1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2022 xiaoshoukui <[email protected]>
4 */
5
6 /*\
7 * [Description]
8 *
9 * Test based on Syzkaller reproducer:
10 * https://syzkaller.appspot.com/bug?extid=522643ab5729b0421998
11 *
12 * The VT_DISALLOCATE ioctl can free a virtual console while tty_release() is
13 * still running, causing a use-after-free in con_shutdown(). This occurs
14 * because VT_DISALLOCATE only considers a virtual console to be in-use if it
15 * has a tty_struct with count > 0. But actually when count == 0, the tty is
16 * still in the process of being closed.
17 *
18 * Fixed by commit:
19 *
20 * commit ca4463bf8438b403596edd0ec961ca0d4fbe0220
21 * Author: Eric Biggers <[email protected]>
22 * Date: Sat Mar 21 20:43:04 2020 -0700
23 *
24 * vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console
25 */
26
27 #define _GNU_SOURCE
28
29 #include <stdlib.h>
30 #include <stdio.h>
31 #include <errno.h>
32 #include <termios.h>
33 #include <linux/vt.h>
34 #include "lapi/ioctl.h"
35
36 #include "tst_test.h"
37 #include "tst_safe_stdio.h"
38 #include "tst_fuzzy_sync.h"
39
40 #define BUF_SIZE 256
41 static char tty_path_a[BUF_SIZE];
42 static char tty_path_b[BUF_SIZE];
43 static int test_tty_port = 8;
44 static struct tst_fzsync_pair fzp;
45
open_close(void * unused)46 static void *open_close(void *unused)
47 {
48 while (tst_fzsync_run_b(&fzp)) {
49 tst_fzsync_start_race_b(&fzp);
50 int fd = SAFE_OPEN(tty_path_b, O_RDWR);
51
52 SAFE_CLOSE(fd);
53 tst_fzsync_end_race_b(&fzp);
54 }
55
56 return unused;
57 }
58
do_test(void)59 static void do_test(void)
60 {
61 int fd = SAFE_OPEN(tty_path_a, O_RDWR);
62
63 tst_fzsync_pair_reset(&fzp, open_close);
64
65 while (tst_fzsync_run_a(&fzp)) {
66 tst_fzsync_start_race_a(&fzp);
67 ioctl(fd, VT_DISALLOCATE, test_tty_port);
68 tst_fzsync_end_race_a(&fzp);
69 if (tst_taint_check()) {
70 tst_res(TFAIL, "Kernel is vulnerable");
71 return;
72 }
73 }
74 SAFE_CLOSE(fd);
75 tst_res(TPASS, "Did not crash with VT_DISALLOCATE");
76 }
77
setup(void)78 static void setup(void)
79 {
80 sprintf(tty_path_a, "/dev/tty%d", test_tty_port + 1);
81 sprintf(tty_path_b, "/dev/tty%d", test_tty_port);
82
83 if (access(tty_path_a, F_OK) || access(tty_path_b, F_OK))
84 tst_brk(TCONF, "TTY(s) under test not available in system");
85
86 tst_fzsync_pair_init(&fzp);
87 }
88
cleanup(void)89 static void cleanup(void)
90 {
91 tst_fzsync_pair_cleanup(&fzp);
92 }
93
94 static struct tst_test test = {
95 .test_all = do_test,
96 .setup = setup,
97 .cleanup = cleanup,
98 .needs_root = 1,
99 .taint_check = TST_TAINT_W | TST_TAINT_D,
100 .max_runtime = 150,
101 .tags = (const struct tst_tag[]) {
102 {"CVE", "2020-36557"},
103 {"linux-git", "ca4463bf8438"},
104 {}
105 }
106 };
107