tkhai

#!/bin/bash
# Reproducer for CVE-2021-4155
# This script shows the way ioctl(XFS_IOC_ALLOCSP) and friends
# leak 4095 bytes of every XFS block (4096 bytes) -- almost everything.
# Found by ktkhai@virtuozzo.com, fix and report sent to Red Hat and security@kernel.org.
# Fix: https://lists.openvz.org/pipermail/devel/2021-December/079470.html
# Fix in ms: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=983d8e60f50806f90534cc5373d0ce867e5aaf79
# https://www.virtuozzo.com/company/blog/xfs-file-system-vulnerability-cve-2021-4155/
# https://access.redhat.com/security/cve/cve-2021-4155
# This is a strange ioctl(XFS_IOC_ALLOCSP), which does

tkhai

/*
 * Kirill Tkhai <ktkhai@virtuozzo.com>
 *
 * License: GPL v2.
 */

#include <assert.h>
#include <stdlib.h>
#include <string.h>
#include <stdio.h>

tkhai

#include <unistd.h>
#include <fcntl.h>
#include <stdint.h>

main()
{
	int fd1 = open("test1.tmp", O_RDWR|O_TRUNC|O_CREAT);
	int fd2 = open("test2.tmp", O_RDWR|O_TRUNC|O_CREAT);
	char buf[1024*1024];

tkhai

#include <unistd.h>
#include <fcntl.h>
#include <stdint.h>

#define RWH_WRITE_LIFE_EXTREME  5
#define F_SET_FILE_RW_HINT      (F_LINUX_SPECIFIC_BASE + 14)
#define F_SET_RW_HINT           (F_LINUX_SPECIFIC_BASE + 12)
#define F_LINUX_SPECIFIC_BASE   1024

tkhai

#include <sys/types.h>
#include <sys/stat.h>
#include <stdint.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>

#define __u8 uint8_t
#define __u32 uint32_t
#define __u64 uint64_t

tkhai

#define _GNU_SOURCE
#include <sys/types.h>
#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>
#include <fcntl.h>
#include <errno.h>

#define BLOCK_SIZE 4096
#define STEP (BLOCK_SIZE * 16)

tkhai

#define _GNU_SOURCE
#include <linux/mman.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <signal.h>
#include <sched.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <fcntl.h>

tkhai

#define _GNU_SOURCE
#include <linux/mman.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <signal.h>
#include <sched.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <fcntl.h>

tkhai

#define _GNU_SOURCE
#include <linux/mman.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <signal.h>
#include <sched.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <fcntl.h>

tkhai

#define _GNU_SOURCE
#include <linux/mman.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <signal.h>
#include <sched.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <fcntl.h>