selftest: af_unix: Add tests for -ECONNRESET.A new function resetpair() calls close() for the receiver and checksthe return value from recv() on the initial sender side.Now resetpair() is added
selftest: af_unix: Add tests for -ECONNRESET.A new function resetpair() calls close() for the receiver and checksthe return value from recv() on the initial sender side.Now resetpair() is added to each test case and some additional testcases.Note that TCP sets -ECONNRESET to the consumed OOB, but we have decidednot to touch TCP MSG_OOB code in the past.Before: # RUN msg_oob.no_peek.ex_oob_ex_oob ... # msg_oob.c:236:ex_oob_ex_oob:AF_UNIX :Connection reset by peer # msg_oob.c:237:ex_oob_ex_oob:Expected: # msg_oob.c:239:ex_oob_ex_oob:Expected ret[0] (-1) == expected_len (0) # ex_oob_ex_oob: Test terminated by assertion # FAIL msg_oob.no_peek.ex_oob_ex_oob not ok 14 msg_oob.no_peek.ex_oob_ex_oob ... # FAILED: 36 / 48 tests passed. # Totals: pass:36 fail:12 xfail:0 xpass:0 skip:0 error:0After: # RUN msg_oob.no_peek.ex_oob_ex_oob ... # msg_oob.c:244:ex_oob_ex_oob:AF_UNIX : # msg_oob.c:245:ex_oob_ex_oob:TCP :Connection reset by peer # OK msg_oob.no_peek.ex_oob_ex_oob ok 14 msg_oob.no_peek.ex_oob_ex_oob ... # PASSED: 48 / 48 tests passed. # Totals: pass:48 fail:0 xfail:0 xpass:0 skip:0 error:0Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>Link: https://patch.msgid.link/20250619041457.1132791-5-kuni1840@gmail.comSigned-off-by: Paolo Abeni <pabeni@redhat.com>
show more ...
af_unix: Add test for consecutive consumed OOB.Let's add a test case where consecutive concumed OOB skbs stayat the head of the queue.Without the previous patch, ioctl(SIOCATMARK) assertion fail
af_unix: Add test for consecutive consumed OOB.Let's add a test case where consecutive concumed OOB skbs stayat the head of the queue.Without the previous patch, ioctl(SIOCATMARK) assertion fails.Before: # RUN msg_oob.no_peek.ex_oob_ex_oob_oob ... # msg_oob.c:305:ex_oob_ex_oob_oob:Expected answ[0] (0) == oob_head (1) # ex_oob_ex_oob_oob: Test terminated by assertion # FAIL msg_oob.no_peek.ex_oob_ex_oob_oob not ok 12 msg_oob.no_peek.ex_oob_ex_oob_oobAfter: # RUN msg_oob.no_peek.ex_oob_ex_oob_oob ... # OK msg_oob.no_peek.ex_oob_ex_oob_oob ok 12 msg_oob.no_peek.ex_oob_ex_oob_oobSigned-off-by: Kuniyuki Iwashima <kuniyu@google.com>Link: https://patch.msgid.link/20250619041457.1132791-3-kuni1840@gmail.comSigned-off-by: Paolo Abeni <pabeni@redhat.com>
selftest: af_unix: Test SO_PASSRIGHTS.scm_rights.c has various patterns of tests to exercise GC.Let's add cases where SO_PASSRIGHTS is disabled.Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.c
selftest: af_unix: Test SO_PASSRIGHTS.scm_rights.c has various patterns of tests to exercise GC.Let's add cases where SO_PASSRIGHTS is disabled.Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Reviewed-by: Willem de Bruijn <willemb@google.com>Signed-off-by: David S. Miller <davem@davemloft.net>
af_unix: Don't return OOB skb in manage_oob().syzbot reported use-after-free in unix_stream_recv_urg(). [0]The scenario is 1. send(MSG_OOB) 2. recv(MSG_OOB) -> The consumed OOB remains
af_unix: Don't return OOB skb in manage_oob().syzbot reported use-after-free in unix_stream_recv_urg(). [0]The scenario is 1. send(MSG_OOB) 2. recv(MSG_OOB) -> The consumed OOB remains in recv queue 3. send(MSG_OOB) 4. recv() -> manage_oob() returns the next skb of the consumed OOB -> This is also OOB, but unix_sk(sk)->oob_skb is not cleared 5. recv(MSG_OOB) -> unix_sk(sk)->oob_skb is used but already freedThe recent commit 8594d9b85c07 ("af_unix: Don't call skb_get() for OOBskb.") uncovered the issue.If the OOB skb is consumed and the next skb is peeked in manage_oob(),we still need to check if the skb is OOB.Let's do so by falling back to the following checks in manage_oob()and add the test case in selftest.Note that we need to add a similar check for SIOCATMARK.[0]:BUG: KASAN: slab-use-after-free in unix_stream_read_actor+0xa6/0xb0 net/unix/af_unix.c:2959Read of size 4 at addr ffff8880326abcc4 by task syz-executor178/5235CPU: 0 UID: 0 PID: 5235 Comm: syz-executor178 Not tainted 6.11.0-rc5-syzkaller-00742-gfbdaffe41adc #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 unix_stream_read_actor+0xa6/0xb0 net/unix/af_unix.c:2959 unix_stream_recv_urg+0x1df/0x320 net/unix/af_unix.c:2640 unix_stream_read_generic+0x2456/0x2520 net/unix/af_unix.c:2778 unix_stream_recvmsg+0x22b/0x2c0 net/unix/af_unix.c:2996 sock_recvmsg_nosec net/socket.c:1046 [inline] sock_recvmsg+0x22f/0x280 net/socket.c:1068 ____sys_recvmsg+0x1db/0x470 net/socket.c:2816 ___sys_recvmsg net/socket.c:2858 [inline] __sys_recvmsg+0x2f0/0x3e0 net/socket.c:2888 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7fRIP: 0033:0x7f5360d6b4e9Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48RSP: 002b:00007fff29b3a458 EFLAGS: 00000246 ORIG_RAX: 000000000000002fRAX: ffffffffffffffda RBX: 00007fff29b3a638 RCX: 00007f5360d6b4e9RDX: 0000000000002001 RSI: 0000000020000640 RDI: 0000000000000003RBP: 00007f5360dde610 R08: 0000000000000000 R09: 0000000000000000R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001R13: 00007fff29b3a628 R14: 0000000000000001 R15: 0000000000000001 </TASK>Allocated by task 5235: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3988 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_node_noprof+0x16b/0x320 mm/slub.c:4080 __alloc_skb+0x1c3/0x440 net/core/skbuff.c:667 alloc_skb include/linux/skbuff.h:1320 [inline] alloc_skb_with_frags+0xc3/0x770 net/core/skbuff.c:6528 sock_alloc_send_pskb+0x91a/0xa60 net/core/sock.c:2815 sock_alloc_send_skb include/net/sock.h:1778 [inline] queue_oob+0x108/0x680 net/unix/af_unix.c:2198 unix_stream_sendmsg+0xd24/0xf80 net/unix/af_unix.c:2351 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2680 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7fFreed by task 5235: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kmem_cache_free+0x145/0x350 mm/slub.c:4548 unix_stream_read_generic+0x1ef6/0x2520 net/unix/af_unix.c:2917 unix_stream_recvmsg+0x22b/0x2c0 net/unix/af_unix.c:2996 sock_recvmsg_nosec net/socket.c:1046 [inline] sock_recvmsg+0x22f/0x280 net/socket.c:1068 __sys_recvfrom+0x256/0x3e0 net/socket.c:2255 __do_sys_recvfrom net/socket.c:2273 [inline] __se_sys_recvfrom net/socket.c:2269 [inline] __x64_sys_recvfrom+0xde/0x100 net/socket.c:2269 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7fThe buggy address belongs to the object at ffff8880326abc80 which belongs to the cache skbuff_head_cache of size 240The buggy address is located 68 bytes inside of freed 240-byte region [ffff8880326abc80, ffff8880326abd70)The buggy address belongs to the physical page:page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x326abksm flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)page_type: 0xfdffffff(slab)raw: 00fff00000000000 ffff88801eaee780 ffffea0000b7dc80 dead000000000003raw: 0000000000000000 00000000800c000c 00000001fdffffff 0000000000000000page dumped because: kasan: bad access detectedpage_owner tracks the page as allocatedpage last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 4686, tgid 4686 (udevadm), ts 32357469485, free_ts 28829011109 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1493 prep_new_page mm/page_alloc.c:1501 [inline] get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3439 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4695 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] alloc_slab_page+0x5f/0x120 mm/slub.c:2321 allocate_slab+0x5a/0x2f0 mm/slub.c:2484 new_slab mm/slub.c:2537 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3723 __slab_alloc+0x58/0xa0 mm/slub.c:3813 __slab_alloc_node mm/slub.c:3866 [inline] slab_alloc_node mm/slub.c:4025 [inline] kmem_cache_alloc_node_noprof+0x1fe/0x320 mm/slub.c:4080 __alloc_skb+0x1c3/0x440 net/core/skbuff.c:667 alloc_skb include/linux/skbuff.h:1320 [inline] alloc_uevent_skb+0x74/0x230 lib/kobject_uevent.c:289 uevent_net_broadcast_untagged lib/kobject_uevent.c:326 [inline] kobject_uevent_net_broadcast+0x2fd/0x580 lib/kobject_uevent.c:410 kobject_uevent_env+0x57d/0x8e0 lib/kobject_uevent.c:608 kobject_synth_uevent+0x4ef/0xae0 lib/kobject_uevent.c:207 uevent_store+0x4b/0x70 drivers/base/bus.c:633 kernfs_fop_write_iter+0x3a1/0x500 fs/kernfs/file.c:334 new_sync_write fs/read_write.c:497 [inline] vfs_write+0xa72/0xc90 fs/read_write.c:590page last free pid 1 tgid 1 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1094 [inline] free_unref_page+0xd22/0xea0 mm/page_alloc.c:2612 kasan_depopulate_vmalloc_pte+0x74/0x90 mm/kasan/shadow.c:408 apply_to_pte_range mm/memory.c:2797 [inline] apply_to_pmd_range mm/memory.c:2841 [inline] apply_to_pud_range mm/memory.c:2877 [inline] apply_to_p4d_range mm/memory.c:2913 [inline] __apply_to_page_range+0x8a8/0xe50 mm/memory.c:2947 kasan_release_vmalloc+0x9a/0xb0 mm/kasan/shadow.c:525 purge_vmap_node+0x3e3/0x770 mm/vmalloc.c:2208 __purge_vmap_area_lazy+0x708/0xae0 mm/vmalloc.c:2290 _vm_unmap_aliases+0x79d/0x840 mm/vmalloc.c:2885 change_page_attr_set_clr+0x2fe/0xdb0 arch/x86/mm/pat/set_memory.c:1881 change_page_attr_set arch/x86/mm/pat/set_memory.c:1922 [inline] set_memory_nx+0xf2/0x130 arch/x86/mm/pat/set_memory.c:2110 free_init_pages arch/x86/mm/init.c:924 [inline] free_kernel_image_pages arch/x86/mm/init.c:943 [inline] free_initmem+0x79/0x110 arch/x86/mm/init.c:970 kernel_init+0x31/0x2b0 init/main.c:1476 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244Memory state around the buggy address: ffff8880326abb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880326abc00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc>ffff8880326abc80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880326abd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc ffff8880326abd80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fbFixes: 93c99f21db36 ("af_unix: Don't stop recv(MSG_DONTWAIT) if consumed OOB skb is at the head.")Reported-by: syzbot+8811381d455e3e9ec788@syzkaller.appspotmail.comCloses: https://syzkaller.appspot.com/bug?extid=8811381d455e3e9ec788Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Link: https://patch.msgid.link/20240905193240.17565-5-kuniyu@amazon.comSigned-off-by: Jakub Kicinski <kuba@kernel.org>
selftest: af_unix: Fix kselftest compilation warningsChange expected_buf from (const void *) to (const char *)in function __recvpair().This change fixes the below warnings during test compilation
selftest: af_unix: Fix kselftest compilation warningsChange expected_buf from (const void *) to (const char *)in function __recvpair().This change fixes the below warnings during test compilation:```In file included from msg_oob.c:14:msg_oob.c: In function ‘__recvpair’:../../kselftest_harness.h:106:40: warning: format ‘%s’ expects argumentof type ‘char *’,but argument 6 has type ‘const void *’ [-Wformat=]../../kselftest_harness.h:101:17: note: in expansion of macro ‘__TH_LOG’msg_oob.c:235:17: note: in expansion of macro ‘TH_LOG’../../kselftest_harness.h:106:40: warning: format ‘%s’ expects argumentof type ‘char *’,but argument 6 has type ‘const void *’ [-Wformat=]../../kselftest_harness.h:101:17: note: in expansion of macro ‘__TH_LOG’msg_oob.c:259:25: note: in expansion of macro ‘TH_LOG’```Fixes: d098d77232c3 ("selftest: af_unix: Add msg_oob.c.")Signed-off-by: Abhinav Jain <jain.abhinav177@gmail.com>Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>Link: https://patch.msgid.link/20240814080743.1156166-1-jain.abhinav177@gmail.comSigned-off-by: Jakub Kicinski <kuba@kernel.org>
selftest: af_unix: Add test case for backtrack after finalising SCC.syzkaller reported a KMSAN splat in __unix_walk_scc() while backtrackingedge_stack after finalising SCC.Let's add a test case
selftest: af_unix: Add test case for backtrack after finalising SCC.syzkaller reported a KMSAN splat in __unix_walk_scc() while backtrackingedge_stack after finalising SCC.Let's add a test case exercising the path.Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>Link: https://patch.msgid.link/20240702160428.10153-2-syoshida@redhat.comSigned-off-by: Jakub Kicinski <kuba@kernel.org>
selftest: af_unix: Check SIOCATMARK after every send()/recv() in msg_oob.c.To catch regression, let's check ioctl(SIOCATMARK) after everysend() and recv() calls.Signed-off-by: Kuniyuki Iwashima
selftest: af_unix: Check SIOCATMARK after every send()/recv() in msg_oob.c.To catch regression, let's check ioctl(SIOCATMARK) after everysend() and recv() calls.Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Signed-off-by: Paolo Abeni <pabeni@redhat.com>
af_unix: Fix wrong ioctl(SIOCATMARK) when consumed OOB skb is at the head.Even if OOB data is recv()ed, ioctl(SIOCATMARK) must return 1 when theOOB skb is at the head of the receive queue and no n
af_unix: Fix wrong ioctl(SIOCATMARK) when consumed OOB skb is at the head.Even if OOB data is recv()ed, ioctl(SIOCATMARK) must return 1 when theOOB skb is at the head of the receive queue and no new OOB data is queued.Without fix: # RUN msg_oob.no_peek.oob ... # msg_oob.c:305:oob:Expected answ[0] (0) == oob_head (1) # oob: Test terminated by assertion # FAIL msg_oob.no_peek.oob not ok 2 msg_oob.no_peek.oobWith fix: # RUN msg_oob.no_peek.oob ... # OK msg_oob.no_peek.oob ok 2 msg_oob.no_peek.oobFixes: 314001f0bf92 ("af_unix: Add OOB support")Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Signed-off-by: Paolo Abeni <pabeni@redhat.com>
selftest: af_unix: Check EPOLLPRI after every send()/recv() in msg_oob.cWhen OOB data is in recvq, we can detect it with epoll by checkingEPOLLPRI.This patch add checks for EPOLLPRI after every
selftest: af_unix: Check EPOLLPRI after every send()/recv() in msg_oob.cWhen OOB data is in recvq, we can detect it with epoll by checkingEPOLLPRI.This patch add checks for EPOLLPRI after every send() and recv() inall test cases.Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Signed-off-by: Paolo Abeni <pabeni@redhat.com>
selftest: af_unix: Check SIGURG after every send() in msg_oob.cWhen data is sent with MSG_OOB, SIGURG is sent to a process if thereceiver socket has set its owner to the process by ioctl(FIOSETOWN
selftest: af_unix: Check SIGURG after every send() in msg_oob.cWhen data is sent with MSG_OOB, SIGURG is sent to a process if thereceiver socket has set its owner to the process by ioctl(FIOSETOWN)or fcntl(F_SETOWN).This patch adds SIGURG check after every send(MSG_OOB) call.Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Signed-off-by: Paolo Abeni <pabeni@redhat.com>
selftest: af_unix: Add SO_OOBINLINE test cases in msg_oob.cWhen SO_OOBINLINE is enabled on a socket, MSG_OOB can be recv()edwithout MSG_OOB flag, and ioctl(SIOCATMARK) will behaves differently.T
selftest: af_unix: Add SO_OOBINLINE test cases in msg_oob.cWhen SO_OOBINLINE is enabled on a socket, MSG_OOB can be recv()edwithout MSG_OOB flag, and ioctl(SIOCATMARK) will behaves differently.This patch adds some test cases for SO_OOBINLINE.Note the new test cases found two bugs in TCP. 1) After reading OOB data with non-inline mode, we can re-read the data by setting SO_OOBINLINE. # RUN msg_oob.no_peek.inline_oob_ahead_break ... # msg_oob.c:146:inline_oob_ahead_break:AF_UNIX :world # msg_oob.c:147:inline_oob_ahead_break:TCP :oworld # OK msg_oob.no_peek.inline_oob_ahead_break ok 14 msg_oob.no_peek.inline_oob_ahead_break 2) The head OOB data is dropped if SO_OOBINLINE is disabled if a new OOB data is queued. # RUN msg_oob.no_peek.inline_ex_oob_drop ... # msg_oob.c:171:inline_ex_oob_drop:AF_UNIX :x # msg_oob.c:172:inline_ex_oob_drop:TCP :y # msg_oob.c:146:inline_ex_oob_drop:AF_UNIX :y # msg_oob.c:147:inline_ex_oob_drop:TCP :Resource temporarily unavailable # OK msg_oob.no_peek.inline_ex_oob_drop ok 17 msg_oob.no_peek.inline_ex_oob_dropSigned-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Signed-off-by: Paolo Abeni <pabeni@redhat.com>
af_unix: Don't stop recv() at consumed ex-OOB skb.Currently, recv() is stopped at a consumed OOB skb even if a newOOB skb is queued and we can ignore the old OOB skb. >>> from socket import *
af_unix: Don't stop recv() at consumed ex-OOB skb.Currently, recv() is stopped at a consumed OOB skb even if a newOOB skb is queued and we can ignore the old OOB skb. >>> from socket import * >>> c1, c2 = socket(AF_UNIX, SOCK_STREAM) >>> c1.send(b'hellowor', MSG_OOB) 8 >>> c2.recv(1, MSG_OOB) # consume OOB data stays at middle of recvq. b'r' >>> c1.send(b'ld', MSG_OOB) 2 >>> c2.recv(10) # recv() stops at the old consumed OOB b'hellowo' # should be 'hellowol'manage_oob() should not stop recv() at the old consumed OOB skb ifthere is a new OOB data queued.Note that TCP behaviour is apparently wrong in this test case becausewe can recv() the same OOB data twice.Without fix: # RUN msg_oob.no_peek.ex_oob_ahead_break ... # msg_oob.c:138:ex_oob_ahead_break:AF_UNIX :hellowo # msg_oob.c:139:ex_oob_ahead_break:Expected:hellowol # msg_oob.c:141:ex_oob_ahead_break:Expected ret[0] (7) == expected_len (8) # ex_oob_ahead_break: Test terminated by assertion # FAIL msg_oob.no_peek.ex_oob_ahead_break not ok 11 msg_oob.no_peek.ex_oob_ahead_breakWith fix: # RUN msg_oob.no_peek.ex_oob_ahead_break ... # msg_oob.c:146:ex_oob_ahead_break:AF_UNIX :hellowol # msg_oob.c:147:ex_oob_ahead_break:TCP :helloworl # OK msg_oob.no_peek.ex_oob_ahead_break ok 11 msg_oob.no_peek.ex_oob_ahead_breakFixes: 314001f0bf92 ("af_unix: Add OOB support")Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Signed-off-by: Paolo Abeni <pabeni@redhat.com>
selftest: af_unix: Add non-TCP-compliant test cases in msg_oob.c.While testing, I found some weird behaviour on the TCP side as well.For example, TCP drops the preceding OOB data when queueing a
selftest: af_unix: Add non-TCP-compliant test cases in msg_oob.c.While testing, I found some weird behaviour on the TCP side as well.For example, TCP drops the preceding OOB data when queueing a newOOB data if the old OOB data is at the head of recvq. # RUN msg_oob.no_peek.ex_oob_drop ... # msg_oob.c:146:ex_oob_drop:AF_UNIX :x # msg_oob.c:147:ex_oob_drop:TCP :Resource temporarily unavailable # msg_oob.c:146:ex_oob_drop:AF_UNIX :y # msg_oob.c:147:ex_oob_drop:TCP :Invalid argument # OK msg_oob.no_peek.ex_oob_drop ok 9 msg_oob.no_peek.ex_oob_drop # RUN msg_oob.no_peek.ex_oob_drop_2 ... # msg_oob.c:146:ex_oob_drop_2:AF_UNIX :x # msg_oob.c:147:ex_oob_drop_2:TCP :Resource temporarily unavailable # OK msg_oob.no_peek.ex_oob_drop_2 ok 10 msg_oob.no_peek.ex_oob_drop_2This patch allows AF_UNIX's MSG_OOB implementation to produce differentresults from TCP when operations are guarded with tcp_incompliant{}.Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Signed-off-by: Paolo Abeni <pabeni@redhat.com>
af_unix: Don't stop recv(MSG_DONTWAIT) if consumed OOB skb is at the head.Let's say a socket send()s "hello" with MSG_OOB and "world" without flags, >>> from socket import * >>> c1, c2 = socke
af_unix: Don't stop recv(MSG_DONTWAIT) if consumed OOB skb is at the head.Let's say a socket send()s "hello" with MSG_OOB and "world" without flags, >>> from socket import * >>> c1, c2 = socketpair(AF_UNIX) >>> c1.send(b'hello', MSG_OOB) 5 >>> c1.send(b'world') 5and its peer recv()s "hell" and "o". >>> c2.recv(10) b'hell' >>> c2.recv(1, MSG_OOB) b'o'Now the consumed OOB skb stays at the head of recvq to return a correctvalue for ioctl(SIOCATMARK), which is broken now and fixed by a laterpatch.Then, if peer issues recv() with MSG_DONTWAIT, manage_oob() returns NULL,so recv() ends up with -EAGAIN. >>> c2.setblocking(False) # This causes -EAGAIN even with available data >>> c2.recv(5) Traceback (most recent call last): File "<stdin>", line 1, in <module> BlockingIOError: [Errno 11] Resource temporarily unavailableHowever, next recv() will return the following available data, "world". >>> c2.recv(5) b'world'When the consumed OOB skb is at the head of the queue, we need to fetchthe next skb to fix the weird behaviour.Note that the issue does not happen without MSG_DONTWAIT because we canretry after manage_oob().This patch also adds a test case that covers the issue.Without fix: # RUN msg_oob.no_peek.ex_oob_break ... # msg_oob.c:134:ex_oob_break:AF_UNIX :Resource temporarily unavailable # msg_oob.c:135:ex_oob_break:Expected:ld # msg_oob.c:137:ex_oob_break:Expected ret[0] (-1) == expected_len (2) # ex_oob_break: Test terminated by assertion # FAIL msg_oob.no_peek.ex_oob_break not ok 8 msg_oob.no_peek.ex_oob_breakWith fix: # RUN msg_oob.no_peek.ex_oob_break ... # OK msg_oob.no_peek.ex_oob_break ok 8 msg_oob.no_peek.ex_oob_breakFixes: 314001f0bf92 ("af_unix: Add OOB support")Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Signed-off-by: Paolo Abeni <pabeni@redhat.com>
af_unix: Stop recv(MSG_PEEK) at consumed OOB skb.After consuming OOB data, recv() reading the preceding data must break atthe OOB skb regardless of MSG_PEEK.Currently, MSG_PEEK does not stop rec
af_unix: Stop recv(MSG_PEEK) at consumed OOB skb.After consuming OOB data, recv() reading the preceding data must break atthe OOB skb regardless of MSG_PEEK.Currently, MSG_PEEK does not stop recv() for AF_UNIX, and the behaviour isnot compliant with TCP. >>> from socket import * >>> c1, c2 = socketpair(AF_UNIX) >>> c1.send(b'hello', MSG_OOB) 5 >>> c1.send(b'world') 5 >>> c2.recv(1, MSG_OOB) b'o' >>> c2.recv(9, MSG_PEEK) # This should return b'hell' b'hellworld' # even with enough buffer.Let's fix it by returning NULL for consumed skb and unlinking it only ifMSG_PEEK is not specified.This patch also adds test cases that add recv(MSG_PEEK) before each recv().Without fix: # RUN msg_oob.peek.oob_ahead_break ... # msg_oob.c:134:oob_ahead_break:AF_UNIX :hellworld # msg_oob.c:135:oob_ahead_break:Expected:hell # msg_oob.c:137:oob_ahead_break:Expected ret[0] (9) == expected_len (4) # oob_ahead_break: Test terminated by assertion # FAIL msg_oob.peek.oob_ahead_break not ok 13 msg_oob.peek.oob_ahead_breakWith fix: # RUN msg_oob.peek.oob_ahead_break ... # OK msg_oob.peek.oob_ahead_break ok 13 msg_oob.peek.oob_ahead_breakFixes: 314001f0bf92 ("af_unix: Add OOB support")Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Signed-off-by: Paolo Abeni <pabeni@redhat.com>
selftest: af_unix: Add msg_oob.c.AF_UNIX's MSG_OOB functionality lacked thorough testing, and we foundsome bizarre behaviour.The new selftest validates every MSG_OOB operation against TCP as ar
selftest: af_unix: Add msg_oob.c.AF_UNIX's MSG_OOB functionality lacked thorough testing, and we foundsome bizarre behaviour.The new selftest validates every MSG_OOB operation against TCP as areference implementation.This patch adds only a few tests with basic send() and recv() thatdo not fail.The following patches will add more test cases for SO_OOBINLINE, SIGURG,EPOLLPRI, and SIOCATMARK.Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Signed-off-by: Paolo Abeni <pabeni@redhat.com>
selftest: af_unix: Remove test_unix_oob.c.test_unix_oob.c does not fully cover AF_UNIX's MSG_OOB functionality,thus there are discrepancies between TCP behaviour.Also, the test uses fork() to cr
selftest: af_unix: Remove test_unix_oob.c.test_unix_oob.c does not fully cover AF_UNIX's MSG_OOB functionality,thus there are discrepancies between TCP behaviour.Also, the test uses fork() to create message producer, and it's noteasy to understand and add more test cases.Let's remove test_unix_oob.c and rewrite a new test.Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Signed-off-by: Paolo Abeni <pabeni@redhat.com>
selftest: af_unix: Add Kconfig file.diag_uid selftest failed on NIPA where the received nlmsg_type isNLMSG_ERROR [0] because CONFIG_UNIX_DIAG is not set [1] by defaultand sock_diag_lock_handler()
selftest: af_unix: Add Kconfig file.diag_uid selftest failed on NIPA where the received nlmsg_type isNLMSG_ERROR [0] because CONFIG_UNIX_DIAG is not set [1] by defaultand sock_diag_lock_handler() failed to load the module. # # Starting 2 tests from 2 test cases. # # RUN diag_uid.uid.1 ... # # diag_uid.c:159:1:Expected nlh->nlmsg_type (2) == SOCK_DIAG_BY_FAMILY (20) # # 1: Test terminated by assertion # # FAIL diag_uid.uid.1 # not ok 1 diag_uid.uid.1Let's add all AF_UNIX Kconfig to the config file under af_unix dirso that NIPA consumes it.Fixes: ac011361bd4f ("af_unix: Add test for sock_diag and UDIAG_SHOW_UID.")Link: https://netdev-3.bots.linux.dev/vmksft-net/results/644841/104-diag-uid/stdout [0]Link: https://netdev-3.bots.linux.dev/vmksft-net/results/644841/config [1]Reported-by: Jakub Kicinski <kuba@kernel.org>Closes: https://lore.kernel.org/netdev/20240617073033.0cbb829d@kernel.org/Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Signed-off-by: David S. Miller <davem@davemloft.net>
selftest: af_unix: Make SCM_RIGHTS into OOB data.scm_rights.c covers various test cases for inflight file descriptorsand garbage collector for AF_UNIX sockets.Currently, SCM_RIGHTS messages are
selftest: af_unix: Make SCM_RIGHTS into OOB data.scm_rights.c covers various test cases for inflight file descriptorsand garbage collector for AF_UNIX sockets.Currently, SCM_RIGHTS messages are sent with 3-bytes string, and it'snot good for MSG_OOB cases, as SCM_RIGTS cmsg goes with the first 2-bytes,which is non-OOB data.Let's send SCM_RIGHTS messages with 1-byte character to pack SCM_RIGHTSinto OOB data.Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Signed-off-by: Michal Luczaj <mhal@rbox.co>Signed-off-by: Paolo Abeni <pabeni@redhat.com>
selftest: af_unix: Test GC for SCM_RIGHTS.This patch adds test cases to verify the new GC.We run each test for the following cases: * SOCK_DGRAM * SOCK_STREAM without embryo socket * SOCK_
selftest: af_unix: Test GC for SCM_RIGHTS.This patch adds test cases to verify the new GC.We run each test for the following cases: * SOCK_DGRAM * SOCK_STREAM without embryo socket * SOCK_STREAM without embryo socket + MSG_OOB * SOCK_STREAM with embryo sockets * SOCK_STREAM with embryo sockets + MSG_OOBBefore and after running each test case, we ensure that there isno AF_UNIX socket left in the netns by reading /proc/net/protocols.We cannot use /proc/net/unix and UNIX_DIAG because the embryo socketdoes not show up there.Each test creates multiple sockets in an array. We pass sockets inthe even index using the peer sockets in the odd index.So, send_fd(0, 1) actually sends fd[0] to fd[2] via fd[0 + 1]. Test 1 : A <-> A Test 2 : A <-> B Test 3 : A -> B -> C <- D ^.___|___.' ^ `---------'Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Acked-by: Paolo Abeni <pabeni@redhat.com>Link: https://lore.kernel.org/r/20240325202425.60930-16-kuniyu@amazon.comSigned-off-by: Jakub Kicinski <kuba@kernel.org>
selftests/net: unix: fix unused variable compiler warningRemove an unused variable. diag_uid.c:151:24: error: unused variable 'udr' [-Werror,-Wunused-variable]Fixes: ac011361bd4f ("a
selftests/net: unix: fix unused variable compiler warningRemove an unused variable. diag_uid.c:151:24: error: unused variable 'udr' [-Werror,-Wunused-variable]Fixes: ac011361bd4f ("af_unix: Add test for sock_diag and UDIAG_SHOW_UID.")Signed-off-by: Willem de Bruijn <willemb@google.com>Link: https://lore.kernel.org/r/20231124171645.1011043-4-willemdebruijn.kernel@gmail.comSigned-off-by: Jakub Kicinski <kuba@kernel.org>
selftests: net: remove unused variablesThese variables are never referenced in the code, just remove themSigned-off-by: zhujun2 <zhujun2@cmss.chinamobile.com>Signed-off-by: David S. Miller <dave
selftests: net: remove unused variablesThese variables are never referenced in the code, just remove themSigned-off-by: zhujun2 <zhujun2@cmss.chinamobile.com>Signed-off-by: David S. Miller <davem@davemloft.net>
selftests: net: add SCM_PIDFD / SO_PEERPIDFD testBasic test to check consistency between:- SCM_CREDENTIALS and SCM_PIDFD- SO_PEERCRED and SO_PEERPIDFDCc: "David S. Miller" <davem@davemloft.net>
selftests: net: add SCM_PIDFD / SO_PEERPIDFD testBasic test to check consistency between:- SCM_CREDENTIALS and SCM_PIDFD- SO_PEERCRED and SO_PEERPIDFDCc: "David S. Miller" <davem@davemloft.net>Cc: Eric Dumazet <edumazet@google.com>Cc: Jakub Kicinski <kuba@kernel.org>Cc: Paolo Abeni <pabeni@redhat.com>Cc: Leon Romanovsky <leon@kernel.org>Cc: David Ahern <dsahern@kernel.org>Cc: Arnd Bergmann <arnd@arndb.de>Cc: Kees Cook <keescook@chromium.org>Cc: Christian Brauner <brauner@kernel.org>Cc: Kuniyuki Iwashima <kuniyu@amazon.com>Cc: linux-kernel@vger.kernel.orgCc: netdev@vger.kernel.orgCc: linux-arch@vger.kernel.orgCc: linux-kselftest@vger.kernel.orgSigned-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>Signed-off-by: David S. Miller <davem@davemloft.net>
af_unix: selftest: Fix the size of the parameter to connect()Adjust size parameter in connect() to match the type of the parameter, tofix "No such file or directory" error in selftests/net/af_unix
af_unix: selftest: Fix the size of the parameter to connect()Adjust size parameter in connect() to match the type of the parameter, tofix "No such file or directory" error in selftests/net/af_unix/test_oob_unix.c:127.The existing code happens to work provided that the autogenerated pathnameis shorter than sizeof (struct sockaddr), which is why it hasn't beennoticed earlier.Visible from the trace excerpt:bind(3, {sa_family=AF_UNIX, sun_path="unix_oob_453059"}, 110) = 0clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fa6a6577a10) = 453060[pid <child>] connect(6, {sa_family=AF_UNIX, sun_path="unix_oob_45305"}, 16) = -1 ENOENT (No such file or directory)BUG: The filename is trimmed to sizeof (struct sockaddr).Cc: "David S. Miller" <davem@davemloft.net>Cc: Eric Dumazet <edumazet@google.com>Cc: Jakub Kicinski <kuba@kernel.org>Cc: Paolo Abeni <pabeni@redhat.com>Cc: Shuah Khan <shuah@kernel.org>Cc: Kuniyuki Iwashima <kuniyu@amazon.co.jp>Cc: Florian Westphal <fw@strlen.de>Reviewed-by: Florian Westphal <fw@strlen.de>Fixes: 314001f0bf92 ("af_unix: Add OOB support")Signed-off-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>Signed-off-by: David S. Miller <davem@davemloft.net>
af_unix: Add test for sock_diag and UDIAG_SHOW_UID.The test prog dumps a single AF_UNIX socket's UID with and withoutunshare(CLONE_NEWUSER) and checks if it matches the result of getuid().Withou
af_unix: Add test for sock_diag and UDIAG_SHOW_UID.The test prog dumps a single AF_UNIX socket's UID with and withoutunshare(CLONE_NEWUSER) and checks if it matches the result of getuid().Without the preceding patch, the test prog is killed by a NULL derefin sk_diag_dump_uid(). # ./diag_uid TAP version 13 1..2 # Starting 2 tests from 3 test cases. # RUN diag_uid.uid.1 ... BUG: kernel NULL pointer dereference, address: 0000000000000270 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 105212067 P4D 105212067 PUD 1051fe067 PMD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.amzn2022.0.1 04/01/2014 RIP: 0010:sk_diag_fill (./include/net/sock.h:920 net/unix/diag.c:119 net/unix/diag.c:170) ... # 1: Test terminated unexpectedly by signal 9 # FAIL diag_uid.uid.1 not ok 1 diag_uid.uid.1 # RUN diag_uid.uid_unshare.1 ... # 1: Test terminated by timeout # FAIL diag_uid.uid_unshare.1 not ok 2 diag_uid.uid_unshare.1 # FAILED: 0 / 2 tests passed. # Totals: pass:0 fail:2 xfail:0 xpass:0 skip:0 error:0With the patch, the test succeeds. # ./diag_uid TAP version 13 1..2 # Starting 2 tests from 3 test cases. # RUN diag_uid.uid.1 ... # OK diag_uid.uid.1 ok 1 diag_uid.uid.1 # RUN diag_uid.uid_unshare.1 ... # OK diag_uid.uid_unshare.1 ok 2 diag_uid.uid_unshare.1 # PASSED: 2 / 2 tests passed. # Totals: pass:2 fail:0 xfail:0 xpass:0 skip:0 error:0Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>Signed-off-by: Paolo Abeni <pabeni@redhat.com>
12