android13/external/ltp/testcases/kernel/syscalls/mmap/mmap16.c

/*
 *   Copyright (c) 2015 Fujitsu Ltd.
 *   Author: Xiaoguang Wang <wangxg.fnst@cn.fujitsu.com>
 *
 *   This program is free software;  you can redistribute it and/or modify
 *   it under the terms of the GNU General Public License as published by
 *   the Free Software Foundation; either version 2 of the License, or
 *   (at your option) any later version.
 *
 *   This program is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY;  without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
 *   the GNU General Public License for more details.
 */

/*
 * This is a regression test for commit:
 * http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/
 * commit/?id=90a8020
 * http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/
 * commit/?id=d6320cb
 */

#define _GNU_SOURCE

#include <stdio.h>
#include <errno.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <sys/mount.h>
#include <sys/mman.h>

#include "test.h"
#include "safe_macros.h"

#define MNTPOINT	"mntpoint"
#define FS_BLOCKSIZE	1024
#define SUB_LOOPCOUNT	10

static void setup(void);
static void cleanup(void);
static void do_child(void);
static void do_test(void);

static const char *device;
static const char *fs_type = "ext4";
static int mount_flag;
static int chdir_flag;
static int parentfd = -1;

static int page_size;
static int bug_reproduced;

char *TCID = "mmap16";
int TST_TOTAL = 1;

int main(int ac, char **av)
{
	int i, lc;

	tst_parse_opts(ac, av, NULL, NULL);

	setup();

	/*
	 * If child process was killed by SIGBUS, indeed that can not guarantee
	 * this bug must have been fixed, If we're luckily enough, virtual
	 * memory subsystem happen to decide that it is time to write dirty
	 * pages, it will make mapped pages write-protect, so ->page_mkwrite()
	 * still will be called, child process will be killed by SIGBUS, but
	 * it's not because of above fixing patches. So here we run this test
	 * 10 times, if once, child process exits normally, we can sure that
	 * this bug is not fixed.
	 */
	for (lc = 0; TEST_LOOPING(lc); lc++) {
		tst_count = 0;

		for (i = 0; i < SUB_LOOPCOUNT; i++)
			do_test();
	}

	if (bug_reproduced)
		tst_resm(TFAIL, "Bug is reproduced!");
	else
		tst_resm(TPASS, "Bug is not reproduced!");

	cleanup();
	tst_exit();
}

static void do_test(void)
{
	int ret, status;
	pid_t child;
	char buf[FS_BLOCKSIZE];

	SAFE_TOUCH(cleanup, "testfilep", 0644, NULL);
	SAFE_TOUCH(cleanup, "testfilec", 0644, NULL);

	child = tst_fork();
	switch (child) {
	case -1:
		tst_brkm(TBROK | TERRNO, cleanup, "fork failed");
	case 0:
		do_child();
	default:
		parentfd = SAFE_OPEN(cleanup, "testfilep", O_RDWR);
		memset(buf, 'a', FS_BLOCKSIZE);

		TST_SAFE_CHECKPOINT_WAIT(cleanup, 0);
		while (1) {
			ret = write(parentfd, buf, FS_BLOCKSIZE);
			if (ret < 0) {
				if (errno == ENOSPC) {
					break;
				} else {
					tst_brkm(TBROK | TERRNO, cleanup,
						 "write failed unexpectedly");
				}
			}
		}
		SAFE_CLOSE(cleanup, parentfd);
		TST_SAFE_CHECKPOINT_WAKE(cleanup, 0);
	}

	wait(&status);
	if (WIFEXITED(status) && WEXITSTATUS(status) == 1) {
		bug_reproduced = 1;
	} else {
		/*
		 * If child process was killed by SIGBUS, bug is not reproduced.
		 */
		if (!WIFSIGNALED(status) || WTERMSIG(status) != SIGBUS) {
			tst_brkm(TBROK | TERRNO, cleanup,
				 "child process terminate unexpectedly");
		}
	}

	SAFE_UNLINK(cleanup, "testfilep");
	SAFE_UNLINK(cleanup, "testfilec");
}

static void setup(void)
{
	const char *fs_opts[3] = {"-b", "1024", NULL};
	const char *extra_opts[] = {"10240", NULL};

	tst_sig(FORK, DEF_HANDLER, NULL);
	tst_require_root();

	TEST_PAUSE;
	tst_tmpdir();

	TST_CHECKPOINT_INIT(tst_rmdir);

	page_size = getpagesize();

	device = tst_acquire_device(cleanup);
	if (!device)
		tst_brkm(TCONF, cleanup, "Failed to obtain block device");
	tst_mkfs(cleanup, device, fs_type, fs_opts, extra_opts);

	SAFE_MKDIR(cleanup, MNTPOINT, 0755);
	/*
	 * Disable ext4 delalloc feature, so block will be allocated
	 * as soon as possible
	 */
	SAFE_MOUNT(cleanup, device, MNTPOINT, fs_type, 0, "nodelalloc");
	mount_flag = 1;

	SAFE_CHDIR(cleanup, MNTPOINT);
	chdir_flag = 1;

}

static void do_child(void)
{
	int fd, offset;
	char buf[FS_BLOCKSIZE];
	char *addr = NULL;

	/*
	 * We have changed SIGBUS' handler in parent process by calling
	 * tst_sig(FORK, DEF_HANDLER, NULL), so here just restore it.
	 */
	if (signal(SIGBUS, SIG_DFL) == SIG_ERR)
		tst_brkm(TBROK | TERRNO, NULL, "signal(SIGBUS) failed");

	memset(buf, 'a', FS_BLOCKSIZE);
	fd = SAFE_OPEN(NULL, "testfilec", O_RDWR);
	SAFE_WRITE(NULL, 1, fd, buf, FS_BLOCKSIZE);

	/*
	 * In case mremap() may fail because that memory area can not be
	 * expanded at current virtual address(MREMAP_MAYMOVE is not set),
	 * we first do a mmap(page_size * 2) operation to reserve some
	 * free address space.
	 */
	addr = SAFE_MMAP(NULL, NULL, page_size * 2, PROT_WRITE | PROT_READ,
			 MAP_PRIVATE_EXCEPT_UCLINUX | MAP_ANONYMOUS, -1, 0);
	SAFE_MUNMAP(NULL, addr, page_size * 2);

	addr = SAFE_MMAP(NULL, addr, FS_BLOCKSIZE, PROT_WRITE | PROT_READ,
			 MAP_SHARED, fd, 0);

	addr[0] = 'a';

	SAFE_FTRUNCATE(NULL, fd, page_size * 2);
	addr = mremap(addr, FS_BLOCKSIZE, 2 * page_size, 0);
	if (addr == MAP_FAILED)
		tst_brkm(TBROK | TERRNO, NULL, "mremap failed unexpectedly");

	/*
	 * Let parent process consume FS free blocks as many as possible, then
	 * there'll be no free blocks allocated for this new file mmaping for
	 * offset starting at 1024, 2048, or 3072. If this above kernel bug
	 * has been fixed, usually child process will killed by SIGBUS signal,
	 * if not, the data 'A', 'B', 'C' will be silently discarded later when
	 * kernel writepage is called, that means data corruption.
	 */
	TST_SAFE_CHECKPOINT_WAKE(NULL, 0);
	TST_SAFE_CHECKPOINT_WAIT2(NULL, 0, 60*1000);

	for (offset = FS_BLOCKSIZE; offset < page_size; offset += FS_BLOCKSIZE)
		addr[offset] = 'a';

	SAFE_MUNMAP(NULL, addr, 2 * page_size);
	SAFE_CLOSE(NULL, fd);
	exit(TFAIL);
}

static void cleanup(void)
{
	if (parentfd >= 0)
		close(parentfd);
	if (chdir_flag && chdir(".."))
		tst_resm(TWARN | TERRNO, "chdir('..') failed");
	if (mount_flag && tst_umount(MNTPOINT) < 0)
		tst_resm(TWARN | TERRNO, "umount device:%s failed", device);
	if (device)
		tst_release_device(device);
	tst_rmdir();
}