mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 01:10:04 +00:00
![Eric Sandeen](/assets/img/avatar_default.png)
The kernel has only two users of proc_do_large_bitmap(), the kernel CPU watchdog, and the ip_local_reserved_ports. Refer to watchdog_cpumask and ip_local_reserved_ports in Documentation for further details on these. When you input a large buffer into these, when it is larger than PAGE_SIZE- 1, the input data gets misparsed, and the user get incorrectly informed that the desired input value was set. This commit implements a test which mimics and exploits that use case, it uses a bitmap size, as in the watchdog case. The bitmap is used to test the bitmap proc handler, proc_do_large_bitmap(). The next commit fixes this issue. [akpm@linux-foundation.org: move proc_do_large_bitmap() export to EOF] [mcgrof@kernel.org: use new target description for backward compatibility] [mcgrof@kernel.org: augment test number to 50, ran into issues with bash string comparisons when testing up to 50 cases.] [mcgrof@kernel.org: introduce and use verify_diff_proc_file() to use diff] [mcgrof@kernel.org: use mktemp for tmp file] [mcgrof@kernel.org: merge shell test and C code] [mcgrof@kernel.org: commit log love] [mcgrof@kernel.org: export proc_do_large_bitmap() to allow for the test [mcgrof@kernel.org: check for the return value when writing to the proc file] Link: http://lkml.kernel.org/r/20190320222831.8243-6-mcgrof@kernel.org Signed-off-by: Eric Sandeen <sandeen@redhat.com> Signed-off-by: Luis Chamberlain <mcgrof@kernel.org> Acked-by: Kees Cook <keescook@chromium.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
164 lines
3.7 KiB
C
164 lines
3.7 KiB
C
/*
|
|
* proc sysctl test driver
|
|
*
|
|
* Copyright (C) 2017 Luis R. Rodriguez <mcgrof@kernel.org>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License as published by the Free
|
|
* Software Foundation; either version 2 of the License, or at your option any
|
|
* later version; or, when distributed separately from the Linux kernel or
|
|
* when incorporated into other software packages, subject to the following
|
|
* license:
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
* under the terms of copyleft-next (version 0.3.1 or later) as published
|
|
* at http://copyleft-next.org/.
|
|
*/
|
|
|
|
/*
|
|
* This module provides an interface to the the proc sysctl interfaces. This
|
|
* driver requires CONFIG_PROC_SYSCTL. It will not normally be loaded by the
|
|
* system unless explicitly requested by name. You can also build this driver
|
|
* into your kernel.
|
|
*/
|
|
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
|
|
|
#include <linux/init.h>
|
|
#include <linux/list.h>
|
|
#include <linux/module.h>
|
|
#include <linux/printk.h>
|
|
#include <linux/fs.h>
|
|
#include <linux/miscdevice.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/uaccess.h>
|
|
#include <linux/async.h>
|
|
#include <linux/delay.h>
|
|
#include <linux/vmalloc.h>
|
|
|
|
static int i_zero;
|
|
static int i_one_hundred = 100;
|
|
|
|
struct test_sysctl_data {
|
|
int int_0001;
|
|
int int_0002;
|
|
int int_0003[4];
|
|
|
|
unsigned int uint_0001;
|
|
|
|
char string_0001[65];
|
|
|
|
#define SYSCTL_TEST_BITMAP_SIZE 65536
|
|
unsigned long *bitmap_0001;
|
|
};
|
|
|
|
static struct test_sysctl_data test_data = {
|
|
.int_0001 = 60,
|
|
.int_0002 = 1,
|
|
|
|
.int_0003[0] = 0,
|
|
.int_0003[1] = 1,
|
|
.int_0003[2] = 2,
|
|
.int_0003[3] = 3,
|
|
|
|
.uint_0001 = 314,
|
|
|
|
.string_0001 = "(none)",
|
|
};
|
|
|
|
/* These are all under /proc/sys/debug/test_sysctl/ */
|
|
static struct ctl_table test_table[] = {
|
|
{
|
|
.procname = "int_0001",
|
|
.data = &test_data.int_0001,
|
|
.maxlen = sizeof(int),
|
|
.mode = 0644,
|
|
.proc_handler = proc_dointvec_minmax,
|
|
.extra1 = &i_zero,
|
|
.extra2 = &i_one_hundred,
|
|
},
|
|
{
|
|
.procname = "int_0002",
|
|
.data = &test_data.int_0002,
|
|
.maxlen = sizeof(int),
|
|
.mode = 0644,
|
|
.proc_handler = proc_dointvec,
|
|
},
|
|
{
|
|
.procname = "int_0003",
|
|
.data = &test_data.int_0003,
|
|
.maxlen = sizeof(test_data.int_0003),
|
|
.mode = 0644,
|
|
.proc_handler = proc_dointvec,
|
|
},
|
|
{
|
|
.procname = "uint_0001",
|
|
.data = &test_data.uint_0001,
|
|
.maxlen = sizeof(unsigned int),
|
|
.mode = 0644,
|
|
.proc_handler = proc_douintvec,
|
|
},
|
|
{
|
|
.procname = "string_0001",
|
|
.data = &test_data.string_0001,
|
|
.maxlen = sizeof(test_data.string_0001),
|
|
.mode = 0644,
|
|
.proc_handler = proc_dostring,
|
|
},
|
|
{
|
|
.procname = "bitmap_0001",
|
|
.data = &test_data.bitmap_0001,
|
|
.maxlen = SYSCTL_TEST_BITMAP_SIZE,
|
|
.mode = 0644,
|
|
.proc_handler = proc_do_large_bitmap,
|
|
},
|
|
{ }
|
|
};
|
|
|
|
static struct ctl_table test_sysctl_table[] = {
|
|
{
|
|
.procname = "test_sysctl",
|
|
.maxlen = 0,
|
|
.mode = 0555,
|
|
.child = test_table,
|
|
},
|
|
{ }
|
|
};
|
|
|
|
static struct ctl_table test_sysctl_root_table[] = {
|
|
{
|
|
.procname = "debug",
|
|
.maxlen = 0,
|
|
.mode = 0555,
|
|
.child = test_sysctl_table,
|
|
},
|
|
{ }
|
|
};
|
|
|
|
static struct ctl_table_header *test_sysctl_header;
|
|
|
|
static int __init test_sysctl_init(void)
|
|
{
|
|
test_data.bitmap_0001 = kzalloc(SYSCTL_TEST_BITMAP_SIZE/8, GFP_KERNEL);
|
|
if (!test_data.bitmap_0001)
|
|
return -ENOMEM;
|
|
test_sysctl_header = register_sysctl_table(test_sysctl_root_table);
|
|
if (!test_sysctl_header) {
|
|
kfree(test_data.bitmap_0001);
|
|
return -ENOMEM;
|
|
}
|
|
return 0;
|
|
}
|
|
late_initcall(test_sysctl_init);
|
|
|
|
static void __exit test_sysctl_exit(void)
|
|
{
|
|
kfree(test_data.bitmap_0001);
|
|
if (test_sysctl_header)
|
|
unregister_sysctl_table(test_sysctl_header);
|
|
}
|
|
|
|
module_exit(test_sysctl_exit);
|
|
|
|
MODULE_AUTHOR("Luis R. Rodriguez <mcgrof@kernel.org>");
|
|
MODULE_LICENSE("GPL");
|