Attachment 871165 Details for Bug 1217821

simple reproduce code

cve-2021-4197_2.txt (text/plain), 4.79 KB, created by WEI GAO on 2023-12-05 13:10:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: WEI GAO

Created: 2023-12-05 13:10:52 UTC

Size: 4.79 KB

patch

obsolete

>#define _GNU_SOURCE
>#include <sched.h>
>#include <stdio.h>
>#include <stdlib.h>
>#include <string.h>
>#include <sys/wait.h>
>#include <unistd.h>
>
>#define STACK_SIZE (1024 * 1024) /* Stack size for cloned child */
>#define ERREXIT(msg)                                                           \
>  {                                                                            \
>    perror(msg);                                                               \
>    exit(EXIT_FAILURE);                                                        \
>  }
>#define CHECKALLOC(ptr, msg)                                                   \
>  ({                                                                           \
>    void *p = ptr;                                                             \
>    if (p == NULL)                                                             \
>      ERREXIT(msg);                                                            \
>    p;                                                                         \
>  })
>
>int child=0;
>
>static int
>childFunc(void *arg)
>{
>  puts("child: start");
>  puts("child: terminate");
>  *(int *)arg = 100;
>  return 0; /* Child terminates now */
>}
>
>int
>main(int argc, char *argv[])
>{
>        static  char stack[STACK_SIZE]; /* Start of stack buffer */
>//      char stack[STACK_SIZE]; /* Start of stack buffer */
>        pid_t pid;   /* Child process's pids */
>        int wstatus;
>
>        printf("child start value is %d \n", child);
>
>        char *stackTop; /* End of stack buffer */
>        stackTop = stack + STACK_SIZE;
>
>        pid = clone(childFunc, stackTop,
>                        CLONE_NEWCGROUP | CLONE_FILES | CLONE_VM | SIGCHLD, &child);
>        if (pid == -1)
>                ERREXIT("clone");
>
>        printf("clone() returned %ld\n", (long)pid);
>
>        if (waitpid(pid, &wstatus, 0) == -1)
>                ERREXIT("waitpid");
>
>        if (WIFEXITED(wstatus)) {
>                printf("exited, status=%d\n", WEXITSTATUS(wstatus));
>        } else if (WIFSIGNALED(wstatus)) {
>                printf("!!!!!killed by signal %d\n", WTERMSIG(wstatus));
>        } else if (WIFSTOPPED(wstatus)) {
>                printf("stopped by signal %d\n", WSTOPSIG(wstatus));
>        } else if (WIFCONTINUED(wstatus)) {
>                printf("continued\n");
>        }
>
>        printf("child %ld has terminated\n", (long)pid);
>
>        printf("child value is change to %d \n", child);
>
>        return EXIT_SUCCESS;
>}
>
>
>
>
>all: default
>
>default: waitpid waitpid_optimized
>
>waitpid: waitpid.c Makefile
>        $(CC) -Wall -Werror -std=gnu11 -ggdb -o waitpid            waitpid.c
>
>waitpid_optimized: waitpid.c Makefile
>        $(CC) -Wall -Werror -std=gnu11 -Ofast -o waitpid_optimized waitpid.c
>
>clean:
>        $(RM) waitpid waitpid_optimized
>
>
>
>cat /etc/os-release
>NAME="SLES"
>VERSION="15-SP6"
>VERSION_ID="15.6"
>PRETTY_NAME="SUSE Linux Enterprise Server 15 SP6"
>ID="sles"
>ID_LIKE="suse"
>ANSI_COLOR="0;32"
>CPE_NAME="cpe:/o:suse:sles:15:sp6"
>DOCUMENTATION_URL="https://documentation.suse.com/"
>azureuser@cvetestasmorodskyi:~> uname -r
>6.4.0-150600.4-default
>azureuser@cvetestasmorodskyi:~> ldd --version
>ldd (GNU libc) 2.31
>Copyright (C) 2020 Free Software Foundation, Inc.
>This is free software; see the source for copying conditions.  There is NO
>warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
>Written by Roland McGrath and Ulrich Drepper.
>azureuser@cvetestasmorodskyi:~> lscpu
>Architecture:           aarch64
>  CPU op-mode(s):       32-bit, 64-bit
>  Byte Order:           Little Endian
>CPU(s):                 2
>  On-line CPU(s) list:  0,1
>Vendor ID:              ARM
>  Model name:           Neoverse-N1
>    Model:              1
>    Thread(s) per core: 1
>    Core(s) per socket: 2
>    Socket(s):          1
>    Stepping:           r3p1
>    BogoMIPS:           50.00
>    Flags:              fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm lrcpc dcpop asimddp
>Caches (sum of all):
>  L1d:                  128 KiB (2 instances)
>  L1i:                  128 KiB (2 instances)
>  L2:                   2 MiB (2 instances)
>  L3:                   32 MiB (1 instance)
>NUMA:
>  NUMA node(s):         1
>  NUMA node0 CPU(s):    0,1
>Vulnerabilities:
>  Gather data sampling: Not affected
>  Itlb multihit:        Not affected
>  L1tf:                 Not affected
>  Mds:                  Not affected
>  Meltdown:             Mitigation; PTI
>  Mmio stale data:      Not affected
>  Retbleed:             Not affected
>  Spec rstack overflow: Not affected
>  Spec store bypass:    Not affected
>  Spectre v1:           Mitigation; __user pointer sanitization
>  Spectre v2:           Mitigation; CSV2, BHB
>  Srbds:                Not affected
>  Tsx async abort:      Not affected

Actions: View

Attachments on bug 1217821: 871165