1 /* 2 * Code taken from an example posted to Red Hat bugzilla #220971 3 * 4 * Original Author: Kostantin Khorenko from OpenVZ/Virtuozzo 5 * Munged by Jeff Moyer to incorporate it into the autotest framework. 6 * 7 * Description: "aio_setup_ring() function initializes info->nr_pages 8 * variable incorrectly, then this variable can be used in error path 9 * to free the allocated resources. By this way an unprivileged user 10 * can crash the node." 11 * 12 * At the beginning of aio_setup_ring, info->nr_pages is initialized 13 * to the requested number of pages. However, it is supposed to 14 * indicate how many pages are mapped in info->ring_pages. Thus, if 15 * the call to do_mmap fails: 16 * 17 * info->mmap_base = do_mmap(NULL, 0, info->mmap_size, 18 * PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE, 19 * 0); 20 * if (IS_ERR((void *)info->mmap_base)) { 21 * up_write(&ctx->mm->mmap_sem); 22 * printk("mmap err: %ld\n", -info->mmap_base); 23 * info->mmap_size = 0; 24 * aio_free_ring(ctx); <--------- 25 * return -EAGAIN; 26 * } 27 * 28 * we end up calling aio_free_ring with a bogus array and cause an oops. 29 * 30 * This is a destructive test. 31 */ 32 #include <stdio.h> 33 #include <unistd.h> 34 #include <sys/mman.h> 35 #include <errno.h> 36 #include <libgen.h> 37 #include <libaio.h> 38 39 int main(int __attribute__((unused)) argc, char **argv) 40 { 41 long res; 42 io_context_t ctx = (void*) 0; 43 void* map; 44 45 while (1) { 46 map = mmap(NULL, 100, PROT_READ, MAP_ANONYMOUS|MAP_PRIVATE, 47 0, 0); 48 if (map == MAP_FAILED) 49 break; 50 map = mmap(NULL, 100, PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, 51 0, 0); 52 if (map == MAP_FAILED) 53 break; 54 } 55 56 res = io_setup(10000, &ctx); 57 if (res != -ENOMEM) { 58 printf("%s: Error: io_setup returned %ld, expected -ENOMEM\n", 59 basename(argv[0]), res); 60 return 1; 61 } else 62 printf("%s: Success!\n", basename(argv[0])); 63 return 0; 64 } 65
