[PATCH] assert: Add test for CVE-2025-0395

[Siddhesh Poyarekar]

On 2025-02-04 11:33, Adhemerval Zanella Netto wrote:
> I am not sure why the buildbot has not caught it, it might due the either the
> gcc version of the missing options).  In any case I think we should avoid the
> alias violation ((uintptr_t *) &from) with something like:

Ack, thanks.

> diff --git a/assert/tst-assert-sa-2025-0001.c b/assert/tst-assert-sa-2025-0001.c
> index 1a86128da4..e87b9b76a3 100644
> --- a/assert/tst-assert-sa-2025-0001.c
> +++ b/assert/tst-assert-sa-2025-0001.c
> @@ -23,6 +23,7 @@
>   #include <stdbool.h>
>   #include <stdint.h>
>   #include <string.h>
> +#include <inttypes.h>
>   #include <sys/mman.h>
>   #include <support/check.h>
>   #include <support/support.h>
> @@ -56,7 +57,7 @@ do_test (int argc, char **argv)
>     FILE *f = xfopen ("/proc/self/maps", "r");
>     char *line = NULL;
>     size_t len = 0;
> -  void *prev_to = NULL;
> +  uintptr_t prev_to = 0;
> 
>     /* Pad the beginning of every writable mapping with a PROT_NONE map.  This
>        ensures that the mmap in the assert_fail path never ends up below a
> @@ -64,17 +65,17 @@ do_test (int argc, char **argv)
>        overflow.  */
>     while (xgetline (&line, &len, f))
>       {
> -      void *from, *to;
> +      uintptr_t from, to;
>         char perm[4];
> 
> -      sscanf (line, "%lx-%lx %c%c%c%c ",
> -             (uintptr_t *) &from, (uintptr_t *) &to,
> +      sscanf (line, "%" SCNxPTR "-%" SCNxPTR " %c%c%c%c ",
> +             &from, &to,
>                &perm[0], &perm[1], &perm[2], &perm[3]);
> 
>         bool writable = (memchr (perm, 'w', 4) != NULL);
> 
> -      if (prev_to != NULL && from - prev_to > pagesize && writable)
> -       xmmap (from - pagesize, pagesize, PROT_NONE,
> +      if (prev_to != 0 && from - prev_to > pagesize && writable)
> +       xmmap ((void *)(from - pagesize), pagesize, PROT_NONE,
>                 MAP_ANONYMOUS | MAP_PRIVATE, 0);
> 
>         prev_to = to;
> 
> I am not sure why the buildbot for arm32 has failed, it only indicates that a
> SEGFAULT occurred (error 127).  I have tests on arm64 kernel and with the patch
> avoid I did not see any issue.

I haven't had a chance to dig into that yet, I hope to get an update out 
soon.

Sid