1 /* 2 * Copyright (c) 2017 Richard Palethorpe <rpalethorpe (at) suse.com> 3 * Original POC by Daniel Jiang 4 * 5 * This program is free software: you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License as published by 7 * the Free Software Foundation, either version 2 of the License, or 8 * (at your option) any later version. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License 16 * along with this program. If not, see <http://www.gnu.org/licenses/>. 17 */ 18 /* 19 * Test for CVE-2017-2671 faulty locking on ping socket 20 * 21 * When sys_connect() is called with sockaddr.sin_family set to AF_UNSPEC on a 22 * ping socket; __udp_disconnect() gets called, which in turn calls the buggy 23 * function ping_unhashed(). This function does not obtain a rwlock before 24 * checking if the socket is hashed allowing the socket data to be pulled from 25 * underneath it in the time between calling sk_hashed() and gaining the write 26 * lock. 27 * 28 * Fixed in commit 43a6684519ab0a6c52024b5e25322476cabad893 29 * 30 * This test repeatedly 'connects' a ping socket correctly then calls 31 * connect() with AF_UNSPEC in two seperate threads to trigger the race 32 * condition. If the bug is present, then the test will most likely crash the 33 * system. 34 * 35 * The test requests root privileges so that it can ensure ping sockets are 36 * enabled. On distributions (including Android) where ping sockets are 37 * enabled by default, root privileges are not required. 38 */ 39 40 #include <unistd.h> 41 #include <stdio.h> 42 #include <sys/socket.h> 43 #include <arpa/inet.h> 44 #include <stdlib.h> 45 46 #include "tst_test.h" 47 #include "tst_safe_net.h" 48 #include "tst_safe_pthread.h" 49 50 #include "tst_fuzzy_sync.h" 51 52 #define ATTEMPTS 0x80000 53 #define PING_SYSCTL_PATH "/proc/sys/net/ipv4/ping_group_range" 54 55 static int sockfd; 56 static unsigned int ping_min_grp, ping_max_grp; 57 static struct tst_fzsync_pair fzsync_pair; 58 static struct sockaddr_in iaddr, uaddr; 59 static void *connect_b(void *); 60 61 static void setup(void) 62 { 63 iaddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); 64 uaddr = iaddr; 65 iaddr.sin_family = AF_INET; 66 uaddr.sin_family = AF_UNSPEC; 67 68 if (access(PING_SYSCTL_PATH, F_OK)) 69 tst_brk(TCONF, "socket() does not support IPPROTO_ICMP"); 70 71 SAFE_FILE_SCANF(PING_SYSCTL_PATH, "%u %u", 72 &ping_min_grp, &ping_max_grp); 73 SAFE_FILE_PRINTF(PING_SYSCTL_PATH, "0 0"); 74 75 sockfd = SAFE_SOCKET(AF_INET, SOCK_DGRAM, IPPROTO_ICMP); 76 tst_res(TINFO, "Created ping socket, attempting to race..."); 77 78 tst_fzsync_pair_init(&fzsync_pair); 79 } 80 81 static void cleanup(void) 82 { 83 tst_fzsync_pair_cleanup(&fzsync_pair); 84 85 if (sockfd > 0) 86 SAFE_CLOSE(sockfd); 87 88 if (ping_min_grp | ping_max_grp) 89 SAFE_FILE_PRINTF(PING_SYSCTL_PATH, "%u %u", 90 ping_min_grp, ping_max_grp); 91 } 92 93 static void *connect_b(void * param LTP_ATTRIBUTE_UNUSED) 94 { 95 while (tst_fzsync_run_b(&fzsync_pair)) { 96 tst_fzsync_start_race_b(&fzsync_pair); 97 connect(sockfd, (struct sockaddr *)&uaddr, sizeof(uaddr)); 98 tst_fzsync_end_race_b(&fzsync_pair); 99 } 100 101 return 0; 102 } 103 104 static void run(void) 105 { 106 tst_fzsync_pair_reset(&fzsync_pair, connect_b); 107 while (tst_fzsync_run_a(&fzsync_pair)) { 108 SAFE_CONNECT(sockfd, 109 (struct sockaddr *)&iaddr, sizeof(iaddr)); 110 111 tst_fzsync_start_race_a(&fzsync_pair); 112 connect(sockfd, (struct sockaddr *)&uaddr, sizeof(uaddr)); 113 tst_fzsync_end_race_a(&fzsync_pair); 114 } 115 116 tst_res(TPASS, "We didn't crash"); 117 } 118 119 static struct tst_test test = { 120 .setup = setup, 121 .test_all = run, 122 .cleanup = cleanup, 123 .needs_root = 1, 124 }; 125
