1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2019 SUSE LLC
4 * Author: Christian Amann <[email protected]>
5 */
6 /*\
7 * [Description]
8 *
9 * Test for CVE-2017-8890
10 *
11 * In Kernels up to 4.10.15 missing commit 657831ff the multicast
12 * group information of a socket gets copied over to a newly created
13 * socket when using the accept() syscall. This will cause a double free
14 * when closing the original and the cloned socket.
15 *
16 * WARNING:
17 * There is a high chance that this test will cause an unstable system
18 * if it does not succeed!
19 *
20 * For more information about this CVE see:
21 * https://www.suse.com/security/cve/CVE-2017-8890/
22 */
23
24 #include <errno.h>
25 #include <sys/socket.h>
26 #include "tst_test.h"
27 #include "tst_safe_net.h"
28 #include "tst_safe_pthread.h"
29
30 #define MULTICASTIP "224.0.0.0"
31 #define LOCALHOSTIP "127.0.0.1"
32
33 static int server_sockfd;
34 static int clone_server_sockfd;
35 static int client_sockfd;
36 static int server_port;
37 static socklen_t addr_len;
38
39 static struct sockaddr_in *server_addr;
40 static struct sockaddr_in *client_addr;
41 static struct group_req *mc_group;
42
server_thread(void * arg)43 static void *server_thread(void *arg)
44 {
45 int op, op_len, mc_group_len;
46
47 op = 1;
48 op_len = sizeof(op);
49 mc_group_len = sizeof(*mc_group);
50
51 server_sockfd = SAFE_SOCKET(AF_INET, SOCK_STREAM, 0);
52
53 SAFE_SETSOCKOPT(server_sockfd, SOL_SOCKET, SO_REUSEADDR, &op, op_len);
54 SAFE_SETSOCKOPT(server_sockfd, SOL_IP, MCAST_JOIN_GROUP,
55 mc_group, mc_group_len);
56
57 SAFE_BIND(server_sockfd, (struct sockaddr *)server_addr, addr_len);
58 SAFE_LISTEN(server_sockfd, 1);
59
60 TST_CHECKPOINT_WAKE(0);
61
62 TEST(accept(server_sockfd, (struct sockaddr *)client_addr, &addr_len));
63 if (TST_RET == -1)
64 tst_brk(TBROK | TTERRNO, "Could not accept connection");
65
66 clone_server_sockfd = TST_RET;
67
68 TEST(setsockopt(clone_server_sockfd, SOL_IP, MCAST_LEAVE_GROUP,
69 mc_group, mc_group_len));
70 SAFE_CLOSE(clone_server_sockfd);
71
72 if (TST_RET != -1)
73 tst_res(TFAIL, "Multicast group was copied!");
74 else if (TST_ERR == EADDRNOTAVAIL)
75 tst_res(TPASS | TTERRNO, "Multicast group was not copied");
76 else
77 tst_brk(TBROK | TTERRNO, "setsockopt() failed unexpectedly");
78
79 SAFE_CLOSE(server_sockfd);
80 return arg;
81 }
82
client_thread(void * arg)83 static void *client_thread(void *arg)
84 {
85 client_sockfd = SAFE_SOCKET(AF_INET, SOCK_STREAM, 0);
86 SAFE_BIND(client_sockfd, (struct sockaddr *)client_addr, addr_len);
87
88 SAFE_CONNECT(client_sockfd, (struct sockaddr *)server_addr, addr_len);
89
90 SAFE_CLOSE(client_sockfd);
91 return arg;
92 }
93
run(void)94 static void run(void)
95 {
96 pthread_t server_thr, client_thr;
97
98 server_addr->sin_port = server_port;
99 client_addr->sin_port = htons(0);
100
101 SAFE_PTHREAD_CREATE(&server_thr, NULL, server_thread, NULL);
102 TST_CHECKPOINT_WAIT(0);
103 SAFE_PTHREAD_CREATE(&client_thr, NULL, client_thread, NULL);
104
105 SAFE_PTHREAD_JOIN(server_thr, NULL);
106 SAFE_PTHREAD_JOIN(client_thr, NULL);
107 }
108
setup(void)109 static void setup(void)
110 {
111 struct sockaddr_in *mc_group_addr;
112
113 server_addr = tst_alloc(sizeof(*server_addr));
114 client_addr = tst_alloc(sizeof(*client_addr));
115 mc_group = tst_alloc(sizeof(*mc_group));
116
117 mc_group->gr_interface = 0;
118 mc_group_addr = (struct sockaddr_in *) &mc_group->gr_group;
119 mc_group_addr->sin_family = AF_INET;
120 inet_aton(MULTICASTIP, &mc_group_addr->sin_addr);
121
122 server_addr->sin_family = AF_INET;
123 inet_aton(LOCALHOSTIP, &server_addr->sin_addr);
124
125 client_addr->sin_family = AF_INET;
126 client_addr->sin_addr.s_addr = htons(INADDR_ANY);
127
128 addr_len = sizeof(struct sockaddr_in);
129
130 server_port = TST_GET_UNUSED_PORT(AF_INET, SOCK_STREAM);
131 tst_res(TINFO, "Starting listener on port: %d", ntohs(server_port));
132 }
133
cleanup(void)134 static void cleanup(void)
135 {
136 if (clone_server_sockfd > 0)
137 SAFE_CLOSE(clone_server_sockfd);
138 if (client_sockfd > 0)
139 SAFE_CLOSE(client_sockfd);
140 if (server_sockfd > 0)
141 SAFE_CLOSE(server_sockfd);
142 }
143
144 static struct tst_test test = {
145 .test_all = run,
146 .setup = setup,
147 .cleanup = cleanup,
148 .needs_checkpoints = 1,
149 .tags = (const struct tst_tag[]) {
150 {"CVE", "2017-8890"},
151 {"linux-git", "657831ff"},
152 {},
153 }
154 };
155