1 /* 2 * Copyright (c) 2017 Google, Inc. 3 * 4 * This program is free software: you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License as published by 6 * the Free Software Foundation, either version 2 of the License, or 7 * (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program, if not, see <http://www.gnu.org/licenses/>. 16 */ 17 18 /* 19 * Regression test for commit c9f838d104fe ("KEYS: fix 20 * keyctl_set_reqkey_keyring() to not leak thread keyrings"), a.k.a. 21 * CVE-2017-7472. This bug could be used to exhaust kernel memory, though it 22 * would take a while to do that and it would grind the test suite to a halt. 23 * Instead we do a quick check for whether the existing thread keyring is 24 * replaced when the default request-key destination is set to the thread 25 * keyring. It shouldn't be, but before the fix it was (and the old thread 26 * keyring was leaked). 27 */ 28 29 #include <errno.h> 30 31 #include "tst_test.h" 32 #include "lapi/keyctl.h" 33 34 static void do_test(void) 35 { 36 key_serial_t tid_keyring; 37 38 TEST(keyctl(KEYCTL_GET_KEYRING_ID, KEY_SPEC_THREAD_KEYRING, 1)); 39 if (TEST_RETURN < 0) 40 tst_brk(TBROK | TTERRNO, "failed to create thread keyring"); 41 tid_keyring = TEST_RETURN; 42 43 TEST(keyctl(KEYCTL_SET_REQKEY_KEYRING, KEY_REQKEY_DEFL_THREAD_KEYRING)); 44 if (TEST_RETURN < 0) 45 tst_brk(TBROK | TTERRNO, "failed to set reqkey keyring"); 46 47 TEST(keyctl(KEYCTL_GET_KEYRING_ID, KEY_SPEC_THREAD_KEYRING, 0)); 48 if (TEST_RETURN < 0) 49 tst_brk(TBROK | TTERRNO, "failed to get thread keyring ID"); 50 if (TEST_RETURN == tid_keyring) 51 tst_res(TPASS, "thread keyring was not leaked"); 52 else 53 tst_res(TFAIL, "thread keyring was leaked!"); 54 } 55 56 static struct tst_test test = { 57 .test_all = do_test, 58 }; 59
