linux-kernel - Re: [RFC PATCH v3 4/4] test/vsock: copy to user failure test

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230309163034.bznx6pywv5a45egw@sgarzare-redhat>
Date:   Thu, 9 Mar 2023 17:30:34 +0100
From:   Stefano Garzarella <sgarzare@...hat.com>
To:     Arseniy Krasnov <avkrasnov@...rdevices.ru>
Cc:     Stefan Hajnoczi <stefanha@...hat.com>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Bobby Eshleman <bobby.eshleman@...edance.com>,
        kvm@...r.kernel.org, virtualization@...ts.linux-foundation.org,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        kernel@...rdevices.ru, oxffffaa@...il.com
Subject: Re: [RFC PATCH v3 4/4] test/vsock: copy to user failure test

On Thu, Mar 09, 2023 at 01:14:48PM +0300, Arseniy Krasnov wrote:
>This adds SOCK_STREAM and SOCK_SEQPACKET tests for invalid buffer case.
>It tries to read data to NULL buffer (data already presents in socket's
>queue), then uses valid buffer. For SOCK_STREAM second read must return
>data, because skbuff is not dropped, but for SOCK_SEQPACKET skbuff will
>be dropped by kernel, and 'recv()' will return EAGAIN.
>
>Signed-off-by: Arseniy Krasnov <AVKrasnov@...rdevices.ru>
>---
> tools/testing/vsock/vsock_test.c | 118 +++++++++++++++++++++++++++++++
> 1 file changed, 118 insertions(+)

Reviewed-by: Stefano Garzarella <sgarzare@...hat.com>

>
>diff --git a/tools/testing/vsock/vsock_test.c b/tools/testing/vsock/vsock_test.c
>index 67e9f9df3a8c..3de10dbb50f5 100644
>--- a/tools/testing/vsock/vsock_test.c
>+++ b/tools/testing/vsock/vsock_test.c
>@@ -860,6 +860,114 @@ static void test_stream_poll_rcvlowat_client(const struct test_opts *opts)
> 	close(fd);
> }
>
>+#define INV_BUF_TEST_DATA_LEN 512
>+
>+static void test_inv_buf_client(const struct test_opts *opts, bool stream)
>+{
>+	unsigned char data[INV_BUF_TEST_DATA_LEN] = {0};
>+	ssize_t ret;
>+	int fd;
>+
>+	if (stream)
>+		fd = vsock_stream_connect(opts->peer_cid, 1234);
>+	else
>+		fd = vsock_seqpacket_connect(opts->peer_cid, 1234);
>+
>+	if (fd < 0) {
>+		perror("connect");
>+		exit(EXIT_FAILURE);
>+	}
>+
>+	control_expectln("SENDDONE");
>+
>+	/* Use invalid buffer here. */
>+	ret = recv(fd, NULL, sizeof(data), 0);
>+	if (ret != -1) {
>+		fprintf(stderr, "expected recv(2) failure, got %zi\n", ret);
>+		exit(EXIT_FAILURE);
>+	}
>+
>+	if (errno != ENOMEM) {
>+		fprintf(stderr, "unexpected recv(2) errno %d\n", errno);
>+		exit(EXIT_FAILURE);
>+	}
>+
>+	ret = recv(fd, data, sizeof(data), MSG_DONTWAIT);
>+
>+	if (stream) {
>+		/* For SOCK_STREAM we must continue reading. */
>+		if (ret != sizeof(data)) {
>+			fprintf(stderr, "expected recv(2) success, got %zi\n", ret);
>+			exit(EXIT_FAILURE);
>+		}
>+		/* Don't check errno in case of success. */
>+	} else {
>+		/* For SOCK_SEQPACKET socket's queue must be empty. */
>+		if (ret != -1) {
>+			fprintf(stderr, "expected recv(2) failure, got %zi\n", ret);
>+			exit(EXIT_FAILURE);
>+		}
>+
>+		if (errno != EAGAIN) {
>+			fprintf(stderr, "unexpected recv(2) errno %d\n", errno);
>+			exit(EXIT_FAILURE);
>+		}
>+	}
>+
>+	control_writeln("DONE");
>+
>+	close(fd);
>+}
>+
>+static void test_inv_buf_server(const struct test_opts *opts, bool stream)
>+{
>+	unsigned char data[INV_BUF_TEST_DATA_LEN] = {0};
>+	ssize_t res;
>+	int fd;
>+
>+	if (stream)
>+		fd = vsock_stream_accept(VMADDR_CID_ANY, 1234, NULL);
>+	else
>+		fd = vsock_seqpacket_accept(VMADDR_CID_ANY, 1234, NULL);
>+
>+	if (fd < 0) {
>+		perror("accept");
>+		exit(EXIT_FAILURE);
>+	}
>+
>+	res = send(fd, data, sizeof(data), 0);
>+	if (res != sizeof(data)) {
>+		fprintf(stderr, "unexpected send(2) result %zi\n", res);
>+		exit(EXIT_FAILURE);
>+	}
>+
>+	control_writeln("SENDDONE");
>+
>+	control_expectln("DONE");
>+
>+	close(fd);
>+}
>+
>+static void test_stream_inv_buf_client(const struct test_opts *opts)
>+{
>+	test_inv_buf_client(opts, true);
>+}
>+
>+static void test_stream_inv_buf_server(const struct test_opts *opts)
>+{
>+	test_inv_buf_server(opts, true);
>+}
>+
>+static void test_seqpacket_inv_buf_client(const struct test_opts *opts)
>+{
>+	test_inv_buf_client(opts, false);
>+}
>+
>+static void test_seqpacket_inv_buf_server(const struct test_opts *opts)
>+{
>+	test_inv_buf_server(opts, false);
>+}
>+
> static struct test_case test_cases[] = {
> 	{
> 		.name = "SOCK_STREAM connection reset",
>@@ -920,6 +1028,16 @@ static struct test_case test_cases[] = {
> 		.run_client = test_seqpacket_bigmsg_client,
> 		.run_server = test_seqpacket_bigmsg_server,
> 	},
>+	{
>+		.name = "SOCK_STREAM test invalid buffer",
>+		.run_client = test_stream_inv_buf_client,
>+		.run_server = test_stream_inv_buf_server,
>+	},
>+	{
>+		.name = "SOCK_SEQPACKET test invalid buffer",
>+		.run_client = test_seqpacket_inv_buf_client,
>+		.run_server = test_seqpacket_inv_buf_server,
>+	},
> 	{},
> };
>
>-- 
>2.25.1
>