system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-07-22 02:37:15 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

tests: Test for an epair panic

Browse source 
if_epair abused the ifr_data field to insert its second interface in
IFC_IFLIST. If userspace provides a value for ifr_data it would get
dereferenced by the kernel leading to a panic.

Reported by:	Ilja Van Sprundel <ivansprundel@ioactive.com>
MFC after:	3 days
This commit is contained in:
Kristof Provost 2020-01-28 22:46:51 +00:00
parent b02fd8b790
commit 5458a63bca
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=357234
2 changed files with 75 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
tests/sys/net/Makefile
View file

@ -9,6 +9,7 @@ ATF_TESTS_SH+= if_lagg_test
ATF_TESTS_SH+= if_clone_test
ATF_TESTS_SH+= if_tun_test
ATF_TESTS_SH+= if_vlan
ATF_TESTS_C+= if_epair
TESTS_SUBDIRS+= routing
@ -18,7 +19,7 @@ TESTS_SUBDIRS+= routing
TEST_METADATA+= is_exclusive=true
MAN=
PROG= randsleep
PROGS+= randsleep
WARNS?= 6

73
tests/sys/net/if_epair.c Normal file
View file

@ -0,0 +1,73 @@
/*-
* Copyright (c) 2020 Kristof Provost <kp@FreeBSD.org>
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $FreeBSD$
*/
#include <sys/ioctl.h>
#include <sys/linker.h>
#include <sys/module.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <net/if.h>
#include <fcntl.h>
#include <stdio.h>
#include <atf-c.h>
ATF_TC(params);
ATF_TC_HEAD(params, tc)
{
atf_tc_set_md_var(tc, "require.user", "root");
}
ATF_TC_BODY(params, tc)
{
struct ifreq ifr;
int s;
s = kldload("if_epair");
if (s != 0)
atf_tc_fail("Failed to load if_epair");
s = socket(AF_INET, SOCK_DGRAM, 0);
if (s < 0)
atf_tc_fail("Failed to create socket");
bzero(&ifr, sizeof(ifr));
ifr.ifr_data = (caddr_t)-1;
(void) strlcpy(ifr.ifr_name, "epair", sizeof(ifr.ifr_name));
ioctl(s, SIOCIFCREATE2, &ifr);
}
ATF_TP_ADD_TCS(tp)
{
ATF_TP_ADD_TC(tp, params);
return (atf_no_error());
}