d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

tests: Test for an epair panic

Browse Source 
if_epair abused the ifr_data field to insert its second interface in
IFC_IFLIST. If userspace provides a value for ifr_data it would get
dereferenced by the kernel leading to a panic.

Reported by:	Ilja Van Sprundel <ivansprundel@ioactive.com>
MFC after:	3 days
This commit is contained in:
kp 2020-01-28 22:46:51 +00:00
parent 34cc84f183
commit 5eca6abc74
2 changed files with 75 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
tests/sys/net/Makefile
View File

@ -9,6 +9,7 @@ ATF_TESTS_SH+= if_lagg_test
ATF_TESTS_SH+= if_clone_test
ATF_TESTS_SH+= if_tun_test
ATF_TESTS_SH+= if_vlan
ATF_TESTS_C+= if_epair
TESTS_SUBDIRS+= routing
@ -18,7 +19,7 @@ TESTS_SUBDIRS+= routing
TEST_METADATA+= is_exclusive=true
MAN=
PROG= randsleep
PROGS+= randsleep
WARNS?= 6

73
tests/sys/net/if_epair.c Normal file
View File

@ -0,0 +1,73 @@
/*-
* Copyright (c) 2020 Kristof Provost <kp@FreeBSD.org>
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $FreeBSD$
*/
#include <sys/ioctl.h>
#include <sys/linker.h>
#include <sys/module.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <net/if.h>
#include <fcntl.h>
#include <stdio.h>
#include <atf-c.h>
ATF_TC(params);
ATF_TC_HEAD(params, tc)
{
atf_tc_set_md_var(tc, "require.user", "root");
}
ATF_TC_BODY(params, tc)
{
struct ifreq ifr;
int s;
s = kldload("if_epair");
if (s != 0)
atf_tc_fail("Failed to load if_epair");
s = socket(AF_INET, SOCK_DGRAM, 0);
if (s < 0)
atf_tc_fail("Failed to create socket");
bzero(&ifr, sizeof(ifr));
ifr.ifr_data = (caddr_t)-1;
(void) strlcpy(ifr.ifr_name, "epair", sizeof(ifr.ifr_name));
ioctl(s, SIOCIFCREATE2, &ifr);
}
ATF_TP_ADD_TCS(tp)
{
ATF_TP_ADD_TC(tp, params);
return (atf_no_error());
}