syscalls/add_key04: new test for associative array bug

PATCH New Eric Biggers 1 participant 1 message Nov 13, 2017 Keys/keyrings

lore

Share & tools

lore

Eric Biggers

author

2017-11-13 22:01 UTC #0 lore raw

PATCH v2 1/1 syscalls/add_key04: new test for associative array bug

From: Eric Biggers <[email protected]>

Add a test for a bug in the kernel's generic associative array implementation which allowed users to cause a kernel oops (NULL pointer dereference) by adding keys to a keyring in a certain pattern.

Signed-off-by Eric Biggers <[email protected]>

---

Changed since v1: fixed a typo

 runtest/cve                                   |  1 +
 runtest/syscalls                              |  1 +
 testcases/kernel/syscalls/.gitignore          |  1 +
 testcases/kernel/syscalls/add_key/add_key04.c | 90 +++++++++++++++++++++++++++
 4 files changed, 93 insertions(+)
 create mode 100644 testcases/kernel/syscalls/add_key/add_key04.c

runtest/cve +1 -0

index 1b0d13374..2873df906 100644
@@ -20,6 +20,7 @@ cve-2017-6951 cve-2017-6951
 cve-2017-7308 setsockopt02
 cve-2017-7472 keyctl04
 cve-2017-12192 keyctl07
+cve-2017-12193 add_key04
 cve-2017-15274 add_key02
 cve-2017-15299 request_key03 -b cve-2017-15299
 cve-2017-15537 ptrace07

runtest/syscalls +1 -0

index fc381eb16..14089ac2c 100644
@@ -14,6 +14,7 @@ acct01 acct01
 add_key01 add_key01
 add_key02 add_key02
 add_key03 add_key03
+add_key04 add_key04
 
 adjtimex01 adjtimex01
 adjtimex02 adjtimex02

testcases/kernel/syscalls/.gitignore +1 -0

index 0b3935880..12a136edb 100644
@@ -9,6 +9,7 @@
 /add_key/add_key01
 /add_key/add_key02
 /add_key/add_key03
+/add_key/add_key04
 /adjtimex/adjtimex01
 /adjtimex/adjtimex02
 /alarm/alarm01

testcases/kernel/syscalls/add_key/add_key04.c new file +90 -0

90 lines not on this page · raw message

Signature · 1 line

2.15.0.448.gf294e3d99a-goog