Commit 440c9d48 authored by Michal Luczaj's avatar Michal Luczaj Committed by Jakub Kicinski
Browse files

vsock/test: Add test for SO_LINGER null ptr deref 



Explicitly close() a TCP_ESTABLISHED (connectible) socket with SO_LINGER
enabled.

As for now, test does not verify if close() actually lingers.
On an unpatched machine, may trigger a null pointer dereference.

Tested-by: default avatarLuigi Leonardi <leonardi@redhat.com>
Reviewed-by: default avatarLuigi Leonardi <leonardi@redhat.com>
Reviewed-by: default avatarStefano Garzarella <sgarzare@redhat.com>
Signed-off-by: default avatarMichal Luczaj <mhal@rbox.co>
Link: https://patch.msgid.link/20250210-vsock-linger-nullderef-v3-2-ef6244d02b54@rbox.co


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 78dafe1c

tools/testing/vsock/vsock_test.c

+41 −0
Original line number Diff line number Diff line
@@ -1788,6 +1788,42 @@ static void test_stream_connect_retry_server(const struct test_opts *opts) 
	close(fd);

}



static void test_stream_linger_client(const struct test_opts *opts)

{

	struct linger optval = {

		.l_onoff = 1,

		.l_linger = 1

	};

	int fd;



	fd = vsock_stream_connect(opts->peer_cid, opts->peer_port);

	if (fd < 0) {

		perror("connect");

		exit(EXIT_FAILURE);

	}



	if (setsockopt(fd, SOL_SOCKET, SO_LINGER, &optval, sizeof(optval))) {

		perror("setsockopt(SO_LINGER)");

		exit(EXIT_FAILURE);

	}



	close(fd);

}



static void test_stream_linger_server(const struct test_opts *opts)

{

	int fd;



	fd = vsock_stream_accept(VMADDR_CID_ANY, opts->peer_port, NULL);

	if (fd < 0) {

		perror("accept");

		exit(EXIT_FAILURE);

	}



	vsock_wait_remote_close(fd);

	close(fd);

}



static struct test_case test_cases[] = {

	{

		.name = "SOCK_STREAM connection reset",
@@ -1943,6 +1979,11 @@ static struct test_case test_cases[] = { 
		.run_client = test_stream_connect_retry_client,

		.run_server = test_stream_connect_retry_server,

	},

	{

		.name = "SOCK_STREAM SO_LINGER null-ptr-deref",

		.run_client = test_stream_linger_client,

		.run_server = test_stream_linger_server,

	},

	{},

};