Commit c7f92042 authored by Tzung-Bi Shih's avatar Tzung-Bi Shih Committed by Bartosz Golaszewski
Browse files

selftests: gpio: Add gpio-cdev-uaf tests 



Add tests for gpiolib-cdev to make sure accessing to dangling resources
via the opening file descriptor won't crash the system after the
underlying resource providers have gone.

Reviewed-by: default avatarLinus Walleij <linusw@kernel.org>
Signed-off-by: default avatarTzung-Bi Shih <tzungbi@kernel.org>
Link: https://patch.msgid.link/20260223061726.82161-7-tzungbi@kernel.org


Signed-off-by: default avatarBartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
parent ee68f18d

tools/testing/selftests/gpio/Makefile

+3 −2
Original line number Diff line number Diff line 
# SPDX-License-Identifier: GPL-2.0



TEST_PROGS := gpio-mockup.sh gpio-sim.sh gpio-aggregator.sh

TEST_PROGS := gpio-mockup.sh gpio-sim.sh gpio-aggregator.sh gpio-cdev-uaf.sh

TEST_FILES := gpio-mockup-sysfs.sh

TEST_GEN_PROGS_EXTENDED := gpio-mockup-cdev gpio-chip-info gpio-line-name

TEST_GEN_PROGS_EXTENDED := gpio-mockup-cdev gpio-chip-info gpio-line-name \

			   gpio-cdev-uaf

CFLAGS += -O2 -g -Wall $(KHDR_INCLUDES)



include ../lib.mk

tools/testing/selftests/gpio/gpio-cdev-uaf.c

0 → 100644
+292 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-or-later

/*

 * GPIO character device helper for UAF tests.

 *

 * Copyright 2026 Google LLC

 */



#include <errno.h>

#include <fcntl.h>

#include <linux/gpio.h>

#include <poll.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <sys/ioctl.h>

#include <sys/stat.h>

#include <sys/types.h>

#include <unistd.h>



#define CONFIGFS_DIR "/sys/kernel/config/gpio-sim"

#define PROCFS_DIR "/proc"



static void print_usage(void)

{

	printf("usage:\n");

	printf("  gpio-cdev-uaf [chip|handle|event|req] [poll|read|ioctl]\n");

}



static int _create_chip(const char *name, int create)

{

	char path[64];



	snprintf(path, sizeof(path), CONFIGFS_DIR "/%s", name);



	if (create)

		return mkdir(path, 0755);

	else

		return rmdir(path);

}



static int create_chip(const char *name)

{

	return _create_chip(name, 1);

}



static void remove_chip(const char *name)

{

	_create_chip(name, 0);

}



static int _create_bank(const char *chip_name, const char *name, int create)

{

	char path[64];



	snprintf(path, sizeof(path), CONFIGFS_DIR "/%s/%s", chip_name, name);



	if (create)

		return mkdir(path, 0755);

	else

		return rmdir(path);

}



static int create_bank(const char *chip_name, const char *name)

{

	return _create_bank(chip_name, name, 1);

}



static void remove_bank(const char *chip_name, const char *name)

{

	_create_bank(chip_name, name, 0);

}



static int _enable_chip(const char *name, int enable)

{

	char path[64];

	int fd, ret;



	snprintf(path, sizeof(path), CONFIGFS_DIR "/%s/live", name);



	fd = open(path, O_WRONLY);

	if (fd == -1)

		return fd;



	if (enable)

		ret = write(fd, "1", 1);

	else

		ret = write(fd, "0", 1);



	close(fd);

	return ret == 1 ? 0 : -1;

}



static int enable_chip(const char *name)

{

	return _enable_chip(name, 1);

}



static void disable_chip(const char *name)

{

	_enable_chip(name, 0);

}



static int open_chip(const char *chip_name, const char *bank_name)

{

	char path[64], dev_name[32];

	int ret, fd;



	ret = create_chip(chip_name);

	if (ret) {

		fprintf(stderr, "failed to create chip\n");

		return ret;

	}



	ret = create_bank(chip_name, bank_name);

	if (ret) {

		fprintf(stderr, "failed to create bank\n");

		goto err_remove_chip;

	}



	ret = enable_chip(chip_name);

	if (ret) {

		fprintf(stderr, "failed to enable chip\n");

		goto err_remove_bank;

	}



	snprintf(path, sizeof(path), CONFIGFS_DIR "/%s/%s/chip_name",

		 chip_name, bank_name);



	fd = open(path, O_RDONLY);

	if (fd == -1) {

		ret = fd;

		fprintf(stderr, "failed to open %s\n", path);

		goto err_disable_chip;

	}



	ret = read(fd, dev_name, sizeof(dev_name) - 1);

	close(fd);

	if (ret == -1) {

		fprintf(stderr, "failed to read %s\n", path);

		goto err_disable_chip;

	}

	dev_name[ret] = '\0';

	if (ret && dev_name[ret - 1] == '\n')

		dev_name[ret - 1] = '\0';



	snprintf(path, sizeof(path), "/dev/%s", dev_name);



	fd = open(path, O_RDWR);

	if (fd == -1) {

		ret = fd;

		fprintf(stderr, "failed to open %s\n", path);

		goto err_disable_chip;

	}



	return fd;

err_disable_chip:

	disable_chip(chip_name);

err_remove_bank:

	remove_bank(chip_name, bank_name);

err_remove_chip:

	remove_chip(chip_name);

	return ret;

}



static void close_chip(const char *chip_name, const char *bank_name)

{

	disable_chip(chip_name);

	remove_bank(chip_name, bank_name);

	remove_chip(chip_name);

}



static int test_poll(int fd)

{

	struct pollfd pfds;



	pfds.fd = fd;

	pfds.events = POLLIN;

	pfds.revents = 0;



	if (poll(&pfds, 1, 0) == -1)

		return -1;



	return (pfds.revents & ~(POLLHUP | POLLERR)) ? -1 : 0;

}



static int test_read(int fd)

{

	char data;



	if (read(fd, &data, 1) == -1 && errno == ENODEV)

		return 0;

	return -1;

}



static int test_ioctl(int fd)

{

	if (ioctl(fd, 0, NULL) == -1 && errno == ENODEV)

		return 0;

	return -1;

}



int main(int argc, char **argv)

{

	int cfd, fd, ret;

	int (*test_func)(int);



	if (argc != 3) {

		print_usage();

		return EXIT_FAILURE;

	}



	if (strcmp(argv[1], "chip") == 0 ||

	    strcmp(argv[1], "event") == 0 ||

	    strcmp(argv[1], "req") == 0) {

		if (strcmp(argv[2], "poll") &&

		    strcmp(argv[2], "read") &&

		    strcmp(argv[2], "ioctl")) {

			fprintf(stderr, "unknown command: %s\n", argv[2]);

			return EXIT_FAILURE;

		}

	} else if (strcmp(argv[1], "handle") == 0) {

		if (strcmp(argv[2], "ioctl")) {

			fprintf(stderr, "unknown command: %s\n", argv[2]);

			return EXIT_FAILURE;

		}

	} else {

		fprintf(stderr, "unknown command: %s\n", argv[1]);

		return EXIT_FAILURE;

	}



	if (strcmp(argv[2], "poll") == 0)

		test_func = test_poll;

	else if (strcmp(argv[2], "read") == 0)

		test_func = test_read;

	else	/* strcmp(argv[2], "ioctl") == 0 */

		test_func = test_ioctl;



	cfd = open_chip("chip", "bank");

	if (cfd == -1) {

		fprintf(stderr, "failed to open chip\n");

		return EXIT_FAILURE;

	}



	/* Step 1: Hold a FD to the test target. */

	if (strcmp(argv[1], "chip") == 0) {

		fd = cfd;

	} else if (strcmp(argv[1], "handle") == 0) {

		struct gpiohandle_request req = {0};



		req.lines = 1;

		if (ioctl(cfd, GPIO_GET_LINEHANDLE_IOCTL, &req) == -1) {

			fprintf(stderr, "failed to get handle FD\n");

			goto err_close_chip;

		}



		close(cfd);

		fd = req.fd;

	} else if (strcmp(argv[1], "event") == 0) {

		struct gpioevent_request req = {0};



		if (ioctl(cfd, GPIO_GET_LINEEVENT_IOCTL, &req) == -1) {

			fprintf(stderr, "failed to get event FD\n");

			goto err_close_chip;

		}



		close(cfd);

		fd = req.fd;

	} else {	/* strcmp(argv[1], "req") == 0 */

		struct gpio_v2_line_request req = {0};



		req.num_lines = 1;

		if (ioctl(cfd, GPIO_V2_GET_LINE_IOCTL, &req) == -1) {

			fprintf(stderr, "failed to get req FD\n");

			goto err_close_chip;

		}



		close(cfd);

		fd = req.fd;

	}



	/* Step 2: Free the chip. */

	close_chip("chip", "bank");



	/* Step 3: Access the dangling FD to trigger UAF. */

	ret = test_func(fd);

	close(fd);

	return ret ? EXIT_FAILURE : EXIT_SUCCESS;

err_close_chip:

	close(cfd);

	close_chip("chip", "bank");

	return EXIT_FAILURE;

}

tools/testing/selftests/gpio/gpio-cdev-uaf.sh

0 → 100755
+63 −0
Original line number Diff line number Diff line 
#!/bin/sh

# SPDX-License-Identifier: GPL-2.0

# Copyright 2026 Google LLC



BASE_DIR=`dirname $0`

MODULE="gpio-cdev-uaf"



fail() {

	echo "$*" >&2

	echo "GPIO $MODULE test FAIL"

	exit 1

}



skip() {

	echo "$*" >&2

	echo "GPIO $MODULE test SKIP"

	exit 4

}



# Load the gpio-sim module. This will pull in configfs if needed too.

modprobe gpio-sim || skip "unable to load the gpio-sim module"

# Make sure configfs is mounted at /sys/kernel/config. Wait a bit if needed.

for _ in `seq 5`; do

	mountpoint -q /sys/kernel/config && break

	mount -t configfs none /sys/kernel/config

	sleep 0.1

done

mountpoint -q /sys/kernel/config || \

	skip "configfs not mounted at /sys/kernel/config"



echo "1. GPIO"



echo "1.1. poll"

$BASE_DIR/gpio-cdev-uaf chip poll || fail "failed to test chip poll"

echo "1.2. read"

$BASE_DIR/gpio-cdev-uaf chip read || fail "failed to test chip read"

echo "1.3. ioctl"

$BASE_DIR/gpio-cdev-uaf chip ioctl || fail "failed to test chip ioctl"



echo "2. linehandle"



echo "2.1. ioctl"

$BASE_DIR/gpio-cdev-uaf handle ioctl || fail "failed to test handle ioctl"



echo "3. lineevent"



echo "3.1. read"

$BASE_DIR/gpio-cdev-uaf event read || fail "failed to test event read"

echo "3.2. poll"

$BASE_DIR/gpio-cdev-uaf event poll || fail "failed to test event poll"

echo "3.3. ioctl"

$BASE_DIR/gpio-cdev-uaf event ioctl || fail "failed to test event ioctl"



echo "4. linereq"



echo "4.1. read"

$BASE_DIR/gpio-cdev-uaf req read || fail "failed to test req read"

echo "4.2. poll"

$BASE_DIR/gpio-cdev-uaf req poll || fail "failed to test req poll"

echo "4.3. ioctl"

$BASE_DIR/gpio-cdev-uaf req ioctl || fail "failed to test req ioctl"



echo "GPIO $MODULE test PASS"