf3b74ce>] acpi_init+0x2a3/0x2bd
[    0.059376]  [<ffffffffae60210a>] do_one_initcall+0xba/0x240
[    0.059379]  [<ffffffffaf36c362>] kernel_init_freeable+0x180/0x21f
[    0.059381]  [<ffffffffaf36bb1f>] ? initcall_blacklist+0xb0/0xb0
[    0.059383]  [<ffffffffaecfc6b0>] ? rest_init+0x80/0x80
[    0.059385]  [<ffffffffaecfc6be>] kernel_init+0xe/0xf0
[    0.059388]  [<ffffffffaed1f637>] ret_from_fork_nospec_begin+0x21/0x21
[    0.059390]  [<ffffffffaecfc6b0>] ? rest_init+0x80/0x80
[    0.059393] ---[ end trace a7b32a0fce036eb7 ]---

-----------------------------------------------------------------

Please let me know if more information is needed, thanks.

Thanks,
Xiao Yang

Quoted 25 lines · Michael Moese

Add a regression test for CVE-2017-17053. This testcase is depending on some new library functions included in this series.
This patch series consists of reworked patches according to previous review comments, as well as a small new library wrapper function SAFE_SIGACTION() to install a signal handler.
Michael Moese (3):
Add library support for /proc/sys/kernel/tainted Add a library wrapper for sigaction() Add regression test for CVE-2017-17053
  doc/test-writing-guidelines.txt |  42 ++++++++++
  include/tst_safe_macros.h       |  20 +++++
  include/tst_taint.h             | 104 +++++++++++++++++++++++++
  lib/tst_taint.c                 | 106 +++++++++++++++++++++++++
  runtest/cve                     |   1 +
  testcases/cve/.gitignore        |   1 +
  testcases/cve/Makefile          |   2 +
  testcases/cve/cve-2017-17053.c  | 166 ++++++++++++++++++++++++++++++++++++++++
  8 files changed, 442 insertions(+)
create mode 100644 include/tst_taint.h create mode 100644 lib/tst_taint.c
create mode 100644 testcases/cve/cve-2017-17053.c

Xiao Yang

2018-03-27 09:48 UTC #8 lore raw

v6 cover Add regression test for CVE-2017-17053

Hiï¼Œ

Can anybody help me look into this issue?

Thanks,
Xiao Yang

Quoted 126 lines · Xiao Yang

Hi Michael,

Sorry to bother you.

tst_taint_init() always got TBROK before verifying CVE-2017-17053 on my enviorment, as below:
-----------------------------------------------------------------
[root@RHEL7U5RC_Intel64 cve]# ./cve-2017-17053 tst_test.c:987: INFO: Timeout per run is 0h 05m 00s tst_taint.c:88: BROK: Kernel is already tainted: 512
......
-----------------------------------------------------------------

On my enviorment, __ioremap_caller() displayed the warning message and set /proc/sys/kernel/tainted to
TST_TAINT_W(512) when too high physical address wasn't handled. Is this a usual case? should we break
and skip CVE-2017-17053 due to this existed TST_TAINT_W?

Please see the the following warning message:
-----------------------------------------------------------------

[    0.059261] ioremap: invalid physical address fffffffffff90000
[    0.059263] ------------[ cut here ]------------
[    0.059268] WARNING: CPU: 0 PID: 1 at arch/x86/mm/ioremap.c:103 
__ioremap_caller+0x2f2/0x340
[    0.059269] Modules linked in:
[    0.059272] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 
3.10.0-860.el7.x86_64 #1
[    0.059273] Hardware name: LENOVO QiTianM7150/To be filled by 
O.E.M., BIOS 90KT20CUS 09/14/2010
[    0.059275] Call Trace:
[    0.059281]  [<ffffffffaed0d768>] dump_stack+0x19/0x1b
[    0.059284]  [<ffffffffae6916d8>] __warn+0xd8/0x100
[    0.059286]  [<ffffffffae69181d>] warn_slowpath_null+0x1d/0x20
[    0.059288]  [<ffffffffae66f442>] __ioremap_caller+0x2f2/0x340
[    0.059290]  [<ffffffffaed0064a>] ? acpi_os_map_memory+0xfd/0x155
[    0.059293]  [<ffffffffae7f7606>] ? kmem_cache_alloc_trace+0x1d6/0x200
[    0.059295]  [<ffffffffae66f4c4>] ioremap_cache+0x14/0x20
[    0.059297]  [<ffffffffaed0064a>] acpi_os_map_memory+0xfd/0x155
[    0.059301]  [<ffffffffae9ec576>] 
acpi_ex_system_memory_space_handler+0xdd/0x1ca
[    0.059304]  [<ffffffffae9e5fa3>] 
acpi_ev_address_space_dispatch+0x1c5/0x231
[    0.059306]  [<ffffffffae9e963a>] acpi_ex_access_region+0x20e/0x2a2
[    0.059309]  [<ffffffffae9cf86d>] ? acpi_os_release_lock+0xe/0x10
[    0.059312]  [<ffffffffae9fae9c>] ? 
acpi_ut_update_ref_count+0x99/0x2bf
[    0.059314]  [<ffffffffae9e99f5>] acpi_ex_field_datum_io+0x105/0x196
[    0.059316]  [<ffffffffae9e9c0e>] 
acpi_ex_extract_from_field+0x98/0x228
[    0.059318]  [<ffffffffae9fca3a>] ? 
acpi_ut_create_internal_object_dbg+0x23/0x8a
[    0.059321]  [<ffffffffae9e91bd>] 
acpi_ex_read_data_from_field+0x13c/0x178
[    0.059323]  [<ffffffffae9ec8fc>] 
acpi_ex_resolve_node_to_value+0x1a3/0x245
[    0.059325]  [<ffffffffae9ecbbb>] acpi_ex_resolve_to_value+0x21d/0x23a
[    0.059327]  [<ffffffffae9e26c3>] 
acpi_ds_evaluate_name_path+0x8d/0x11b
[    0.059329]  [<ffffffffae9e2aaa>] acpi_ds_exec_end_op+0x98/0x3f3
[    0.059332]  [<ffffffffae9f4fb8>] acpi_ps_parse_loop+0x526/0x583
[    0.059335]  [<ffffffffae9fd618>] ? 
acpi_ut_create_generic_state+0x37/0x54
[    0.059337]  [<ffffffffae9f5ac0>] acpi_ps_parse_aml+0x98/0x289
[    0.059339]  [<ffffffffae9f6313>] acpi_ps_execute_method+0x1c7/0x272
[    0.059341]  [<ffffffffae9f0a40>] acpi_ns_evaluate+0x1c1/0x258
[    0.059343]  [<ffffffffae9f3387>] acpi_evaluate_object+0x135/0x252
[    0.059346]  [<ffffffffae9cfc7e>] acpi_evaluate_integer+0x52/0x84
[    0.059348]  [<ffffffffae9cf811>] ? acpi_os_signal_semaphore+0x21/0x2d
[    0.059350]  [<ffffffffae9d3818>] acpi_bus_get_status_handle+0x1e/0x39
[    0.059353]  [<ffffffffae9d5d1b>] acpi_bus_check_add+0x81/0x1c2
[    0.059355]  [<ffffffffae6c0d02>] ? up+0x32/0x50
[    0.059358]  [<ffffffffae9f316c>] acpi_ns_walk_namespace+0xcb/0x184
[    0.059360]  [<ffffffffae9d5c9a>] ? acpi_add_single_object+0x4f9/0x4f9
[    0.059362]  [<ffffffffae9d5c9a>] ? acpi_add_single_object+0x4f9/0x4f9
[    0.059364]  [<ffffffffae9f36a2>] acpi_walk_namespace+0x95/0xc5
[    0.059367]  [<ffffffffaf3b722b>] ? acpi_sleep_proc_init+0x2a/0x2a
[    0.059369]  [<ffffffffae9d60dd>] acpi_bus_scan+0x5c/0x90
[    0.059371]  [<ffffffffaf3b76b1>] acpi_scan_init+0x89/0x1d8
[    0.059373]  [<ffffffffaf3b74ce>] acpi_init+0x2a3/0x2bd
[    0.059376]  [<ffffffffae60210a>] do_one_initcall+0xba/0x240
[    0.059379]  [<ffffffffaf36c362>] kernel_init_freeable+0x180/0x21f
[    0.059381]  [<ffffffffaf36bb1f>] ? initcall_blacklist+0xb0/0xb0
[    0.059383]  [<ffffffffaecfc6b0>] ? rest_init+0x80/0x80
[    0.059385]  [<ffffffffaecfc6be>] kernel_init+0xe/0xf0
[    0.059388]  [<ffffffffaed1f637>] ret_from_fork_nospec_begin+0x21/0x21
[    0.059390]  [<ffffffffaecfc6b0>] ? rest_init+0x80/0x80
[    0.059393] ---[ end trace a7b32a0fce036eb7 ]---

-----------------------------------------------------------------

Please let me know if more information is needed, thanks.

Thanks,
Xiao Yang

Quoted 26 lines · Michael Moese

Add a regression test for CVE-2017-17053. This testcase is depending on some new library functions included in this series.
This patch series consists of reworked patches according to previous review comments, as well as a small new library wrapper function SAFE_SIGACTION() to install a signal handler.
Michael Moese (3):
Add library support for /proc/sys/kernel/tainted Add a library wrapper for sigaction() Add regression test for CVE-2017-17053
  doc/test-writing-guidelines.txt |  42 ++++++++++
  include/tst_safe_macros.h       |  20 +++++
  include/tst_taint.h             | 104 +++++++++++++++++++++++++
  lib/tst_taint.c                 | 106 +++++++++++++++++++++++++
  runtest/cve                     |   1 +
  testcases/cve/.gitignore        |   1 +
  testcases/cve/Makefile          |   2 +
  testcases/cve/cve-2017-17053.c  | 166 
++++++++++++++++++++++++++++++++++++++++
  8 files changed, 442 insertions(+)
create mode 100644 include/tst_taint.h create mode 100644 lib/tst_taint.c
create mode 100644 testcases/cve/cve-2017-17053.c

Michael Moese

author

2018-03-27 09:58 UTC #9 lore raw

v6 cover Add regression test for CVE-2017-17053

Hi,
I'm sorry, I must have missed your mail.

The testcase cannot run if the TAINT_W flag is already set, as this is triggered on vulnerable kernels - so if you have a already tainted kernel, this test cannot reliably detect if the kernel is safe to this CVE or not.
Where does the warning message you get result from? Is this something you can fix?

Michael

Quoted 140 lines · Xiao Yang

Hi，

Can anybody help me look into this issue?

Thanks,
Xiao Yang

Quoted 126 lines · Xiao Yang

Hi Michael,

Sorry to bother you.

tst_taint_init() always got TBROK before verifying CVE-2017-17053 on my enviorment, as below:
-----------------------------------------------------------------
[root@RHEL7U5RC_Intel64 cve]# ./cve-2017-17053 tst_test.c:987: INFO: Timeout per run is 0h 05m 00s tst_taint.c:88: BROK: Kernel is already tainted: 512
......
-----------------------------------------------------------------

On my enviorment, __ioremap_caller() displayed the warning message and set /proc/sys/kernel/tainted to
TST_TAINT_W(512) when too high physical address wasn't handled. Is this a usual case? should we break
and skip CVE-2017-17053 due to this existed TST_TAINT_W?

Please see the the following warning message:
-----------------------------------------------------------------

[    0.059261] ioremap: invalid physical address fffffffffff90000
[    0.059263] ------------[ cut here ]------------
[    0.059268] WARNING: CPU: 0 PID: 1 at arch/x86/mm/ioremap.c:103
__ioremap_caller+0x2f2/0x340
[    0.059269] Modules linked in:
[    0.059272] CPU: 0 PID: 1 Comm: swapper/0 Not tainted
3.10.0-860.el7.x86_64 #1
[    0.059273] Hardware name: LENOVO QiTianM7150/To be filled by O.E.M.,
BIOS 90KT20CUS 09/14/2010
[    0.059275] Call Trace:
[    0.059281]  [<ffffffffaed0d768>] dump_stack+0x19/0x1b
[    0.059284]  [<ffffffffae6916d8>] __warn+0xd8/0x100
[    0.059286]  [<ffffffffae69181d>] warn_slowpath_null+0x1d/0x20
[    0.059288]  [<ffffffffae66f442>] __ioremap_caller+0x2f2/0x340
[    0.059290]  [<ffffffffaed0064a>] ? acpi_os_map_memory+0xfd/0x155
[    0.059293]  [<ffffffffae7f7606>] ? kmem_cache_alloc_trace+0x1d6/0x200
[    0.059295]  [<ffffffffae66f4c4>] ioremap_cache+0x14/0x20
[    0.059297]  [<ffffffffaed0064a>] acpi_os_map_memory+0xfd/0x155
[    0.059301]  [<ffffffffae9ec576>]
acpi_ex_system_memory_space_handler+0xdd/0x1ca
[    0.059304]  [<ffffffffae9e5fa3>]
acpi_ev_address_space_dispatch+0x1c5/0x231
[    0.059306]  [<ffffffffae9e963a>] acpi_ex_access_region+0x20e/0x2a2
[    0.059309]  [<ffffffffae9cf86d>] ? acpi_os_release_lock+0xe/0x10
[    0.059312]  [<ffffffffae9fae9c>] ?
acpi_ut_update_ref_count+0x99/0x2bf
[    0.059314]  [<ffffffffae9e99f5>] acpi_ex_field_datum_io+0x105/0x196
[    0.059316]  [<ffffffffae9e9c0e>]
acpi_ex_extract_from_field+0x98/0x228
[    0.059318]  [<ffffffffae9fca3a>] ?
acpi_ut_create_internal_object_dbg+0x23/0x8a
[    0.059321]  [<ffffffffae9e91bd>]
acpi_ex_read_data_from_field+0x13c/0x178
[    0.059323]  [<ffffffffae9ec8fc>]
acpi_ex_resolve_node_to_value+0x1a3/0x245
[    0.059325]  [<ffffffffae9ecbbb>] acpi_ex_resolve_to_value+0x21d/0x23a
[    0.059327]  [<ffffffffae9e26c3>]
acpi_ds_evaluate_name_path+0x8d/0x11b
[    0.059329]  [<ffffffffae9e2aaa>] acpi_ds_exec_end_op+0x98/0x3f3
[    0.059332]  [<ffffffffae9f4fb8>] acpi_ps_parse_loop+0x526/0x583
[    0.059335]  [<ffffffffae9fd618>] ?
acpi_ut_create_generic_state+0x37/0x54
[    0.059337]  [<ffffffffae9f5ac0>] acpi_ps_parse_aml+0x98/0x289
[    0.059339]  [<ffffffffae9f6313>] acpi_ps_execute_method+0x1c7/0x272
[    0.059341]  [<ffffffffae9f0a40>] acpi_ns_evaluate+0x1c1/0x258
[    0.059343]  [<ffffffffae9f3387>] acpi_evaluate_object+0x135/0x252
[    0.059346]  [<ffffffffae9cfc7e>] acpi_evaluate_integer+0x52/0x84
[    0.059348]  [<ffffffffae9cf811>] ? acpi_os_signal_semaphore+0x21/0x2d
[    0.059350]  [<ffffffffae9d3818>] acpi_bus_get_status_handle+0x1e/0x39
[    0.059353]  [<ffffffffae9d5d1b>] acpi_bus_check_add+0x81/0x1c2
[    0.059355]  [<ffffffffae6c0d02>] ? up+0x32/0x50
[    0.059358]  [<ffffffffae9f316c>] acpi_ns_walk_namespace+0xcb/0x184
[    0.059360]  [<ffffffffae9d5c9a>] ? acpi_add_single_object+0x4f9/0x4f9
[    0.059362]  [<ffffffffae9d5c9a>] ? acpi_add_single_object+0x4f9/0x4f9
[    0.059364]  [<ffffffffae9f36a2>] acpi_walk_namespace+0x95/0xc5
[    0.059367]  [<ffffffffaf3b722b>] ? acpi_sleep_proc_init+0x2a/0x2a
[    0.059369]  [<ffffffffae9d60dd>] acpi_bus_scan+0x5c/0x90
[    0.059371]  [<ffffffffaf3b76b1>] acpi_scan_init+0x89/0x1d8
[    0.059373]  [<ffffffffaf3b74ce>] acpi_init+0x2a3/0x2bd
[    0.059376]  [<ffffffffae60210a>] do_one_initcall+0xba/0x240
[    0.059379]  [<ffffffffaf36c362>] kernel_init_freeable+0x180/0x21f
[    0.059381]  [<ffffffffaf36bb1f>] ? initcall_blacklist+0xb0/0xb0
[    0.059383]  [<ffffffffaecfc6b0>] ? rest_init+0x80/0x80
[    0.059385]  [<ffffffffaecfc6be>] kernel_init+0xe/0xf0
[    0.059388]  [<ffffffffaed1f637>] ret_from_fork_nospec_begin+0x21/0x21
[    0.059390]  [<ffffffffaecfc6b0>] ? rest_init+0x80/0x80
[    0.059393] ---[ end trace a7b32a0fce036eb7 ]---

-----------------------------------------------------------------

Please let me know if more information is needed, thanks.

Thanks,
Xiao Yang

Quoted 26 lines · Michael Moese

Add a regression test for CVE-2017-17053. This testcase is depending on some new library functions included in this series.
This patch series consists of reworked patches according to previous review comments, as well as a small new library wrapper function SAFE_SIGACTION() to install a signal handler.
Michael Moese (3):
Add library support for /proc/sys/kernel/tainted Add a library wrapper for sigaction() Add regression test for CVE-2017-17053
  doc/test-writing-guidelines.txt |  42 ++++++++++
  include/tst_safe_macros.h       |  20 +++++
  include/tst_taint.h             | 104 +++++++++++++++++++++++++
  lib/tst_taint.c                 | 106 +++++++++++++++++++++++++
  runtest/cve                     |   1 +
  testcases/cve/.gitignore        |   1 +
  testcases/cve/Makefile          |   2 +
  testcases/cve/cve-2017-17053.c  | 166
++++++++++++++++++++++++++++++++++++++++
  8 files changed, 442 insertions(+)
create mode 100644 include/tst_taint.h create mode 100644 lib/tst_taint.c
create mode 100644 testcases/cve/cve-2017-17053.c

Signature · 1 line

Mailing list info: https://lists.linux.it/listinfo/ltp

Signature · 1 line

SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nürnberg)

Cyril Hrubis

2018-03-27 13:01 UTC #10 lore raw

v6 cover Add regression test for CVE-2017-17053

In reply to Xiao Yang

Hi!
As Michael said there is not much we can do in LTP here, the test cannot be executed because kernel is already tainted. The best solution is to fix the kernel not to spew warnings but I know that it's not as easy as it sounds.

Signature · 2 lines

Cyril Hrubis
[email protected]