public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

vsock/test: Add test for null ptr deref when transport changes

Browse source 
Add a new test to ensure that when the transport changes a null pointer
dereference does not occur. The bug was reported upstream [1] and fixed
with commit 2cb7c756f6 ("vsock/virtio: discard packets if the
transport changes").

KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
CPU: 2 UID: 0 PID: 463 Comm: kworker/2:3 Not tainted
Workqueue: vsock-loopback vsock_loopback_work
RIP: 0010:vsock_stream_has_data+0x44/0x70
Call Trace:
 virtio_transport_do_close+0x68/0x1a0
 virtio_transport_recv_pkt+0x1045/0x2ae4
 vsock_loopback_work+0x27d/0x3f0
 process_one_work+0x846/0x1420
 worker_thread+0x5b3/0xf80
 kthread+0x35a/0x700
 ret_from_fork+0x2d/0x70
 ret_from_fork_asm+0x1a/0x30

Note that this test may not fail in a kernel without the fix, but it may
hang on the client side if it triggers a kernel oops.

This works by creating a socket, trying to connect to a server, and then
executing a second connect operation on the same socket but to a
different CID (0). This triggers a transport change. If the connect
operation is interrupted by a signal, this could cause a null-ptr-deref.

Since this bug is non-deterministic, we need to try several times. It
is reasonable to assume that the bug will show up within the timeout
period.

If there is a G2H transport loaded in the system, the bug is not
triggered and this test will always pass. This is because
`vsock_assign_transport`, when using CID 0, like in this case, sets
vsk->transport to `transport_g2h` that is not NULL if a G2H transport is
available.

[1]https://lore.kernel.org/netdev/Z2LvdTTQR7dBmPb5@v4bel-B760M-AORUS-ELITE-AX/

Suggested-by: Hyunwoo Kim <v4bel@theori.io>
Suggested-by: Michal Luczaj <mhal@rbox.co>
Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://patch.msgid.link/20250630-test_vsock-v5-2-2492e141e80b@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Luigi Leonardi 2025-06-30 18:33:04 +02:00 • committed by Jakub Kicinski
parent e84b20b25d
commit 3a764d9338
2 changed files with 171 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
tools/testing/vsock/Makefile
View file

@ -5,6 +5,7 @@ vsock_test: vsock_test.o vsock_test_zerocopy.o timeout.o control.o util.o msg_ze
vsock_diag_test: vsock_diag_test.o timeout.o control.o util.o
vsock_perf: vsock_perf.o msg_zerocopy_common.o
vsock_test: LDLIBS = -lpthread
vsock_uring_test: LDLIBS = -luring
vsock_uring_test: control.o util.o vsock_uring_test.o timeout.o msg_zerocopy_common.o

170
tools/testing/vsock/vsock_test.c
View file

@ -22,6 +22,8 @@
#include <signal.h>
#include <sys/ioctl.h>
#include <linux/time64.h>
#include <pthread.h>
#include <fcntl.h>
#include "vsock_test_zerocopy.h"
#include "timeout.h"
@ -1867,6 +1869,169 @@ static void test_stream_connect_retry_server(const struct test_opts *opts)
close(fd);
}
#define TRANSPORT_CHANGE_TIMEOUT 2 /* seconds */
static void *test_stream_transport_change_thread(void *vargp)
{
pid_t *pid = (pid_t *)vargp;
int ret;
ret = pthread_setcanceltype(PTHREAD_CANCEL_ASYNCHRONOUS, NULL);
if (ret) {
fprintf(stderr, "pthread_setcanceltype: %d\n", ret);
exit(EXIT_FAILURE);
}
while (true) {
if (kill(*pid, SIGUSR1) < 0) {
perror("kill");
exit(EXIT_FAILURE);
}
}
return NULL;
}
static void test_transport_change_signal_handler(int signal)
{
/* We need a custom handler for SIGUSR1 as the default one terminates the process. */
}
static void test_stream_transport_change_client(const struct test_opts *opts)
{
__sighandler_t old_handler;
pid_t pid = getpid();
pthread_t thread_id;
time_t tout;
int ret, tr;
tr = get_transports();
/* Print a warning if there is a G2H transport loaded.
* This is on a best effort basis because VMCI can be either G2H and H2G, and there is
* no easy way to understand it.
* The bug we are testing only appears when G2H transports are not loaded.
* This is because `vsock_assign_transport`, when using CID 0, assigns a G2H transport
* to vsk->transport. If none is available it is set to NULL, causing the null-ptr-deref.
*/
if (tr & TRANSPORTS_G2H)
fprintf(stderr, "G2H Transport detected. This test will not fail.\n");
old_handler = signal(SIGUSR1, test_transport_change_signal_handler);
if (old_handler == SIG_ERR) {
perror("signal");
exit(EXIT_FAILURE);
}
ret = pthread_create(&thread_id, NULL, test_stream_transport_change_thread, &pid);
if (ret) {
fprintf(stderr, "pthread_create: %d\n", ret);
exit(EXIT_FAILURE);
}
control_expectln("LISTENING");
tout = current_nsec() + TRANSPORT_CHANGE_TIMEOUT * NSEC_PER_SEC;
do {
struct sockaddr_vm sa = {
.svm_family = AF_VSOCK,
.svm_cid = opts->peer_cid,
.svm_port = opts->peer_port,
};
int s;
s = socket(AF_VSOCK, SOCK_STREAM, 0);
if (s < 0) {
perror("socket");
exit(EXIT_FAILURE);
}
ret = connect(s, (struct sockaddr *)&sa, sizeof(sa));
/* The connect can fail due to signals coming from the thread,
* or because the receiver connection queue is full.
* Ignoring also the latter case because there is no way
* of synchronizing client's connect and server's accept when
* connect(s) are constantly being interrupted by signals.
*/
if (ret == -1 && (errno != EINTR && errno != ECONNRESET)) {
perror("connect");
exit(EXIT_FAILURE);
}
/* Set CID to 0 cause a transport change. */
sa.svm_cid = 0;
/* Ignore return value since it can fail or not.
* If the previous connect is interrupted while the
* connection request is already sent, the second
* connect() will wait for the response.
*/
connect(s, (struct sockaddr *)&sa, sizeof(sa));
close(s);
control_writeulong(CONTROL_CONTINUE);
} while (current_nsec() < tout);
control_writeulong(CONTROL_DONE);
ret = pthread_cancel(thread_id);
if (ret) {
fprintf(stderr, "pthread_cancel: %d\n", ret);
exit(EXIT_FAILURE);
}
ret = pthread_join(thread_id, NULL);
if (ret) {
fprintf(stderr, "pthread_join: %d\n", ret);
exit(EXIT_FAILURE);
}
if (signal(SIGUSR1, old_handler) == SIG_ERR) {
perror("signal");
exit(EXIT_FAILURE);
}
}
static void test_stream_transport_change_server(const struct test_opts *opts)
{
int s = vsock_stream_listen(VMADDR_CID_ANY, opts->peer_port);
/* Set the socket to be nonblocking because connects that have been interrupted
* (EINTR) can fill the receiver's accept queue anyway, leading to connect failure.
* As of today (6.15) in such situation there is no way to understand, from the
* client side, if the connection has been queued in the server or not.
*/
if (fcntl(s, F_SETFL, fcntl(s, F_GETFL, 0) | O_NONBLOCK) < 0) {
perror("fcntl");
exit(EXIT_FAILURE);
}
control_writeln("LISTENING");
while (control_readulong() == CONTROL_CONTINUE) {
/* Must accept the connection, otherwise the `listen`
* queue will fill up and new connections will fail.
* There can be more than one queued connection,
* clear them all.
*/
while (true) {
int client = accept(s, NULL, NULL);
if (client < 0) {
if (errno == EAGAIN)
break;
perror("accept");
exit(EXIT_FAILURE);
}
close(client);
}
}
close(s);
}
static void test_stream_linger_client(const struct test_opts *opts)
{
int fd;
@ -2106,6 +2271,11 @@ static struct test_case test_cases[] = {
.run_client = test_stream_nolinger_client,
.run_server = test_stream_nolinger_server,
},
{
.name = "SOCK_STREAM transport change null-ptr-deref",
.run_client = test_stream_transport_change_client,
.run_server = test_stream_transport_change_server,
},
{},
};