1*1b191cb5SApple OSS Distributions /* This tests thread_t uaf vulnerability in the XNU kernel due to
2*1b191cb5SApple OSS Distributions * a race condition in unp_connect
3*1b191cb5SApple OSS Distributions */
4*1b191cb5SApple OSS Distributions
5*1b191cb5SApple OSS Distributions #include <sys/un.h>
6*1b191cb5SApple OSS Distributions #include <sys/socket.h>
7*1b191cb5SApple OSS Distributions #include <pthread.h>
8*1b191cb5SApple OSS Distributions #include <sys/proc_info.h>
9*1b191cb5SApple OSS Distributions #include <libproc.h>
10*1b191cb5SApple OSS Distributions #include <darwintest.h>
11*1b191cb5SApple OSS Distributions #include <unistd.h>
12*1b191cb5SApple OSS Distributions
13*1b191cb5SApple OSS Distributions int g_start = 0;
14*1b191cb5SApple OSS Distributions int g_client = 0;
15*1b191cb5SApple OSS Distributions int g_sever1 = 0;
16*1b191cb5SApple OSS Distributions int g_sever2 = 0;
17*1b191cb5SApple OSS Distributions
18*1b191cb5SApple OSS Distributions static void
server_thread1(char * path)19*1b191cb5SApple OSS Distributions server_thread1(char* path)
20*1b191cb5SApple OSS Distributions {
21*1b191cb5SApple OSS Distributions struct sockaddr_un server_sockaddr;
22*1b191cb5SApple OSS Distributions memset(&server_sockaddr, 0, sizeof(struct sockaddr_un));
23*1b191cb5SApple OSS Distributions server_sockaddr.sun_family = AF_UNIX;
24*1b191cb5SApple OSS Distributions strcpy(server_sockaddr.sun_path, path);
25*1b191cb5SApple OSS Distributions unlink(server_sockaddr.sun_path);
26*1b191cb5SApple OSS Distributions
27*1b191cb5SApple OSS Distributions int server_sock = socket(AF_UNIX, SOCK_STREAM, 0);
28*1b191cb5SApple OSS Distributions g_sever1 = server_sock;
29*1b191cb5SApple OSS Distributions T_ASSERT_POSIX_SUCCESS(bind(server_sock,
30*1b191cb5SApple OSS Distributions (struct sockaddr *) &server_sockaddr, sizeof(server_sockaddr)), NULL);
31*1b191cb5SApple OSS Distributions
32*1b191cb5SApple OSS Distributions /*********************************/
33*1b191cb5SApple OSS Distributions /* Listen for any client sockets */
34*1b191cb5SApple OSS Distributions /*********************************/
35*1b191cb5SApple OSS Distributions T_ASSERT_POSIX_SUCCESS(listen(server_sock, -1), NULL);
36*1b191cb5SApple OSS Distributions
37*1b191cb5SApple OSS Distributions return;
38*1b191cb5SApple OSS Distributions }
39*1b191cb5SApple OSS Distributions
40*1b191cb5SApple OSS Distributions static void
server_thread2(char * path)41*1b191cb5SApple OSS Distributions server_thread2(char* path)
42*1b191cb5SApple OSS Distributions {
43*1b191cb5SApple OSS Distributions struct sockaddr_un server_sockaddr;
44*1b191cb5SApple OSS Distributions memset(&server_sockaddr, 0, sizeof(struct sockaddr_un));
45*1b191cb5SApple OSS Distributions server_sockaddr.sun_family = AF_UNIX;
46*1b191cb5SApple OSS Distributions strcpy(server_sockaddr.sun_path, path);
47*1b191cb5SApple OSS Distributions unlink(server_sockaddr.sun_path);
48*1b191cb5SApple OSS Distributions
49*1b191cb5SApple OSS Distributions int server_sock = socket(AF_UNIX, SOCK_STREAM, 0);
50*1b191cb5SApple OSS Distributions g_sever2 = server_sock;
51*1b191cb5SApple OSS Distributions T_ASSERT_POSIX_SUCCESS(bind(server_sock,
52*1b191cb5SApple OSS Distributions (struct sockaddr *) &server_sockaddr, sizeof(server_sockaddr)), NULL);
53*1b191cb5SApple OSS Distributions
54*1b191cb5SApple OSS Distributions /*********************************/
55*1b191cb5SApple OSS Distributions /* Listen for any client sockets */
56*1b191cb5SApple OSS Distributions /*********************************/
57*1b191cb5SApple OSS Distributions T_ASSERT_POSIX_SUCCESS(listen(server_sock, -1), NULL);
58*1b191cb5SApple OSS Distributions
59*1b191cb5SApple OSS Distributions return;
60*1b191cb5SApple OSS Distributions }
61*1b191cb5SApple OSS Distributions
62*1b191cb5SApple OSS Distributions static void
try_to_connect(char * path)63*1b191cb5SApple OSS Distributions try_to_connect(char* path)
64*1b191cb5SApple OSS Distributions {
65*1b191cb5SApple OSS Distributions struct sockaddr_un server_sockaddr;
66*1b191cb5SApple OSS Distributions memset(&server_sockaddr, 0, sizeof(struct sockaddr_un));
67*1b191cb5SApple OSS Distributions server_sockaddr.sun_family = AF_UNIX;
68*1b191cb5SApple OSS Distributions strcpy(server_sockaddr.sun_path, path);
69*1b191cb5SApple OSS Distributions //unlink(server_sockaddr.sun_path);
70*1b191cb5SApple OSS Distributions
71*1b191cb5SApple OSS Distributions while (g_start == 0) {
72*1b191cb5SApple OSS Distributions usleep(100);
73*1b191cb5SApple OSS Distributions }
74*1b191cb5SApple OSS Distributions int ret = connect(g_client, (struct sockaddr *)&server_sockaddr,
75*1b191cb5SApple OSS Distributions sizeof(server_sockaddr));
76*1b191cb5SApple OSS Distributions
77*1b191cb5SApple OSS Distributions T_ASSERT_TRUE(ret == 0 || errno == EALREADY || errno == EISCONN,
78*1b191cb5SApple OSS Distributions "connect with ret: %d(%d)", ret, errno);
79*1b191cb5SApple OSS Distributions }
80*1b191cb5SApple OSS Distributions
81*1b191cb5SApple OSS Distributions
82*1b191cb5SApple OSS Distributions static void
test_unp_connect_multithread()83*1b191cb5SApple OSS Distributions test_unp_connect_multithread()
84*1b191cb5SApple OSS Distributions {
85*1b191cb5SApple OSS Distributions int client_sock;
86*1b191cb5SApple OSS Distributions char path[] = "/tmp/";
87*1b191cb5SApple OSS Distributions char path1[256];
88*1b191cb5SApple OSS Distributions char path2[256];
89*1b191cb5SApple OSS Distributions char path3[256];
90*1b191cb5SApple OSS Distributions
91*1b191cb5SApple OSS Distributions strncpy(path1, path, 255);
92*1b191cb5SApple OSS Distributions strcat(path1, "/1");
93*1b191cb5SApple OSS Distributions strncpy(path2, path, 255);
94*1b191cb5SApple OSS Distributions strcat(path2, "/2");
95*1b191cb5SApple OSS Distributions strncpy(path3, path, 255);
96*1b191cb5SApple OSS Distributions strcat(path3, "/3");
97*1b191cb5SApple OSS Distributions
98*1b191cb5SApple OSS Distributions
99*1b191cb5SApple OSS Distributions for (int i = 0; i < 1024; i++) {
100*1b191cb5SApple OSS Distributions T_SETUPBEGIN;
101*1b191cb5SApple OSS Distributions server_thread1(path1);
102*1b191cb5SApple OSS Distributions server_thread2(path2);
103*1b191cb5SApple OSS Distributions T_ASSERT_POSIX_SUCCESS(client_sock = socket(AF_UNIX, SOCK_STREAM, 0), NULL);
104*1b191cb5SApple OSS Distributions
105*1b191cb5SApple OSS Distributions unlink(path3);
106*1b191cb5SApple OSS Distributions struct sockaddr_un client_sockaddr;
107*1b191cb5SApple OSS Distributions client_sockaddr.sun_family = AF_UNIX;
108*1b191cb5SApple OSS Distributions strcpy(client_sockaddr.sun_path, path3);
109*1b191cb5SApple OSS Distributions T_ASSERT_POSIX_SUCCESS(bind(client_sock, (struct sockaddr *)&client_sockaddr,
110*1b191cb5SApple OSS Distributions sizeof(client_sockaddr)), NULL);
111*1b191cb5SApple OSS Distributions T_SETUPEND;
112*1b191cb5SApple OSS Distributions g_client = client_sock;
113*1b191cb5SApple OSS Distributions g_start = 0;
114*1b191cb5SApple OSS Distributions pthread_t runner1;
115*1b191cb5SApple OSS Distributions pthread_t runner2;
116*1b191cb5SApple OSS Distributions if (pthread_create(&runner1, 0, (void*)try_to_connect, path1)) {
117*1b191cb5SApple OSS Distributions T_ASSERT_FAIL("pthread_create failed");
118*1b191cb5SApple OSS Distributions }
119*1b191cb5SApple OSS Distributions
120*1b191cb5SApple OSS Distributions if (pthread_create(&runner2, 0, (void*)try_to_connect, path2)) {
121*1b191cb5SApple OSS Distributions T_ASSERT_FAIL("pthread_create failed");
122*1b191cb5SApple OSS Distributions }
123*1b191cb5SApple OSS Distributions usleep(300);
124*1b191cb5SApple OSS Distributions g_start = 1;
125*1b191cb5SApple OSS Distributions pthread_join(runner1, 0);
126*1b191cb5SApple OSS Distributions pthread_join(runner2, 0);
127*1b191cb5SApple OSS Distributions
128*1b191cb5SApple OSS Distributions usleep(3000);
129*1b191cb5SApple OSS Distributions
130*1b191cb5SApple OSS Distributions struct socket_fdinfo si_1 = {0};
131*1b191cb5SApple OSS Distributions proc_pidfdinfo(getpid(), g_sever1, PROC_PIDFDSOCKETINFO, &si_1,
132*1b191cb5SApple OSS Distributions sizeof(si_1));
133*1b191cb5SApple OSS Distributions struct socket_fdinfo si_2 = {0};
134*1b191cb5SApple OSS Distributions proc_pidfdinfo(getpid(), g_sever2, PROC_PIDFDSOCKETINFO, &si_2,
135*1b191cb5SApple OSS Distributions sizeof(si_2));
136*1b191cb5SApple OSS Distributions if (si_1.psi.soi_incqlen || si_2.psi.soi_incqlen) {
137*1b191cb5SApple OSS Distributions close(g_sever2);
138*1b191cb5SApple OSS Distributions close(g_sever1);
139*1b191cb5SApple OSS Distributions }
140*1b191cb5SApple OSS Distributions close(client_sock);
141*1b191cb5SApple OSS Distributions close(g_sever2);
142*1b191cb5SApple OSS Distributions close(g_sever1);
143*1b191cb5SApple OSS Distributions }
144*1b191cb5SApple OSS Distributions }
145*1b191cb5SApple OSS Distributions
146*1b191cb5SApple OSS Distributions T_DECL(unp_connect_thread_uaf, "Uaf due to multithreaded unp_connect")
147*1b191cb5SApple OSS Distributions {
148*1b191cb5SApple OSS Distributions test_unp_connect_multithread();
149*1b191cb5SApple OSS Distributions }
150