1f08c3bdfSopenharmony_ci// SPDX-License-Identifier: GPL-2.0-or-later 2f08c3bdfSopenharmony_ci/* 3f08c3bdfSopenharmony_ci * Copyright (c) 2017 Richard Palethorpe <rpalethorpe@suse.com> 4f08c3bdfSopenharmony_ci */ 5f08c3bdfSopenharmony_ci/* 6f08c3bdfSopenharmony_ci * Test for CVE-2017-6951, original reproducer can be found here: 7f08c3bdfSopenharmony_ci * http://www.spinics.net/lists/keyrings/msg01845.html 8f08c3bdfSopenharmony_ci * 9f08c3bdfSopenharmony_ci * request_key() is not in glibc, so we just use the syscall directly instead 10f08c3bdfSopenharmony_ci * of linking to keyutils. 11f08c3bdfSopenharmony_ci */ 12f08c3bdfSopenharmony_ci 13f08c3bdfSopenharmony_ci#include <unistd.h> 14f08c3bdfSopenharmony_ci#include <sys/syscall.h> 15f08c3bdfSopenharmony_ci 16f08c3bdfSopenharmony_ci#include "tst_test.h" 17f08c3bdfSopenharmony_ci#include "lapi/syscalls.h" 18f08c3bdfSopenharmony_ci 19f08c3bdfSopenharmony_ci#define ATTEMPTS 0x100 20f08c3bdfSopenharmony_ci 21f08c3bdfSopenharmony_cistatic void run(void) 22f08c3bdfSopenharmony_ci{ 23f08c3bdfSopenharmony_ci int i; 24f08c3bdfSopenharmony_ci 25f08c3bdfSopenharmony_ci tst_res(TINFO, "Requesting dead key"); 26f08c3bdfSopenharmony_ci for (i = 0; i < ATTEMPTS; i++) 27f08c3bdfSopenharmony_ci tst_syscall(__NR_request_key, "dead", "abc", "abc", 0, 0, 0); 28f08c3bdfSopenharmony_ci 29f08c3bdfSopenharmony_ci tst_res(TPASS, "No crash after %d attempts", ATTEMPTS); 30f08c3bdfSopenharmony_ci} 31f08c3bdfSopenharmony_ci 32f08c3bdfSopenharmony_cistatic struct tst_test test = { 33f08c3bdfSopenharmony_ci .test_all = run, 34f08c3bdfSopenharmony_ci .tags = (const struct tst_tag[]) { 35f08c3bdfSopenharmony_ci {"CVE", "2017-6951"}, 36f08c3bdfSopenharmony_ci {} 37f08c3bdfSopenharmony_ci } 38f08c3bdfSopenharmony_ci}; 39