1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2017 Richard Palethorpe <rpalethorpe@suse.com>
4 * Original POC by Daniel Jiang
5 */
6
7 /*\
8 * [Description]
9 *
10 * Test for CVE-2017-2671 faulty locking on ping socket fixed in kernel v4.11:
11 * 43a6684519ab ("ping: implement proper locking").
12 *
13 * When sys_connect() is called with sockaddr.sin_family set to AF_UNSPEC on a
14 * ping socket; __udp_disconnect() gets called, which in turn calls the buggy
15 * function ping_unhashed(). This function does not obtain a rwlock before
16 * checking if the socket is hashed allowing the socket data to be pulled from
17 * underneath it in the time between calling sk_hashed() and gaining the write
18 * lock.
19 *
20 * This test repeatedly 'connects' a ping socket correctly then calls
21 * connect() with AF_UNSPEC in two seperate threads to trigger the race
22 * condition. If the bug is present, then the test will most likely crash the
23 * system.
24 *
25 * The test requests root privileges so that it can ensure ping sockets are
26 * enabled. On distributions (including Android) where ping sockets are
27 * enabled by default, root privileges are not required.
28 */
29
30 #include <unistd.h>
31 #include <stdio.h>
32 #include <sys/socket.h>
33 #include <arpa/inet.h>
34 #include <stdlib.h>
35
36 #include "tst_test.h"
37 #include "tst_safe_net.h"
38 #include "tst_safe_pthread.h"
39
40 #include "tst_fuzzy_sync.h"
41
42 #define ATTEMPTS 0x80000
43 #define PING_SYSCTL_PATH "/proc/sys/net/ipv4/ping_group_range"
44
45 static int sockfd;
46 static unsigned int ping_min_grp, ping_max_grp;
47 static struct tst_fzsync_pair fzsync_pair;
48 static struct sockaddr_in iaddr, uaddr;
49 static void *connect_b(void *);
50
setup(void)51 static void setup(void)
52 {
53 iaddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
54 uaddr = iaddr;
55 iaddr.sin_family = AF_INET;
56 uaddr.sin_family = AF_UNSPEC;
57
58 if (access(PING_SYSCTL_PATH, F_OK))
59 tst_brk(TCONF, "socket() does not support IPPROTO_ICMP");
60
61 SAFE_FILE_SCANF(PING_SYSCTL_PATH, "%u %u",
62 &ping_min_grp, &ping_max_grp);
63 SAFE_FILE_PRINTF(PING_SYSCTL_PATH, "0 0");
64
65 sockfd = SAFE_SOCKET(AF_INET, SOCK_DGRAM, IPPROTO_ICMP);
66 tst_res(TINFO, "Created ping socket, attempting to race...");
67
68 tst_fzsync_pair_init(&fzsync_pair);
69 }
70
cleanup(void)71 static void cleanup(void)
72 {
73 tst_fzsync_pair_cleanup(&fzsync_pair);
74
75 if (sockfd > 0)
76 SAFE_CLOSE(sockfd);
77
78 if (ping_min_grp | ping_max_grp)
79 SAFE_FILE_PRINTF(PING_SYSCTL_PATH, "%u %u",
80 ping_min_grp, ping_max_grp);
81 }
82
connect_b(void * param LTP_ATTRIBUTE_UNUSED)83 static void *connect_b(void * param LTP_ATTRIBUTE_UNUSED)
84 {
85 while (tst_fzsync_run_b(&fzsync_pair)) {
86 tst_fzsync_start_race_b(&fzsync_pair);
87 connect(sockfd, (struct sockaddr *)&uaddr, sizeof(uaddr));
88 tst_fzsync_end_race_b(&fzsync_pair);
89 }
90
91 return 0;
92 }
93
run(void)94 static void run(void)
95 {
96 tst_fzsync_pair_reset(&fzsync_pair, connect_b);
97 while (tst_fzsync_run_a(&fzsync_pair)) {
98 SAFE_CONNECT(sockfd,
99 (struct sockaddr *)&iaddr, sizeof(iaddr));
100
101 tst_fzsync_start_race_a(&fzsync_pair);
102 connect(sockfd, (struct sockaddr *)&uaddr, sizeof(uaddr));
103 tst_fzsync_end_race_a(&fzsync_pair);
104 }
105
106 tst_res(TPASS, "We didn't crash");
107 }
108
109 static struct tst_test test = {
110 .setup = setup,
111 .test_all = run,
112 .cleanup = cleanup,
113 .needs_root = 1,
114 .runtime = 40,
115 .tags = (const struct tst_tag[]) {
116 {"linux-git", "43a6684519ab"},
117 {"CVE", "2017-2671"},
118 {}
119 }
120 };
121