summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHe Zhe <zhe.he@windriver.com>2019-09-30 10:38:01 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2019-10-02 10:09:47 +0100
commitafc8407398ad7cea4fbd46e2cb3b1f97e3d51c67 (patch)
treea30318e856238b24ff88944daef3022bbc464dae
parent24bf7524597c2582637569d9b776b4fb722fd188 (diff)
downloadpoky-afc8407398ad7cea4fbd46e2cb3b1f97e3d51c67.tar.gz
ltp: Fix hang of cve test cases
Backport a patch to the fix possible hang caused by the case of CVE-2017-17052. CVE: CVE-2017-17052 (From OE-Core rev: 3bde502f612f17b6ed928b04cf5c4ba9ad54d598) Signed-off-by: He Zhe <zhe.he@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-extended/ltp/ltp/0001-cve-2017-17052-Avoid-unsafe-exits-in-threads.patch64
-rw-r--r--meta/recipes-extended/ltp/ltp_20190517.bb1
2 files changed, 65 insertions, 0 deletions
diff --git a/meta/recipes-extended/ltp/ltp/0001-cve-2017-17052-Avoid-unsafe-exits-in-threads.patch b/meta/recipes-extended/ltp/ltp/0001-cve-2017-17052-Avoid-unsafe-exits-in-threads.patch
new file mode 100644
index 0000000000..cc40081300
--- /dev/null
+++ b/meta/recipes-extended/ltp/ltp/0001-cve-2017-17052-Avoid-unsafe-exits-in-threads.patch
@@ -0,0 +1,64 @@
1From e3a8502d0a4f8a44ddd02ca4b2efc097133fb9f7 Mon Sep 17 00:00:00 2001
2From: Mathias Fiedler <mathias.fiedler@aox-tech.de>
3Date: Fri, 23 Aug 2019 12:46:48 +0200
4Subject: [PATCH] cve-2017-17052: Avoid unsafe exits in threads
5
6According to manpage exit(3) calling exit is not thread-safe.
7And with glibc 2.28 (and probably also with glibc >=2.27) sometimes
8child processes created in fork_thread can get stuck on process exit in
9glibc's __run_exit_handlers trying to acquire some lock which was in
10locked state while the fork was created. This can happen when exit is
11called in mmap_thread concurrently to the fork.
12While the main process will still return with PASSED some of its
13children are left behind.
14
15Comparing the source code with the original program as described in the
16commit 2b7e8665b4ff51c034c55df3cff76518d1a9ee3a of linux kernel >=4.13
17the exits in mmap_thread and fork_thread should not be necessary to
18trigger the original bug.
19
20Therefore those exit calls are removed. The mmap_thread and fork_thread
21should still exit when their corresponding main thread in do_test_fork
22calls exit_group. The remaining exit in do_test_fork will be called in
23the main thread without any concurrent thread in the same process.
24
25Signed-off-by: Mathias Fiedler <mathias.fiedler@aox-tech.de>
26Acked-by: Cyril Hrubis <chrubis@suse.cz>
27Acked-by: Jan Stancek <jstancek@redhat.com>
28
29Upstream-Status: Backport
30[https://github.com/linux-test-project/ltp/commit/9f0b452c1af4bcb54da35711eb3fa77334a350b4]
31
32CVE: CVE-2017-17052
33
34Signed-off-by: He Zhe <zhe.he@windriver.com>
35---
36 testcases/cve/cve-2017-17052.c | 5 -----
37 1 file changed, 5 deletions(-)
38
39diff --git a/testcases/cve/cve-2017-17052.c b/testcases/cve/cve-2017-17052.c
40index d7da7e919..18cd2a6d7 100644
41--- a/testcases/cve/cve-2017-17052.c
42+++ b/testcases/cve/cve-2017-17052.c
43@@ -58,8 +58,6 @@ static void *mmap_thread(void *arg)
44 for (;;) {
45 SAFE_MMAP(NULL, 0x1000000, PROT_READ,
46 MAP_POPULATE|MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
47- if (*do_exit)
48- exit(0);
49 }
50
51 return arg;
52@@ -67,9 +65,6 @@ static void *mmap_thread(void *arg)
53
54 static void *fork_thread(void *arg)
55 {
56- if (*do_exit)
57- exit(0);
58-
59 usleep(rand() % 10000);
60 SAFE_FORK();
61
62--
632.17.1
64
diff --git a/meta/recipes-extended/ltp/ltp_20190517.bb b/meta/recipes-extended/ltp/ltp_20190517.bb
index e9a588f496..4650715607 100644
--- a/meta/recipes-extended/ltp/ltp_20190517.bb
+++ b/meta/recipes-extended/ltp/ltp_20190517.bb
@@ -48,6 +48,7 @@ SRC_URI = "git://github.com/linux-test-project/ltp.git \
48 file://0001-cve-meltdown.c-Fix-kernel-symbol-finding.patch \ 48 file://0001-cve-meltdown.c-Fix-kernel-symbol-finding.patch \
49 file://0001-testcases-use-python3-everywhere-to-run-python-scrip.patch \ 49 file://0001-testcases-use-python3-everywhere-to-run-python-scrip.patch \
50 file://0001-syscall-rt_sigtimedwait01-Fix-wrong-sigset-length-fo.patch \ 50 file://0001-syscall-rt_sigtimedwait01-Fix-wrong-sigset-length-fo.patch \
51 file://0001-cve-2017-17052-Avoid-unsafe-exits-in-threads.patch \
51 " 52 "
52 53
53S = "${WORKDIR}/git" 54S = "${WORKDIR}/git"