Commit 6e6c62be authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'vsock-transport-reassignment-and-error-handling-issues' 

Michal Luczaj says:

====================
vsock: Transport reassignment and error handling issues

Series deals with two issues:
- socket reference count imbalance due to an unforgiving transport release
  (triggered by transport reassignment);
- unintentional API feature, a failing connect() making the socket
  impossible to use for any subsequent connect() attempts.

v2: https://lore.kernel.org/20250121-vsock-transport-vs-autobind-v2-0-aad6069a4e8c@rbox.co
v1: https://lore.kernel.org/20250117-vsock-transport-vs-autobind-v1-0-c802c803762d@rbox.co
====================

Link: https://patch.msgid.link/20250128-vsock-transport-vs-autobind-v3-0-1cf57065b770@rbox.co


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 9e6c4e6b 4695f64e

net/vmw_vsock/af_vsock.c

+11 −2
Original line number Diff line number Diff line
@@ -337,7 +337,10 @@ EXPORT_SYMBOL_GPL(vsock_find_connected_socket); 


void vsock_remove_sock(struct vsock_sock *vsk)

{

	/* Transport reassignment must not remove the binding. */

	if (sock_flag(sk_vsock(vsk), SOCK_DEAD))

		vsock_remove_bound(vsk);



	vsock_remove_connected(vsk);

}

EXPORT_SYMBOL_GPL(vsock_remove_sock);
@@ -821,12 +824,13 @@ static void __vsock_release(struct sock *sk, int level) 
	 */

	lock_sock_nested(sk, level);



	sock_orphan(sk);



	if (vsk->transport)

		vsk->transport->release(vsk);

	else if (sock_type_connectible(sk->sk_type))

		vsock_remove_sock(vsk);



	sock_orphan(sk);

	sk->sk_shutdown = SHUTDOWN_MASK;



	skb_queue_purge(&sk->sk_receive_queue);
@@ -1519,6 +1523,11 @@ static int vsock_connect(struct socket *sock, struct sockaddr *addr, 
		if (err < 0)

			goto out;



		/* sk_err might have been set as a result of an earlier

		 * (failed) connect attempt.

		 */

		sk->sk_err = 0;



		/* Mark sock as connecting and set the error code to in

		 * progress in case this is a non-blocking connect.

		 */

tools/testing/vsock/util.c

+34 −54
Original line number Diff line number Diff line
@@ -96,41 +96,57 @@ void vsock_wait_remote_close(int fd) 
	close(epollfd);

}



/* Bind to <bind_port>, connect to <cid, port> and return the file descriptor. */

int vsock_bind_connect(unsigned int cid, unsigned int port, unsigned int bind_port, int type)

/* Create socket <type>, bind to <cid, port> and return the file descriptor. */

int vsock_bind(unsigned int cid, unsigned int port, int type)

{

	struct sockaddr_vm sa_client = {

		.svm_family = AF_VSOCK,

		.svm_cid = VMADDR_CID_ANY,

		.svm_port = bind_port,

	};

	struct sockaddr_vm sa_server = {

	struct sockaddr_vm sa = {

		.svm_family = AF_VSOCK,

		.svm_cid = cid,

		.svm_port = port,

	};

	int fd;



	int client_fd, ret;



	client_fd = socket(AF_VSOCK, type, 0);

	if (client_fd < 0) {

	fd = socket(AF_VSOCK, type, 0);

	if (fd < 0) {

		perror("socket");

		exit(EXIT_FAILURE);

	}



	if (bind(client_fd, (struct sockaddr *)&sa_client, sizeof(sa_client))) {

	if (bind(fd, (struct sockaddr *)&sa, sizeof(sa))) {

		perror("bind");

		exit(EXIT_FAILURE);

	}



	return fd;

}



int vsock_connect_fd(int fd, unsigned int cid, unsigned int port)

{

	struct sockaddr_vm sa = {

		.svm_family = AF_VSOCK,

		.svm_cid = cid,

		.svm_port = port,

	};

	int ret;



	timeout_begin(TIMEOUT);

	do {

		ret = connect(client_fd, (struct sockaddr *)&sa_server, sizeof(sa_server));

		ret = connect(fd, (struct sockaddr *)&sa, sizeof(sa));

		timeout_check("connect");

	} while (ret < 0 && errno == EINTR);

	timeout_end();



	if (ret < 0) {

	return ret;

}



/* Bind to <bind_port>, connect to <cid, port> and return the file descriptor. */

int vsock_bind_connect(unsigned int cid, unsigned int port, unsigned int bind_port, int type)

{

	int client_fd;



	client_fd = vsock_bind(VMADDR_CID_ANY, bind_port, type);



	if (vsock_connect_fd(client_fd, cid, port)) {

		perror("connect");

		exit(EXIT_FAILURE);

	}
@@ -141,17 +157,6 @@ int vsock_bind_connect(unsigned int cid, unsigned int port, unsigned int bind_po 
/* Connect to <cid, port> and return the file descriptor. */

int vsock_connect(unsigned int cid, unsigned int port, int type)

{

	union {

		struct sockaddr sa;

		struct sockaddr_vm svm;

	} addr = {

		.svm = {

			.svm_family = AF_VSOCK,

			.svm_port = port,

			.svm_cid = cid,

		},

	};

	int ret;

	int fd;



	control_expectln("LISTENING");
@@ -162,20 +167,14 @@ int vsock_connect(unsigned int cid, unsigned int port, int type) 
		exit(EXIT_FAILURE);

	}



	timeout_begin(TIMEOUT);

	do {

		ret = connect(fd, &addr.sa, sizeof(addr.svm));

		timeout_check("connect");

	} while (ret < 0 && errno == EINTR);

	timeout_end();



	if (ret < 0) {

	if (vsock_connect_fd(fd, cid, port)) {

		int old_errno = errno;



		close(fd);

		fd = -1;

		errno = old_errno;

	}



	return fd;

}
@@ -192,28 +191,9 @@ int vsock_seqpacket_connect(unsigned int cid, unsigned int port) 
/* Listen on <cid, port> and return the file descriptor. */

static int vsock_listen(unsigned int cid, unsigned int port, int type)

{

	union {

		struct sockaddr sa;

		struct sockaddr_vm svm;

	} addr = {

		.svm = {

			.svm_family = AF_VSOCK,

			.svm_port = port,

			.svm_cid = cid,

		},

	};

	int fd;



	fd = socket(AF_VSOCK, type, 0);

	if (fd < 0) {

		perror("socket");

		exit(EXIT_FAILURE);

	}



	if (bind(fd, &addr.sa, sizeof(addr.svm)) < 0) {

		perror("bind");

		exit(EXIT_FAILURE);

	}

	fd = vsock_bind(cid, port, type);



	if (listen(fd, 1) < 0) {

		perror("listen");

tools/testing/vsock/util.h

+2 −0
Original line number Diff line number Diff line
@@ -39,10 +39,12 @@ struct test_case { 
void init_signals(void);

unsigned int parse_cid(const char *str);

unsigned int parse_port(const char *str);

int vsock_connect_fd(int fd, unsigned int cid, unsigned int port);

int vsock_connect(unsigned int cid, unsigned int port, int type);

int vsock_accept(unsigned int cid, unsigned int port,

		 struct sockaddr_vm *clientaddrp, int type);

int vsock_stream_connect(unsigned int cid, unsigned int port);

int vsock_bind(unsigned int cid, unsigned int port, int type);

int vsock_bind_connect(unsigned int cid, unsigned int port,

		       unsigned int bind_port, int type);

int vsock_seqpacket_connect(unsigned int cid, unsigned int port);

tools/testing/vsock/vsock_test.c

+106 −16
Original line number Diff line number Diff line
@@ -113,24 +113,9 @@ static void test_stream_bind_only_client(const struct test_opts *opts) 


static void test_stream_bind_only_server(const struct test_opts *opts)

{

	union {

		struct sockaddr sa;

		struct sockaddr_vm svm;

	} addr = {

		.svm = {

			.svm_family = AF_VSOCK,

			.svm_port = opts->peer_port,

			.svm_cid = VMADDR_CID_ANY,

		},

	};

	int fd;



	fd = socket(AF_VSOCK, SOCK_STREAM, 0);



	if (bind(fd, &addr.sa, sizeof(addr.svm)) < 0) {

		perror("bind");

		exit(EXIT_FAILURE);

	}

	fd = vsock_bind(VMADDR_CID_ANY, opts->peer_port, SOCK_STREAM);



	/* Notify the client that the server is ready */

	control_writeln("BIND");
@@ -1708,6 +1693,101 @@ static void test_stream_msgzcopy_leak_zcskb_server(const struct test_opts *opts) 
	close(fd);

}



#define MAX_PORT_RETRIES	24	/* net/vmw_vsock/af_vsock.c */



/* Test attempts to trigger a transport release for an unbound socket. This can

 * lead to a reference count mishandling.

 */

static void test_stream_transport_uaf_client(const struct test_opts *opts)

{

	int sockets[MAX_PORT_RETRIES];

	struct sockaddr_vm addr;

	int fd, i, alen;



	fd = vsock_bind(VMADDR_CID_ANY, VMADDR_PORT_ANY, SOCK_STREAM);



	alen = sizeof(addr);

	if (getsockname(fd, (struct sockaddr *)&addr, &alen)) {

		perror("getsockname");

		exit(EXIT_FAILURE);

	}



	for (i = 0; i < MAX_PORT_RETRIES; ++i)

		sockets[i] = vsock_bind(VMADDR_CID_ANY, ++addr.svm_port,

					SOCK_STREAM);



	close(fd);

	fd = socket(AF_VSOCK, SOCK_STREAM, 0);

	if (fd < 0) {

		perror("socket");

		exit(EXIT_FAILURE);

	}



	if (!vsock_connect_fd(fd, addr.svm_cid, addr.svm_port)) {

		perror("Unexpected connect() #1 success");

		exit(EXIT_FAILURE);

	}



	/* Vulnerable system may crash now. */

	if (!vsock_connect_fd(fd, VMADDR_CID_HOST, VMADDR_PORT_ANY)) {

		perror("Unexpected connect() #2 success");

		exit(EXIT_FAILURE);

	}



	close(fd);

	while (i--)

		close(sockets[i]);



	control_writeln("DONE");

}



static void test_stream_transport_uaf_server(const struct test_opts *opts)

{

	control_expectln("DONE");

}



static void test_stream_connect_retry_client(const struct test_opts *opts)

{

	int fd;



	fd = socket(AF_VSOCK, SOCK_STREAM, 0);

	if (fd < 0) {

		perror("socket");

		exit(EXIT_FAILURE);

	}



	if (!vsock_connect_fd(fd, opts->peer_cid, opts->peer_port)) {

		fprintf(stderr, "Unexpected connect() #1 success\n");

		exit(EXIT_FAILURE);

	}



	control_writeln("LISTEN");

	control_expectln("LISTENING");



	if (vsock_connect_fd(fd, opts->peer_cid, opts->peer_port)) {

		perror("connect() #2");

		exit(EXIT_FAILURE);

	}



	close(fd);

}



static void test_stream_connect_retry_server(const struct test_opts *opts)

{

	int fd;



	control_expectln("LISTEN");



	fd = vsock_stream_accept(VMADDR_CID_ANY, opts->peer_port, NULL);

	if (fd < 0) {

		perror("accept");

		exit(EXIT_FAILURE);

	}



	vsock_wait_remote_close(fd);

	close(fd);

}



static struct test_case test_cases[] = {

	{

		.name = "SOCK_STREAM connection reset",
@@ -1853,6 +1933,16 @@ static struct test_case test_cases[] = { 
		.run_client = test_stream_msgzcopy_leak_zcskb_client,

		.run_server = test_stream_msgzcopy_leak_zcskb_server,

	},

	{

		.name = "SOCK_STREAM transport release use-after-free",

		.run_client = test_stream_transport_uaf_client,

		.run_server = test_stream_transport_uaf_server,

	},

	{

		.name = "SOCK_STREAM retry failed connect()",

		.run_client = test_stream_connect_retry_client,

		.run_server = test_stream_connect_retry_server,

	},

	{},

};