1 /* 2 * Copyright (c) 2024 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 29 #include <sys/socket.h> 30 #include <sys/un.h> 31 32 #include <unistd.h> 33 34 #include <darwintest.h> 35 #include <darwintest_utils.h> 36 37 #define MAX_SUN_PATH (SOCK_MAXADDRLEN - offsetof(struct sockaddr_un, sun_path)) 38 39 struct u_m_hdr { 40 uintptr_t mh_next; /* next buffer in chain */ 41 uintptr_t mh_nextpkt; /* next chain in queue/record */ 42 uintptr_t mh_data; /* location of data */ 43 int32_t mh_len; /* amount of data in this mbuf */ 44 u_int16_t mh_type; /* type of data in this mbuf */ 45 u_int16_t mh_flags; /* flags; see below */ 46 }; 47 48 #define MLEN_OVERFLOW_OFSSET (256 - sizeof(struct u_m_hdr)) 49 50 T_GLOBAL_META( 51 T_META_NAMESPACE("xnu.net"), 52 T_META_RADAR_COMPONENT_NAME("xnu"), 53 T_META_RADAR_COMPONENT_VERSION("networking") 54 ); 55 56 T_DECL(sbconcat_mbufs_123249093, "test sbconcat_mbufs() overflow radar://123249093") 57 { 58 int pair[2] = { -1, -1 }; 59 union { 60 uint8_t _buffer[SOCK_MAXADDRLEN]; 61 struct sockaddr_un _sun; 62 } sun_; 63 struct sockaddr_un *sun = &sun_._sun; 64 struct u_m_hdr *mhdr; 65 ssize_t retval; 66 socklen_t address_len = SOCK_MAXADDRLEN; 67 68 snprintf(sun->sun_path, MAX_SUN_PATH, "/tmp/%s.%d", getprogname(), getpid()); 69 70 mhdr = (struct u_m_hdr *)(void *)&sun_._buffer[MLEN_OVERFLOW_OFSSET]; 71 mhdr->mh_next = (uintptr_t)0x4040404040404040ULL; 72 mhdr->mh_nextpkt = (uintptr_t)0x4141414141414141ULL; 73 mhdr->mh_data = (uintptr_t)0x4242424242424242ULL; 74 mhdr->mh_len = 0x43434343; 75 mhdr->mh_type = 0x4444; 76 mhdr->mh_flags = 0x4545; 77 78 T_LOG("sizeof(struct u_m_hdr): %lu ", sizeof(struct u_m_hdr)); 79 T_LOG("MLEN_OVERFLOW_OFSSET: %lu ", MLEN_OVERFLOW_OFSSET); 80 T_LOG("sun_path: %s ", sun->sun_path); 81 82 /* add 1 for the end of string */ 83 sun->sun_len = SOCK_MAXADDRLEN; 84 sun->sun_family = AF_LOCAL; 85 86 T_LOG("sun_len: %u sun_path: %s ", sun->sun_len, sun->sun_path); 87 88 (void)unlink(sun->sun_path); 89 90 T_ASSERT_POSIX_SUCCESS(socketpair(PF_LOCAL, SOCK_DGRAM, 0, pair), "socketpair"); 91 T_LOG("pair[0]: %d pair[1]: %d", pair[0], pair[1]); 92 93 T_ASSERT_POSIX_SUCCESS(bind(pair[0], (struct sockaddr *)sun, sun->sun_len), "bind()"); 94 95 if (getsockname(pair[0], (struct sockaddr *)sun, &address_len) == 0) { 96 T_LOG("getsockname(%d) OK, sun_len: %u sun_path: %s", 97 pair[0], sun->sun_len, sun->sun_path); 98 } else { 99 T_LOG("getsockname(%d) error %s (%d)", 100 pair[0], strerror(errno), errno); 101 } 102 103 /* The call may succeed or fail with ENOBUFS for CONFIG_MBUF_MCACHE */ 104 retval = write(pair[0], NULL, 0); 105 T_ASSERT_TRUE((retval == 0 || errno == ENOBUFS), "write()"); 106 107 close(pair[0]); 108 close(pair[1]); 109 110 (void)unlink(sun->sun_path); 111 } 112