1*33de042dSApple OSS Distributions /*
2*33de042dSApple OSS Distributions * Proof of Concept / Test Case
3*33de042dSApple OSS Distributions * XNU: aio_work_thread use-after-free for AIO_FSYNC entries
4*33de042dSApple OSS Distributions */
5*33de042dSApple OSS Distributions #include <err.h>
6*33de042dSApple OSS Distributions #include <stdarg.h>
7*33de042dSApple OSS Distributions #include <stdint.h>
8*33de042dSApple OSS Distributions #include <stdio.h>
9*33de042dSApple OSS Distributions #include <stdlib.h>
10*33de042dSApple OSS Distributions #include <string.h>
11*33de042dSApple OSS Distributions #include <strings.h>
12*33de042dSApple OSS Distributions
13*33de042dSApple OSS Distributions #include <sys/aio.h>
14*33de042dSApple OSS Distributions #include <unistd.h>
15*33de042dSApple OSS Distributions #include <darwintest.h>
16*33de042dSApple OSS Distributions #include <time.h>
17*33de042dSApple OSS Distributions
18*33de042dSApple OSS Distributions T_GLOBAL_META(
19*33de042dSApple OSS Distributions T_META_NAMESPACE("xnu.fd"),
20*33de042dSApple OSS Distributions T_META_RUN_CONCURRENTLY(true));
21*33de042dSApple OSS Distributions
22*33de042dSApple OSS Distributions #define NREQUESTS 8
23*33de042dSApple OSS Distributions
24*33de042dSApple OSS Distributions static void
attempt(int fd)25*33de042dSApple OSS Distributions attempt(int fd)
26*33de042dSApple OSS Distributions {
27*33de042dSApple OSS Distributions struct aiocb ap[NREQUESTS];
28*33de042dSApple OSS Distributions size_t n;
29*33de042dSApple OSS Distributions unsigned char c;
30*33de042dSApple OSS Distributions
31*33de042dSApple OSS Distributions for (n = 0; n < NREQUESTS; ++n) {
32*33de042dSApple OSS Distributions ap[n].aio_fildes = fd;
33*33de042dSApple OSS Distributions ap[n].aio_nbytes = 1;
34*33de042dSApple OSS Distributions ap[n].aio_buf = &c;
35*33de042dSApple OSS Distributions ap[n].aio_sigevent.sigev_notify = SIGEV_NONE;
36*33de042dSApple OSS Distributions }
37*33de042dSApple OSS Distributions
38*33de042dSApple OSS Distributions /*
39*33de042dSApple OSS Distributions * fire them off and exit.
40*33de042dSApple OSS Distributions */
41*33de042dSApple OSS Distributions for (n = 0; n < NREQUESTS; ++n) {
42*33de042dSApple OSS Distributions aio_fsync((n & 1) ? O_SYNC : O_DSYNC, &ap[n]);
43*33de042dSApple OSS Distributions }
44*33de042dSApple OSS Distributions
45*33de042dSApple OSS Distributions exit(0);
46*33de042dSApple OSS Distributions }
47*33de042dSApple OSS Distributions
48*33de042dSApple OSS Distributions T_DECL(lio_listio_race_63669270, "test for the lightspeed/unc0ver UaF", T_META_TAG_VM_PREFERRED)
49*33de042dSApple OSS Distributions {
50*33de042dSApple OSS Distributions pid_t child;
51*33de042dSApple OSS Distributions int fd;
52*33de042dSApple OSS Distributions char path[128];
53*33de042dSApple OSS Distributions uint64_t end = clock_gettime_nsec_np(CLOCK_UPTIME_RAW) + 10 * NSEC_PER_SEC;
54*33de042dSApple OSS Distributions
55*33de042dSApple OSS Distributions /* we need a valid fd: */
56*33de042dSApple OSS Distributions strcpy(path, "/tmp/aio_fsync_uaf.XXXXXX");
57*33de042dSApple OSS Distributions T_EXPECT_POSIX_SUCCESS(fd = mkstemp(path), "mkstemp");
58*33de042dSApple OSS Distributions T_EXPECT_POSIX_SUCCESS(unlink(path), "unlink");
59*33de042dSApple OSS Distributions
60*33de042dSApple OSS Distributions T_LOG("starting...");
61*33de042dSApple OSS Distributions do {
62*33de042dSApple OSS Distributions switch ((child = fork())) {
63*33de042dSApple OSS Distributions case -1: T_FAIL("fork");
64*33de042dSApple OSS Distributions case 0: attempt(fd);
65*33de042dSApple OSS Distributions }
66*33de042dSApple OSS Distributions
67*33de042dSApple OSS Distributions T_QUIET; T_EXPECT_POSIX_SUCCESS(waitpid(child, NULL, 0), "waitpid");
68*33de042dSApple OSS Distributions } while (clock_gettime_nsec_np(CLOCK_UPTIME_RAW) < end);
69*33de042dSApple OSS Distributions
70*33de042dSApple OSS Distributions T_PASS("the system didn't panic");
71*33de042dSApple OSS Distributions }
72