Commit 301a62df authored by Michal Luczaj's avatar Michal Luczaj Committed by Jakub Kicinski
Browse files

vsock/test: Add test for UAF due to socket unbinding 



Fail the autobind, then trigger a transport reassign. Socket might get
unbound from unbound_sockets, which then leads to a reference count
underflow.

Reviewed-by: default avatarStefano Garzarella <sgarzare@redhat.com>
Signed-off-by: default avatarMichal Luczaj <mhal@rbox.co>
Link: https://patch.msgid.link/20250128-vsock-transport-vs-autobind-v3-5-1cf57065b770@rbox.co


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent ac12b7e2

tools/testing/vsock/vsock_test.c

+58 −0
Original line number Diff line number Diff line
@@ -1693,6 +1693,59 @@ static void test_stream_msgzcopy_leak_zcskb_server(const struct test_opts *opts) 
	close(fd);

}



#define MAX_PORT_RETRIES	24	/* net/vmw_vsock/af_vsock.c */



/* Test attempts to trigger a transport release for an unbound socket. This can

 * lead to a reference count mishandling.

 */

static void test_stream_transport_uaf_client(const struct test_opts *opts)

{

	int sockets[MAX_PORT_RETRIES];

	struct sockaddr_vm addr;

	int fd, i, alen;



	fd = vsock_bind(VMADDR_CID_ANY, VMADDR_PORT_ANY, SOCK_STREAM);



	alen = sizeof(addr);

	if (getsockname(fd, (struct sockaddr *)&addr, &alen)) {

		perror("getsockname");

		exit(EXIT_FAILURE);

	}



	for (i = 0; i < MAX_PORT_RETRIES; ++i)

		sockets[i] = vsock_bind(VMADDR_CID_ANY, ++addr.svm_port,

					SOCK_STREAM);



	close(fd);

	fd = socket(AF_VSOCK, SOCK_STREAM, 0);

	if (fd < 0) {

		perror("socket");

		exit(EXIT_FAILURE);

	}



	if (!vsock_connect_fd(fd, addr.svm_cid, addr.svm_port)) {

		perror("Unexpected connect() #1 success");

		exit(EXIT_FAILURE);

	}



	/* Vulnerable system may crash now. */

	if (!vsock_connect_fd(fd, VMADDR_CID_HOST, VMADDR_PORT_ANY)) {

		perror("Unexpected connect() #2 success");

		exit(EXIT_FAILURE);

	}



	close(fd);

	while (i--)

		close(sockets[i]);



	control_writeln("DONE");

}



static void test_stream_transport_uaf_server(const struct test_opts *opts)

{

	control_expectln("DONE");

}



static struct test_case test_cases[] = {

	{

		.name = "SOCK_STREAM connection reset",
@@ -1838,6 +1891,11 @@ static struct test_case test_cases[] = { 
		.run_client = test_stream_msgzcopy_leak_zcskb_client,

		.run_server = test_stream_msgzcopy_leak_zcskb_server,

	},

	{

		.name = "SOCK_STREAM transport release use-after-free",

		.run_client = test_stream_transport_uaf_client,

		.run_server = test_stream_transport_uaf_server,

	},

	{},

};