netdev - Re: [PATCH net-next 2/4] vsock/test: Add test for accept

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <uyzzicjukysdqzf5ls5s5qp26hfqgrwjz4ahbnb6jp36lzazck@67p3eejksk56>
Date: Tue, 10 Dec 2024 17:18:27 +0100
From: Stefano Garzarella <sgarzare@...hat.com>
To: Michal Luczaj <mhal@...x.co>
Cc: netdev@...r.kernel.org
Subject: Re: [PATCH net-next 2/4] vsock/test: Add test for accept_queue
 memory leak

On Fri, Dec 06, 2024 at 07:34:52PM +0100, Michal Luczaj wrote:
>Attempt to enqueue a child after the queue was flushed, but before
>SOCK_DONE flag has been set.
>
>Fixed by commit d7b0ff5a8667 ("virtio/vsock: Fix accept_queue memory
>leak").
>
>Signed-off-by: Michal Luczaj <mhal@...x.co>
>---
> tools/testing/vsock/vsock_test.c | 44 ++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 44 insertions(+)
>
>diff --git a/tools/testing/vsock/vsock_test.c b/tools/testing/vsock/vsock_test.c
>index 38fd8d96eb83ef1bd45728cfaac6adb3c1e07cfe..48b6d970bcfa95f957facb7ba2e729a32d256b4a 100644
>--- a/tools/testing/vsock/vsock_test.c
>+++ b/tools/testing/vsock/vsock_test.c
>@@ -1474,6 +1474,45 @@ static void test_stream_cred_upd_on_set_rcvlowat(const struct test_opts *opts)
> 	test_stream_credit_update_test(opts, false);
> }
>
>+#define ACCEPTQ_LEAK_RACE_TIMEOUT 2 /* seconds */
>+
>+static void test_stream_leak_acceptq_client(const struct test_opts *opts)
>+{
>+	struct sockaddr_vm addr = {
>+		.svm_family = AF_VSOCK,
>+		.svm_port = opts->peer_port,
>+		.svm_cid = opts->peer_cid
>+	};
>+	time_t tout;
>+	int fd;
>+
>+	tout = current_nsec() + ACCEPTQ_LEAK_RACE_TIMEOUT * NSEC_PER_SEC;
>+	do {
>+		control_writeulong(1);

Can we use control_writeln() and control_expectln()?

>+
>+		fd = socket(AF_VSOCK, SOCK_STREAM, 0);
>+		if (fd < 0) {
>+			perror("socket");
>+			exit(EXIT_FAILURE);
>+		}
>+

Do we need another control messages (server -> client) here to be sure
the server is listening?

>+		connect(fd, (struct sockaddr *)&addr, sizeof(addr));

What about using `vsock_stream_connect` so you can remove a lot of
code from this function (e.g. sockaddr_vm, socket(), etc.)

We only need to add `control_expectln("LISTENING")` in the server which
should also fix my previous comment.

>+		close(fd);
>+	} while (current_nsec() < tout);
>+
>+	control_writeulong(0);
>+}
>+
>+static void test_stream_leak_acceptq_server(const struct test_opts *opts)
>+{
>+	int fd;
>+
>+	while (control_readulong()) {

Ah I see, the loop is easier by sending a number.
I would just add some comments when we send 1 and 0 to explain it.

Thanks,
Stefano

>+		fd = vsock_stream_listen(VMADDR_CID_ANY, opts->peer_port);
>+		close(fd);
>+	}
>+}
>+
> static struct test_case test_cases[] = {
> 	{
> 		.name = "SOCK_STREAM connection reset",
>@@ -1604,6 +1643,11 @@ static struct test_case test_cases[] = {
> 		.run_client = test_seqpacket_unsent_bytes_client,
> 		.run_server = test_seqpacket_unsent_bytes_server,
> 	},
>+	{
>+		.name = "SOCK_STREAM leak accept queue",
>+		.run_client = test_stream_leak_acceptq_client,
>+		.run_server = test_stream_leak_acceptq_server,
>+	},
> 	{},
> };
>
>
>-- 
>2.47.1
>