1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2019 SUSE LLC
4 * Author: Christian Amann <camann@suse.com>
5 */
6 /* Test for CVE-2017-8890
7 *
8 * In Kernels up to 4.10.15 missing commit 657831ff the multicast
9 * group information of a socket gets copied over to a newly created
10 * socket when using the accept() syscall. This will cause a double free
11 * when closing the original and the cloned socket.
12 *
13 * WARNING:
14 * There is a high chance that this test will cause an unstable system
15 * if it does not succeed!
16 *
17 * For more information about this CVE see:
18 * https://www.suse.com/security/cve/CVE-2017-8890/
19 */
20
21 #include <errno.h>
22 #include <sys/socket.h>
23 #include "tst_test.h"
24 #include "tst_safe_net.h"
25 #include "tst_safe_pthread.h"
26
27 #define MULTICASTIP "224.0.0.0"
28 #define LOCALHOSTIP "127.0.0.1"
29
30 static int server_sockfd;
31 static int clone_server_sockfd;
32 static int client_sockfd;
33 static int server_port;
34 static socklen_t addr_len;
35
36 static struct sockaddr_in *server_addr;
37 static struct sockaddr_in *client_addr;
38 static struct group_req *mc_group;
39
server_thread(void * arg)40 static void *server_thread(void *arg)
41 {
42 int op, op_len, mc_group_len;
43
44 op = 1;
45 op_len = sizeof(op);
46 mc_group_len = sizeof(*mc_group);
47
48 server_sockfd = SAFE_SOCKET(AF_INET, SOCK_STREAM, 0);
49
50 SAFE_SETSOCKOPT(server_sockfd, SOL_SOCKET, SO_REUSEADDR, &op, op_len);
51 SAFE_SETSOCKOPT(server_sockfd, SOL_IP, MCAST_JOIN_GROUP,
52 mc_group, mc_group_len);
53
54 SAFE_BIND(server_sockfd, (struct sockaddr *)server_addr, addr_len);
55 SAFE_LISTEN(server_sockfd, 1);
56
57 TST_CHECKPOINT_WAKE(0);
58
59 TEST(accept(server_sockfd, (struct sockaddr *)client_addr, &addr_len));
60 if (TST_RET == -1)
61 tst_brk(TBROK | TTERRNO, "Could not accept connection");
62
63 clone_server_sockfd = TST_RET;
64
65 TEST(setsockopt(clone_server_sockfd, SOL_IP, MCAST_LEAVE_GROUP,
66 mc_group, mc_group_len));
67
68 if (TST_RET != -1)
69 tst_res(TFAIL, "Multicast group was copied!");
70 else if (TST_ERR == EADDRNOTAVAIL)
71 tst_res(TPASS | TTERRNO, "Multicast group was not copied");
72 else
73 tst_brk(TBROK | TTERRNO, "setsockopt() failed unexpectedly");
74
75 SAFE_CLOSE(server_sockfd);
76 return arg;
77 }
78
client_thread(void * arg)79 static void *client_thread(void *arg)
80 {
81 client_sockfd = SAFE_SOCKET(AF_INET, SOCK_STREAM, 0);
82 SAFE_BIND(client_sockfd, (struct sockaddr *)client_addr, addr_len);
83
84 SAFE_CONNECT(client_sockfd, (struct sockaddr *)server_addr, addr_len);
85
86 SAFE_CLOSE(client_sockfd);
87 return arg;
88 }
89
run(void)90 static void run(void)
91 {
92 pthread_t server_thr, client_thr;
93
94 server_addr->sin_port = server_port;
95 client_addr->sin_port = htons(0);
96
97 SAFE_PTHREAD_CREATE(&server_thr, NULL, server_thread, NULL);
98 TST_CHECKPOINT_WAIT(0);
99 SAFE_PTHREAD_CREATE(&client_thr, NULL, client_thread, NULL);
100
101 SAFE_PTHREAD_JOIN(server_thr, NULL);
102 SAFE_PTHREAD_JOIN(client_thr, NULL);
103 }
104
setup(void)105 static void setup(void)
106 {
107 struct sockaddr_in *mc_group_addr;
108
109 server_addr = tst_alloc(sizeof(*server_addr));
110 client_addr = tst_alloc(sizeof(*client_addr));
111 mc_group = tst_alloc(sizeof(*mc_group));
112
113 mc_group->gr_interface = 0;
114 mc_group_addr = (struct sockaddr_in *) &mc_group->gr_group;
115 mc_group_addr->sin_family = AF_INET;
116 inet_aton(MULTICASTIP, &mc_group_addr->sin_addr);
117
118 server_addr->sin_family = AF_INET;
119 inet_aton(LOCALHOSTIP, &server_addr->sin_addr);
120
121 client_addr->sin_family = AF_INET;
122 client_addr->sin_addr.s_addr = htons(INADDR_ANY);
123
124 addr_len = sizeof(struct sockaddr_in);
125
126 server_port = TST_GET_UNUSED_PORT(AF_INET, SOCK_STREAM);
127 tst_res(TINFO, "Starting listener on port: %d", ntohs(server_port));
128 }
129
cleanup(void)130 static void cleanup(void)
131 {
132 if (clone_server_sockfd > 0)
133 SAFE_CLOSE(clone_server_sockfd);
134 if (client_sockfd > 0)
135 SAFE_CLOSE(client_sockfd);
136 if (server_sockfd > 0)
137 SAFE_CLOSE(server_sockfd);
138 }
139
140 static struct tst_test test = {
141 .test_all = run,
142 .setup = setup,
143 .cleanup = cleanup,
144 .needs_checkpoints = 1,
145 .tags = (const struct tst_tag[]) {
146 {"CVE", "2017-8890"},
147 {"linux-git", "657831ff"},
148 {},
149 }
150 };
151