@@ -1458,6 +1458,68 @@ static void test_stream_cred_upd_on_set_rcvlowat(const struct test_opts *opts)
test_stream_credit_update_test(opts, false);
}
+#define MAX_PORT_RETRIES 24 /* net/vmw_vsock/af_vsock.c */
+#define VMADDR_CID_NONEXISTING 42
+
+/* Test attempts to trigger a transport release for an unbound socket. This can
+ * lead to a reference count mishandling.
+ */
+static void test_seqpacket_transport_uaf_client(const struct test_opts *opts)
+{
+ int sockets[MAX_PORT_RETRIES];
+ struct sockaddr_vm addr;
+ int s, i, alen;
+
+ s = vsock_bind(VMADDR_CID_LOCAL, VMADDR_PORT_ANY, SOCK_SEQPACKET);
+
+ alen = sizeof(addr);
+ if (getsockname(s, (struct sockaddr *)&addr, &alen)) {
+ perror("getsockname");
+ exit(EXIT_FAILURE);
+ }
+
+ for (i = 0; i < MAX_PORT_RETRIES; ++i)
+ sockets[i] = vsock_bind(VMADDR_CID_ANY, ++addr.svm_port,
+ SOCK_SEQPACKET);
+
+ close(s);
+ s = socket(AF_VSOCK, SOCK_SEQPACKET, 0);
+ if (s < 0) {
+ perror("socket");
+ exit(EXIT_FAILURE);
+ }
+
+ if (!connect(s, (struct sockaddr *)&addr, alen)) {
+ fprintf(stderr, "Unexpected connect() #1 success\n");
+ exit(EXIT_FAILURE);
+ }
+ /* connect() #1 failed: transport set, sk in unbound list. */
+
+ addr.svm_cid = VMADDR_CID_NONEXISTING;
+ if (!connect(s, (struct sockaddr *)&addr, alen)) {
+ fprintf(stderr, "Unexpected connect() #2 success\n");
+ exit(EXIT_FAILURE);
+ }
+ /* connect() #2 failed: transport unset, sk ref dropped? */
+
+ addr.svm_cid = VMADDR_CID_LOCAL;
+ addr.svm_port = VMADDR_PORT_ANY;
+
+ /* Vulnerable system may crash now. */
+ bind(s, (struct sockaddr *)&addr, alen);
+
+ close(s);
+ while (i--)
+ close(sockets[i]);
+
+ control_writeln("DONE");
+}
+
+static void test_seqpacket_transport_uaf_server(const struct test_opts *opts)
+{
+ control_expectln("DONE");
+}
+
static struct test_case test_cases[] = {
{
.name = "SOCK_STREAM connection reset",
@@ -1588,6 +1650,11 @@ static struct test_case test_cases[] = {
.run_client = test_seqpacket_unsent_bytes_client,
.run_server = test_seqpacket_unsent_bytes_server,
},
+ {
+ .name = "connectible transport release use-after-free",
+ .run_client = test_seqpacket_transport_uaf_client,
+ .run_server = test_seqpacket_transport_uaf_server,
+ },
{},
};
Fail the autobind, then trigger a transport reassign. Socket might get unbound from unbound_sockets, which then leads to a reference count underflow. Signed-off-by: Michal Luczaj <mhal@rbox.co> --- tools/testing/vsock/vsock_test.c | 67 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+)