Proxmox-Port/linux-loongson
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson synced 2025-08-28 09:22:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

vsock/test: Add test for UAF due to socket unbinding

Browse Source 
Fail the autobind, then trigger a transport reassign. Socket might get
unbound from unbound_sockets, which then leads to a reference count
underflow.

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Michal Luczaj <mhal@rbox.co>
Link: https://patch.msgid.link/20250128-vsock-transport-vs-autobind-v3-5-1cf57065b770@rbox.co
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Michal Luczaj 2025-01-28 14:15:31 +01:00 committed by Jakub Kicinski
parent ac12b7e291
commit 301a62dfb0
1 changed files with 58 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
tools/testing/vsock/vsock_test.c
View File

@ -1693,6 +1693,59 @@ static void test_stream_msgzcopy_leak_zcskb_server(const struct test_opts *opts)
close(fd);
}
#define MAX_PORT_RETRIES 24 /* net/vmw_vsock/af_vsock.c */
/* Test attempts to trigger a transport release for an unbound socket. This can
* lead to a reference count mishandling.
*/
static void test_stream_transport_uaf_client(const struct test_opts *opts)
{
int sockets[MAX_PORT_RETRIES];
struct sockaddr_vm addr;
int fd, i, alen;
fd = vsock_bind(VMADDR_CID_ANY, VMADDR_PORT_ANY, SOCK_STREAM);
alen = sizeof(addr);
if (getsockname(fd, (struct sockaddr *)&addr, &alen)) {
perror("getsockname");
exit(EXIT_FAILURE);
}
for (i = 0; i < MAX_PORT_RETRIES; ++i)
sockets[i] = vsock_bind(VMADDR_CID_ANY, ++addr.svm_port,
SOCK_STREAM);
close(fd);
fd = socket(AF_VSOCK, SOCK_STREAM, 0);
if (fd < 0) {
perror("socket");
exit(EXIT_FAILURE);
}
if (!vsock_connect_fd(fd, addr.svm_cid, addr.svm_port)) {
perror("Unexpected connect() #1 success");
exit(EXIT_FAILURE);
}
/* Vulnerable system may crash now. */
if (!vsock_connect_fd(fd, VMADDR_CID_HOST, VMADDR_PORT_ANY)) {
perror("Unexpected connect() #2 success");
exit(EXIT_FAILURE);
}
close(fd);
while (i--)
close(sockets[i]);
control_writeln("DONE");
}
static void test_stream_transport_uaf_server(const struct test_opts *opts)
{
control_expectln("DONE");
}
static struct test_case test_cases[] = {
{
.name = "SOCK_STREAM connection reset",
@ -1838,6 +1891,11 @@ static struct test_case test_cases[] = {
.run_client = test_stream_msgzcopy_leak_zcskb_client,
.run_server = test_stream_msgzcopy_leak_zcskb_server,
},
{
.name = "SOCK_STREAM transport release use-after-free",
.run_client = test_stream_transport_uaf_client,
.run_server = test_stream_transport_uaf_server,
},
{},
};