From patchwork Thu May 20 13:35:48 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gaetan Rivet X-Patchwork-Id: 1481633 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org (client-ip=2605:bc80:3010::138; helo=smtp1.osuosl.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=u256.net header.i=@u256.net header.a=rsa-sha256 header.s=fm1 header.b=BIxec67w; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm2 header.b=iYPJKGqd; dkim-atps=neutral Received: from smtp1.osuosl.org (smtp1.osuosl.org [IPv6:2605:bc80:3010::138]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4Fm9kM4dzZz9sV5 for ; Thu, 20 May 2021 23:36:27 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id C4EDF84421; Thu, 20 May 2021 13:36:19 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s9yqFxLQ_dwB; Thu, 20 May 2021 13:36:16 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [IPv6:2605:bc80:3010:104::8cd3:938]) by smtp1.osuosl.org (Postfix) with ESMTP id 773F5842F4; Thu, 20 May 2021 13:36:14 +0000 (UTC) Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id A55D2C0032; Thu, 20 May 2021 13:36:10 +0000 (UTC) X-Original-To: ovs-dev@openvswitch.org Delivered-To: ovs-dev@lists.linuxfoundation.org Received: from smtp4.osuosl.org (smtp4.osuosl.org [IPv6:2605:bc80:3010::137]) by lists.linuxfoundation.org (Postfix) with ESMTP id 6E715C0001 for ; Thu, 20 May 2021 13:36:05 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp4.osuosl.org (Postfix) with ESMTP id 4F421405BE for ; Thu, 20 May 2021 13:36:05 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Authentication-Results: smtp4.osuosl.org (amavisd-new); dkim=pass (2048-bit key) header.d=u256.net header.b="BIxec67w"; dkim=pass (2048-bit key) header.d=messagingengine.com header.b="iYPJKGqd" Received: from smtp4.osuosl.org ([127.0.0.1]) by localhost (smtp4.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G73uzU-4Vule for ; Thu, 20 May 2021 13:36:01 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.8.0 Received: from out3-smtp.messagingengine.com (out3-smtp.messagingengine.com [66.111.4.27]) by smtp4.osuosl.org (Postfix) with ESMTPS id 075C7404B5 for ; Thu, 20 May 2021 13:36:00 +0000 (UTC) Received: from compute5.internal (compute5.nyi.internal [10.202.2.45]) by mailout.nyi.internal (Postfix) with ESMTP id 856055C01B7 for ; Thu, 20 May 2021 09:35:59 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute5.internal (MEProxy); Thu, 20 May 2021 09:35:59 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=u256.net; h=from :to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; s=fm1; bh=4ya0fOHV8i/13olTgTVfox7loI 75eJhqhxCM+suIZyk=; b=BIxec67wPAOlh0iXEZrIba6JR6hc0j9hVCZTCTY1hU WujnjcWDICzCddPclF8Bqt5sKxG8i03nmE3beWQqNWdK9ktdoh52vZvWsWDUGIEi vUqclncZtfHqEOgk+GrszaJteI4Sw6HsccAZ0KhVmYK2eJpuarRXB/J/1cwQqjk5 xJ6wVO9DXp1jLpRxK+Wk1BiE+Fryo6JbZs4k1iZ3SrMLYnO1ZTGQgNvMQhQyZDd5 WtK1884pAWoPgbiKzYOf9MFYX78iBX7/1J3MIGV5fLcgHOpw93Ta1LkD9t6mJ1P2 rcaFgjLP2Ujuy7SnS2piB7vdPc016kSk8oonZNQfAK6w== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-transfer-encoding:date:from :in-reply-to:message-id:mime-version:references:subject:to :x-me-proxy:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s= fm2; bh=4ya0fOHV8i/13olTgTVfox7loI75eJhqhxCM+suIZyk=; b=iYPJKGqd /D+sLCcC53a6GTLw0YQivlLThGzIA0Hsn9HHRJIE7CgOmwISlSFZZHXFj6sUCPlK TmHwFG8LrG/ymqCefTuip0A0bXx8hEH0iknhxQsj5OC3nVVKCQ0Gp4hwDyykuDtZ XbjVjYybHXA0nPk+5XAOgp5iRIRHa9HrGnPwe4HAE1tOBhKs23ajSLykcnS/8nV4 qT1V6jFz8Yqd0rb9WTYZVSXdd7qiuB6bzK7mxM7V15IgWmdjO9+sTytmFs4nhLzr UB7vpFj2zYGf6hez8jXk6mHFZXT7/9VfQaw8c61ZhkVxqKEHINpoJzAAZeTzshmA hp014yB1fgjbZg== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduledrvdejuddgieeiucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefhvffufffkofgjfhgggfestdekre dtredttdenucfhrhhomhepifgrvghtrghnucftihhvvghtuceoghhrihhvvgesuhdvheei rdhnvghtqeenucggtffrrghtthgvrhhnpeduhfefieekieeiudetgfehkeeludektdekje ehudehffetieduheeigfekvdelfeenucffohhmrghinheprghprggthhgvrdhorhhgnecu kfhppeekiedrvdehgedrvdegfedrudegieenucevlhhushhtvghrufhiiigvpedtnecurf grrhgrmhepmhgrihhlfhhrohhmpehgrhhivhgvsehuvdehiedrnhgvth X-ME-Proxy: Received: from inocybe.home (lfbn-poi-1-930-146.w86-254.abo.wanadoo.fr [86.254.243.146]) by mail.messagingengine.com (Postfix) with ESMTPA for ; Thu, 20 May 2021 09:35:59 -0400 (EDT) From: Gaetan Rivet To: ovs-dev@openvswitch.org Date: Thu, 20 May 2021 15:35:48 +0200 Message-Id: <8f94d7e841a268b797b861a3f75cbdfe3fa1d791.1621517561.git.grive@u256.net> X-Mailer: git-send-email 2.31.1 In-Reply-To: References: MIME-Version: 1.0 Subject: [ovs-dev] [PATCH v2 4/8] tests: Add ASAN use-after-free validation with RCU X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ovs-dev-bounces@openvswitch.org Sender: "dev" When using the RCU mechanism and deferring memory reclamation, potential use-after-free due to incorrect use of RCU can be hidden. Add a test triggering a UAF event. When the test suite is built with AddressSanitizer support, verify that the event triggers and the tool is usable with RCU. Signed-off-by: Gaetan Rivet --- tests/automake.mk | 1 + tests/library.at | 33 +++++++++++++++ tests/test-rcu-uaf.c | 98 ++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 132 insertions(+) create mode 100644 tests/test-rcu-uaf.c diff --git a/tests/automake.mk b/tests/automake.mk index a32abd41c..4420a3f7f 100644 --- a/tests/automake.mk +++ b/tests/automake.mk @@ -472,6 +472,7 @@ tests_ovstest_SOURCES = \ tests/test-packets.c \ tests/test-random.c \ tests/test-rcu.c \ + tests/test-rcu-uaf.c \ tests/test-reconnect.c \ tests/test-rstp.c \ tests/test-sflow.c \ diff --git a/tests/library.at b/tests/library.at index 6e8a154e5..4a549f77e 100644 --- a/tests/library.at +++ b/tests/library.at @@ -261,6 +261,39 @@ AT_KEYWORDS([rcu]) AT_CHECK([ovstest test-rcu], [0], []) AT_CLEANUP +AT_SETUP([rcu quiesce use-after-free detection]) +AT_SKIP_IF([test "$IS_WIN32" = "yes"]) +AT_SKIP_IF([test "$ASAN_ENABLED" = "no"]) +# SIGABRT + 128 +exit_status=134 +AT_KEYWORDS([rcu asan]) +AT_CHECK([ovstest test-rcu-uaf quiesce], [$exit_status], [ignore], [ignore]) +# ASAN report is expected on success. +rm asan.* +AT_CLEANUP + +AT_SETUP([rcu try-quiesce use-after-free detection]) +AT_SKIP_IF([test "$IS_WIN32" = "yes"]) +AT_SKIP_IF([test "$ASAN_ENABLED" = "no"]) +# SIGABRT + 128 +exit_status=134 +AT_KEYWORDS([rcu asan]) +AT_CHECK([ovstest test-rcu-uaf try-quiesce], [$exit_status], [ignore], [ignore]) +# ASAN report is expected on success. +rm asan.* +AT_CLEANUP + +AT_SETUP([rcu quiesce-start-end use-after-free detection]) +AT_SKIP_IF([test "$IS_WIN32" = "yes"]) +AT_SKIP_IF([test "$ASAN_ENABLED" = "no"]) +AT_KEYWORDS([rcu asan]) +# SIGABRT + 128 +exit_status=134 +AT_CHECK([ovstest test-rcu-uaf quiesce-start-end], [$exit_status], [ignore], [ignore]) +# ASAN report is expected on success. +rm asan.* +AT_CLEANUP + AT_SETUP([stopwatch module]) AT_CHECK([ovstest test-stopwatch], [0], [...... ], [ignore]) diff --git a/tests/test-rcu-uaf.c b/tests/test-rcu-uaf.c new file mode 100644 index 000000000..f97738795 --- /dev/null +++ b/tests/test-rcu-uaf.c @@ -0,0 +1,98 @@ +/* + * Copyright (c) 2021 NVIDIA Corporation. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include + +#include + +#include "ovs-thread.h" +#include "ovs-rcu.h" +#include "ovstest.h" +#include "util.h" + +enum ovsrcu_uaf_type { + OVSRCU_UAF_QUIESCE, + OVSRCU_UAF_TRY_QUIESCE, + OVSRCU_UAF_QUIESCE_START_END, +}; + +static void * +rcu_uaf_main(void *aux) +{ + enum ovsrcu_uaf_type *type = aux; + char *xx = xmalloc(2); + + xx[0] = 'a'; + ovsrcu_postpone(free, xx); + switch (*type) { + case OVSRCU_UAF_QUIESCE: + ovsrcu_quiesce(); + break; + case OVSRCU_UAF_TRY_QUIESCE: + while (ovsrcu_try_quiesce()) { + ; + } + break; + case OVSRCU_UAF_QUIESCE_START_END: + ovsrcu_quiesce_start(); + ovsrcu_quiesce_end(); + break; + default: + OVS_NOT_REACHED(); + } + xx[1] = 'b'; + + return NULL; +} + +static void +usage(char *test_name) +{ + fprintf(stderr, "Usage: %s \n", + test_name); +} + +static void +test_rcu_uaf(int argc, char *argv[]) +{ + char **args = argv + optind - 1; + enum ovsrcu_uaf_type type; + pthread_t quiescer; + + if (argc - optind != 1) { + usage(args[0]); + return; + } + + set_program_name(argv[0]); + + if (!strcmp(args[1], "quiesce")) { + type = OVSRCU_UAF_QUIESCE; + } else if (!strcmp(args[1], "try-quiesce")) { + type = OVSRCU_UAF_TRY_QUIESCE; + } else if (!strcmp(args[1], "quiesce-start-end")) { + type = OVSRCU_UAF_QUIESCE_START_END; + } else { + usage(args[0]); + return; + } + + /* Need to create a separate thread, to support try-quiesce. */ + quiescer = ovs_thread_create("rcu-uaf", rcu_uaf_main, &type); + xpthread_join(quiescer, NULL); +} + +OVSTEST_REGISTER("test-rcu-uaf", test_rcu_uaf);