vsock/test: Add test for UAF due to socket unbinding

Fail the autobind, then trigger a transport reassign. Socket might get
unbound from unbound_sockets, which then leads to a reference count
underflow.

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Michal Luczaj <mhal@rbox.co>
Link: https://patch.msgid.link/20250128-vsock-transport-vs-autobind-v3-5-1cf57065b770@rbox.co
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/tools/testing/vsock/vsock_test.c b/tools/testing/vsock/vsock_test.c
index daa4f3ca9b6e7267d1bb14a7d43499da3bafb108..92cfd92bbfdc2cca75dc1149bee7f354262ad2b1 100644 (file)
--- a/tools/testing/vsock/vsock_test.c
+++ b/tools/testing/vsock/vsock_test.c
@@ -1693,6 +1693,59 @@ static void test_stream_msgzcopy_leak_zcskb_server(const struct test_opts *opts)
        close(fd);
 }
 
+#define MAX_PORT_RETRIES       24      /* net/vmw_vsock/af_vsock.c */
+
+/* Test attempts to trigger a transport release for an unbound socket. This can
+ * lead to a reference count mishandling.
+ */
+static void test_stream_transport_uaf_client(const struct test_opts *opts)
+{
+       int sockets[MAX_PORT_RETRIES];
+       struct sockaddr_vm addr;
+       int fd, i, alen;
+
+       fd = vsock_bind(VMADDR_CID_ANY, VMADDR_PORT_ANY, SOCK_STREAM);
+
+       alen = sizeof(addr);
+       if (getsockname(fd, (struct sockaddr *)&addr, &alen)) {
+               perror("getsockname");
+               exit(EXIT_FAILURE);
+       }
+
+       for (i = 0; i < MAX_PORT_RETRIES; ++i)
+               sockets[i] = vsock_bind(VMADDR_CID_ANY, ++addr.svm_port,
+                                       SOCK_STREAM);
+
+       close(fd);
+       fd = socket(AF_VSOCK, SOCK_STREAM, 0);
+       if (fd < 0) {
+               perror("socket");
+               exit(EXIT_FAILURE);
+       }
+
+       if (!vsock_connect_fd(fd, addr.svm_cid, addr.svm_port)) {
+               perror("Unexpected connect() #1 success");
+               exit(EXIT_FAILURE);
+       }
+
+       /* Vulnerable system may crash now. */
+       if (!vsock_connect_fd(fd, VMADDR_CID_HOST, VMADDR_PORT_ANY)) {
+               perror("Unexpected connect() #2 success");
+               exit(EXIT_FAILURE);
+       }
+
+       close(fd);
+       while (i--)
+               close(sockets[i]);
+
+       control_writeln("DONE");
+}
+
+static void test_stream_transport_uaf_server(const struct test_opts *opts)
+{
+       control_expectln("DONE");
+}
+
 static struct test_case test_cases[] = {
        {
                .name = "SOCK_STREAM connection reset",
@@ -1838,6 +1891,11 @@ static struct test_case test_cases[] = {
                .run_client = test_stream_msgzcopy_leak_zcskb_client,
                .run_server = test_stream_msgzcopy_leak_zcskb_server,
        },
+       {
+               .name = "SOCK_STREAM transport release use-after-free",
+               .run_client = test_stream_transport_uaf_client,
+               .run_server = test_stream_transport_uaf_server,
+       },
        {},
 };