1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2019 SUSE LLC
4 * Author: Christian Amann <camann@suse.com>
5 */
6 /*\
7 * [Description]
8 *
9 * Test for CVE-2017-8890
10 *
11 * In Kernels up to 4.10.15 missing commit 657831ff the multicast
12 * group information of a socket gets copied over to a newly created
13 * socket when using the accept() syscall. This will cause a double free
14 * when closing the original and the cloned socket.
15 *
16 * WARNING:
17 * There is a high chance that this test will cause an unstable system
18 * if it does not succeed!
19 *
20 * For more information about this CVE see:
21 * https://www.suse.com/security/cve/CVE-2017-8890/
22 */
23
24 #include <errno.h>
25 #include <sys/socket.h>
26 #include "tst_test.h"
27 #include "tst_safe_net.h"
28 #include "tst_safe_pthread.h"
29
30 #define MULTICASTIP "224.0.0.0"
31 #define LOCALHOSTIP "127.0.0.1"
32
33 static int server_sockfd;
34 static int clone_server_sockfd;
35 static int client_sockfd;
36 static int server_port;
37 static socklen_t addr_len;
38
39 static struct sockaddr_in *server_addr;
40 static struct sockaddr_in *client_addr;
41 static struct group_req *mc_group;
42
server_thread(void * arg)43 static void *server_thread(void *arg)
44 {
45 int op, op_len, mc_group_len;
46
47 op = 1;
48 op_len = sizeof(op);
49 mc_group_len = sizeof(*mc_group);
50
51 server_sockfd = SAFE_SOCKET(AF_INET, SOCK_STREAM, 0);
52
53 SAFE_SETSOCKOPT(server_sockfd, SOL_SOCKET, SO_REUSEADDR, &op, op_len);
54 SAFE_SETSOCKOPT(server_sockfd, SOL_IP, MCAST_JOIN_GROUP,
55 mc_group, mc_group_len);
56
57 SAFE_BIND(server_sockfd, (struct sockaddr *)server_addr, addr_len);
58 SAFE_LISTEN(server_sockfd, 1);
59
60 TST_CHECKPOINT_WAKE(0);
61
62 TEST(accept(server_sockfd, (struct sockaddr *)client_addr, &addr_len));
63 if (TST_RET == -1)
64 tst_brk(TBROK | TTERRNO, "Could not accept connection");
65
66 clone_server_sockfd = TST_RET;
67
68 TEST(setsockopt(clone_server_sockfd, SOL_IP, MCAST_LEAVE_GROUP,
69 mc_group, mc_group_len));
70
71 if (TST_RET != -1)
72 tst_res(TFAIL, "Multicast group was copied!");
73 else if (TST_ERR == EADDRNOTAVAIL)
74 tst_res(TPASS | TTERRNO, "Multicast group was not copied");
75 else
76 tst_brk(TBROK | TTERRNO, "setsockopt() failed unexpectedly");
77
78 SAFE_CLOSE(server_sockfd);
79 return arg;
80 }
81
client_thread(void * arg)82 static void *client_thread(void *arg)
83 {
84 client_sockfd = SAFE_SOCKET(AF_INET, SOCK_STREAM, 0);
85 SAFE_BIND(client_sockfd, (struct sockaddr *)client_addr, addr_len);
86
87 SAFE_CONNECT(client_sockfd, (struct sockaddr *)server_addr, addr_len);
88
89 SAFE_CLOSE(client_sockfd);
90 return arg;
91 }
92
run(void)93 static void run(void)
94 {
95 pthread_t server_thr, client_thr;
96
97 server_addr->sin_port = server_port;
98 client_addr->sin_port = htons(0);
99
100 SAFE_PTHREAD_CREATE(&server_thr, NULL, server_thread, NULL);
101 TST_CHECKPOINT_WAIT(0);
102 SAFE_PTHREAD_CREATE(&client_thr, NULL, client_thread, NULL);
103
104 SAFE_PTHREAD_JOIN(server_thr, NULL);
105 SAFE_PTHREAD_JOIN(client_thr, NULL);
106 }
107
setup(void)108 static void setup(void)
109 {
110 struct sockaddr_in *mc_group_addr;
111
112 server_addr = tst_alloc(sizeof(*server_addr));
113 client_addr = tst_alloc(sizeof(*client_addr));
114 mc_group = tst_alloc(sizeof(*mc_group));
115
116 mc_group->gr_interface = 0;
117 mc_group_addr = (struct sockaddr_in *) &mc_group->gr_group;
118 mc_group_addr->sin_family = AF_INET;
119 inet_aton(MULTICASTIP, &mc_group_addr->sin_addr);
120
121 server_addr->sin_family = AF_INET;
122 inet_aton(LOCALHOSTIP, &server_addr->sin_addr);
123
124 client_addr->sin_family = AF_INET;
125 client_addr->sin_addr.s_addr = htons(INADDR_ANY);
126
127 addr_len = sizeof(struct sockaddr_in);
128
129 server_port = TST_GET_UNUSED_PORT(AF_INET, SOCK_STREAM);
130 tst_res(TINFO, "Starting listener on port: %d", ntohs(server_port));
131 }
132
cleanup(void)133 static void cleanup(void)
134 {
135 if (clone_server_sockfd > 0)
136 SAFE_CLOSE(clone_server_sockfd);
137 if (client_sockfd > 0)
138 SAFE_CLOSE(client_sockfd);
139 if (server_sockfd > 0)
140 SAFE_CLOSE(server_sockfd);
141 }
142
143 static struct tst_test test = {
144 .test_all = run,
145 .setup = setup,
146 .cleanup = cleanup,
147 .needs_checkpoints = 1,
148 .tags = (const struct tst_tag[]) {
149 {"CVE", "2017-8890"},
150 {"linux-git", "657831ff"},
151 {},
152 }
153 };
154