syscalls/request_key03: new test for key instantiation races

From: Eric Biggers <[email protected]>

Add a test for two related bugs in the keyrings subsystem which each allowed unprivileged local users to cause a kernel oops (at best) by attempting to "add" a key concurrently with "requesting" it.

---

Changed since v2:
- Ignore EDQUOT from add_key() and request_key().

Changed since v1:
- Use an optional argument to indicate which crash to pay attention to, used by the "cve" runtests file.
- Slightly increase the iteration count for the "user" key type.

 include/lapi/keyctl.h                              |   4 +
 runtest/cve                                        |   2 +
 runtest/syscalls                                   |   1 +
 testcases/kernel/syscalls/.gitignore               |   1 +
 .../kernel/syscalls/request_key/request_key03.c    | 203 +++++++++++++++++++++
 5 files changed, 211 insertions(+)
 create mode 100644 testcases/kernel/syscalls/request_key/request_key03.c

index 328e55763..4b8098a59 100644
@@ -124,6 +124,10 @@ static inline key_serial_t keyctl_join_session_keyring(const char *name) {
 # define KEYCTL_SETPERM 5
 #endif
 
+#ifndef KEYCTL_CLEAR
+# define KEYCTL_CLEAR 7
+#endif
+
 #ifndef KEYCTL_UNLINK
 # define KEYCTL_UNLINK 9
 #endif

index f137fb3db..1b0d13374 100644
@@ -21,5 +21,7 @@ cve-2017-7308 setsockopt02
 cve-2017-7472 keyctl04
 cve-2017-12192 keyctl07
 cve-2017-15274 add_key02
+cve-2017-15299 request_key03 -b cve-2017-15299
 cve-2017-15537 ptrace07
+cve-2017-15951 request_key03 -b cve-2017-15951
 cve-2017-1000364 stack_clash

index 626853669..fc381eb16 100644
@@ -932,6 +932,7 @@ renameat202 renameat202 -i 10
 
 request_key01 request_key01
 request_key02 request_key02
+request_key03 request_key03
 cve-2017-6951 cve-2017-6951
 
 rmdir01 rmdir01

index 0ba38465f..0b3935880 100644
@@ -773,6 +773,7 @@
 /renameat2/renameat202
 /request_key/request_key01
 /request_key/request_key02
+/request_key/request_key03
 /rmdir/rmdir01
 /rmdir/rmdir02
 /rmdir/rmdir03

2.15.0