1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2017 Richard Palethorpe <rpalethorpe@suse.com>
4 */
5 /*
6 * CVE-2016-7117
7 *
8 * This tests for a use after free caused by a race between recvmmsg() and
9 * close(). The exit path for recvmmsg() in (a2e2725541f: net: Introduce
10 * recvmmsg socket syscall) called fput() on the active file descriptor before
11 * checking the error state and setting the socket's error field.
12 *
13 * If one or more messages are received by recvmmsg() followed by one which
14 * fails, the socket's error field will be set. If just after recvmmsg() calls
15 * fput(), a call to close() is made on the same file descriptor there is a
16 * race between close() releasing the socket object and recvmmsg() setting its
17 * error field.
18 *
19 * fput() does not release a file descriptor's resources (e.g. a socket)
20 * immediatly, it queues them to be released just before a system call returns
21 * to user land. So the close() system call must call fput() after it is
22 * called in recvmmsg(), exit and release the resources all before the socket
23 * error is set.
24 *
25 * Usually if the vulnerability is present the test will be killed with a
26 * kernel null pointer exception. However this is not guaranteed to happen
27 * every time.
28 *
29 * The following was used for reference
30 * https://blog.lizzie.io/notes-about-cve-2016-7117.html
31 */
32
33 #include "config.h"
34
35 #include <sys/wait.h>
36 #include <sys/types.h>
37 #include <sys/socket.h>
38 #include <sys/syscall.h>
39 #include <stdlib.h>
40 #include <errno.h>
41
42 #include "tst_test.h"
43 #include "tst_safe_net.h"
44 #include "tst_timer.h"
45 #include "tst_fuzzy_sync.h"
46
47 /* The bug was present in the kernel before recvmmsg was exposed by glibc */
48 #include "lapi/syscalls.h"
49 #include "lapi/socket.h"
50
51 #define MSG "abcdefghijklmnop"
52 #define RECV_TIMEOUT 1
53 #define ATTEMPTS 0x1FFFFF
54
55 static volatile int socket_fds[2];
56 static struct mmsghdr msghdrs[2] = {
57 {
58 .msg_hdr = {
59 .msg_iov = &(struct iovec) {
60 .iov_len = sizeof(MSG),
61 },
62 .msg_iovlen = 1
63 }
64 },
65 {
66 .msg_hdr = {
67 .msg_iov = &(struct iovec) {
68 .iov_base = (void *)(0xbadadd),
69 .iov_len = ~0,
70 },
71 .msg_iovlen = 1
72 }
73 }
74 };
75 static char rbuf[sizeof(MSG)];
76 static struct timespec timeout = { .tv_sec = RECV_TIMEOUT };
77 static struct tst_fzsync_pair fzsync_pair;
78 static void *send_and_close(void *);
79
setup(void)80 static void setup(void)
81 {
82 fzsync_pair.min_samples = 10000;
83
84 tst_syscall(__NR_recvmmsg, 0, 0, 0, 0, 0);
85
86 tst_fzsync_pair_init(&fzsync_pair);
87 }
88
cleanup(void)89 static void cleanup(void)
90 {
91 close(socket_fds[0]);
92 close(socket_fds[1]);
93
94 tst_fzsync_pair_cleanup(&fzsync_pair);
95 }
96
send_and_close(void * arg)97 static void *send_and_close(void *arg)
98 {
99 while (tst_fzsync_run_b(&fzsync_pair)) {
100
101 tst_fzsync_wait_b(&fzsync_pair);
102 send(socket_fds[0], MSG, sizeof(MSG), 0);
103 send(socket_fds[0], MSG, sizeof(MSG), 0);
104
105 close(socket_fds[0]);
106
107 tst_fzsync_start_race_b(&fzsync_pair);
108 close(socket_fds[1]);
109 tst_fzsync_end_race_b(&fzsync_pair);
110 }
111 return arg;
112 }
113
run(void)114 static void run(void)
115 {
116 int stat, too_early_count = 0;
117
118 msghdrs[0].msg_hdr.msg_iov->iov_base = (void *)&rbuf;
119
120 tst_fzsync_pair_reset(&fzsync_pair, send_and_close);
121 while (tst_fzsync_run_a(&fzsync_pair)) {
122
123 SAFE_SOCKETPAIR(AF_LOCAL, SOCK_DGRAM, 0, (int *)socket_fds);
124 tst_fzsync_wait_a(&fzsync_pair);
125
126 tst_fzsync_start_race_a(&fzsync_pair);
127 stat = tst_syscall(__NR_recvmmsg,
128 socket_fds[1], msghdrs, 2, 0, &timeout);
129 tst_fzsync_end_race_a(&fzsync_pair);
130
131 if (stat == 0)
132 tst_res(TWARN, "No messages received, should be one");
133 else if (stat < 0) {
134 if (errno != EBADF) {
135 tst_res(TWARN | TERRNO,
136 "recvmmsg failed unexpectedly");
137 } else {
138 tst_fzsync_pair_add_bias(&fzsync_pair, 1);
139 too_early_count++;
140 }
141 }
142 }
143
144 tst_res(TPASS, "Nothing bad happened, probably");
145 tst_res(TINFO, "Socket was closed too early %d times", too_early_count);
146 }
147
148 static struct tst_test test = {
149 .test_all = run,
150 .setup = setup,
151 .cleanup = cleanup,
152 .min_kver = "2.6.33",
153 .tags = (const struct tst_tag[]) {
154 {"linux-git", "a2e2725541fa"},
155 {"CVE", "2016-7117"},
156 {}
157 }
158 };
159