1 /*
2 * Copyright (c) 2017 Richard Palethorpe <rpalethorpe@suse.com>
3 * Original POC by Daniel Jiang
4 *
5 * This program is free software: you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation, either version 2 of the License, or
8 * (at your option) any later version.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License
16 * along with this program. If not, see <http://www.gnu.org/licenses/>.
17 */
18 /*
19 * Test for CVE-2017-2671 faulty locking on ping socket
20 *
21 * When sys_connect() is called with sockaddr.sin_family set to AF_UNSPEC on a
22 * ping socket; __udp_disconnect() gets called, which in turn calls the buggy
23 * function ping_unhashed(). This function does not obtain a rwlock before
24 * checking if the socket is hashed allowing the socket data to be pulled from
25 * underneath it in the time between calling sk_hashed() and gaining the write
26 * lock.
27 *
28 * Fixed in commit 43a6684519ab0a6c52024b5e25322476cabad893
29 *
30 * This test repeatedly 'connects' a ping socket correctly then calls
31 * connect() with AF_UNSPEC in two seperate threads to trigger the race
32 * condition. If the bug is present, then the test will most likely crash the
33 * system.
34 *
35 * The test requests root privileges so that it can ensure ping sockets are
36 * enabled. On distributions (including Android) where ping sockets are
37 * enabled by default, root privileges are not required.
38 */
39
40 #include <unistd.h>
41 #include <stdio.h>
42 #include <sys/socket.h>
43 #include <arpa/inet.h>
44 #include <stdlib.h>
45
46 #include "tst_test.h"
47 #include "tst_safe_net.h"
48 #include "tst_safe_pthread.h"
49
50 #include "tst_fuzzy_sync.h"
51
52 #define ATTEMPTS 0x80000
53 #define PING_SYSCTL_PATH "/proc/sys/net/ipv4/ping_group_range"
54
55 static int sockfd;
56 static unsigned int ping_min_grp, ping_max_grp;
57 static struct tst_fzsync_pair fzsync_pair;
58 static struct sockaddr_in iaddr, uaddr;
59 static void *connect_b(void *);
60
setup(void)61 static void setup(void)
62 {
63 iaddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
64 uaddr = iaddr;
65 iaddr.sin_family = AF_INET;
66 uaddr.sin_family = AF_UNSPEC;
67
68 if (access(PING_SYSCTL_PATH, F_OK))
69 tst_brk(TCONF, "socket() does not support IPPROTO_ICMP");
70
71 SAFE_FILE_SCANF(PING_SYSCTL_PATH, "%u %u",
72 &ping_min_grp, &ping_max_grp);
73 SAFE_FILE_PRINTF(PING_SYSCTL_PATH, "0 0");
74
75 sockfd = SAFE_SOCKET(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
76 tst_res(TINFO, "Created ping socket, attempting to race...");
77
78 tst_fzsync_pair_init(&fzsync_pair);
79 }
80
cleanup(void)81 static void cleanup(void)
82 {
83 tst_fzsync_pair_cleanup(&fzsync_pair);
84
85 if (sockfd > 0)
86 SAFE_CLOSE(sockfd);
87
88 if (ping_min_grp | ping_max_grp)
89 SAFE_FILE_PRINTF(PING_SYSCTL_PATH, "%u %u",
90 ping_min_grp, ping_max_grp);
91 }
92
connect_b(void * param LTP_ATTRIBUTE_UNUSED)93 static void *connect_b(void * param LTP_ATTRIBUTE_UNUSED)
94 {
95 while (tst_fzsync_run_b(&fzsync_pair)) {
96 tst_fzsync_start_race_b(&fzsync_pair);
97 connect(sockfd, (struct sockaddr *)&uaddr, sizeof(uaddr));
98 tst_fzsync_end_race_b(&fzsync_pair);
99 }
100
101 return 0;
102 }
103
run(void)104 static void run(void)
105 {
106 tst_fzsync_pair_reset(&fzsync_pair, connect_b);
107 while (tst_fzsync_run_a(&fzsync_pair)) {
108 SAFE_CONNECT(sockfd,
109 (struct sockaddr *)&iaddr, sizeof(iaddr));
110
111 tst_fzsync_start_race_a(&fzsync_pair);
112 connect(sockfd, (struct sockaddr *)&uaddr, sizeof(uaddr));
113 tst_fzsync_end_race_a(&fzsync_pair);
114 }
115
116 tst_res(TPASS, "We didn't crash");
117 }
118
119 static struct tst_test test = {
120 .setup = setup,
121 .test_all = run,
122 .cleanup = cleanup,
123 .needs_root = 1,
124 };
125