android13/external/ltp/testcases/kernel/syscalls/writev/writev03.c

154 lines
3.4 KiB
C

// SPDX-License-Identifier: GPL-2.0-or-later
/*
* Copyright (C) 2021 SUSE LLC <mdoucha@suse.cz>
*/
/*\
* [Description]
*
* Check for potential issues in writev() if the first iovec entry is NULL
* and the next one is not present in RAM. This can result in a brief window
* where writev() first writes uninitialized data into the file (possibly
* exposing internal kernel structures) and then overwrites it with the real
* iovec contents later.
*/
/*
* Bugs fixed in:
* commit d4690f1e1cdabb4d61207b6787b1605a0dc0aeab
* Author: Al Viro <viro@ZenIV.linux.org.uk>
* Date: Fri Sep 16 00:11:45 2016 +0100
*
* fix iov_iter_fault_in_readable()
*/
#include <sys/uio.h>
#include "tst_test.h"
#include "tst_atomic.h"
#include "tst_fuzzy_sync.h"
#define CHUNK_SIZE 256
#define BUF_SIZE (2 * CHUNK_SIZE)
#define MNTPOINT "mntpoint"
#define TEMPFILE MNTPOINT "/test_file"
#define MAPFILE MNTPOINT "/map_file"
static unsigned char buf[BUF_SIZE], *map_ptr;
static int mapfd = -1, writefd = -1, readfd = -1;
static int written;
static struct tst_fzsync_pair fzsync_pair;
struct iovec iov[5];
static void setup(void)
{
int i;
for (i = 0; i < BUF_SIZE; i++)
buf[i] = i & 0xff;
mapfd = SAFE_OPEN(MAPFILE, O_CREAT|O_RDWR|O_TRUNC, 0644);
SAFE_WRITE(1, mapfd, buf, BUF_SIZE);
fzsync_pair.exec_time_p = 0.25;
tst_fzsync_pair_init(&fzsync_pair);
}
static void *thread_run(void *arg)
{
while (tst_fzsync_run_b(&fzsync_pair)) {
writefd = SAFE_OPEN(TEMPFILE, O_CREAT|O_WRONLY|O_TRUNC, 0644);
written = BUF_SIZE;
tst_fzsync_wait_b(&fzsync_pair);
/*
* Do *NOT* preload the data using MAP_POPULATE or touching
* the mapped range. We're testing whether writev() handles
* fault-in correctly.
*/
map_ptr = SAFE_MMAP(NULL, BUF_SIZE, PROT_READ, MAP_SHARED,
mapfd, 0);
iov[1].iov_base = map_ptr;
iov[1].iov_len = CHUNK_SIZE;
iov[3].iov_base = map_ptr + CHUNK_SIZE;
iov[3].iov_len = CHUNK_SIZE;
tst_fzsync_start_race_b(&fzsync_pair);
tst_atomic_store(writev(writefd, iov, ARRAY_SIZE(iov)),
&written);
tst_fzsync_end_race_b(&fzsync_pair);
SAFE_MUNMAP(map_ptr, BUF_SIZE);
map_ptr = NULL;
SAFE_CLOSE(writefd);
}
return arg;
}
static void run(void)
{
int total_read;
unsigned char readbuf[BUF_SIZE + 1];
tst_fzsync_pair_reset(&fzsync_pair, thread_run);
while (tst_fzsync_run_a(&fzsync_pair)) {
tst_fzsync_wait_a(&fzsync_pair);
readfd = SAFE_OPEN(TEMPFILE, O_RDONLY);
tst_fzsync_start_race_a(&fzsync_pair);
for (total_read = 0; total_read < tst_atomic_load(&written);) {
total_read += SAFE_READ(0, readfd, readbuf+total_read,
BUF_SIZE + 1 - total_read);
}
tst_fzsync_end_race_a(&fzsync_pair);
SAFE_CLOSE(readfd);
if (total_read > BUF_SIZE)
tst_brk(TBROK, "writev() wrote too much data");
if (total_read <= 0)
continue;
if (memcmp(readbuf, buf, total_read)) {
tst_res(TFAIL, "writev() wrote invalid data");
return;
}
}
tst_res(TPASS, "writev() handles page fault-in correctly");
}
static void cleanup(void)
{
if (map_ptr && map_ptr != MAP_FAILED)
SAFE_MUNMAP(map_ptr, BUF_SIZE);
if (mapfd >= 0)
SAFE_CLOSE(mapfd);
if (readfd >= 0)
SAFE_CLOSE(readfd);
if (writefd >= 0)
SAFE_CLOSE(writefd);
tst_fzsync_pair_cleanup(&fzsync_pair);
}
static struct tst_test test = {
.test_all = run,
.needs_root = 1,
.mount_device = 1,
.mntpoint = MNTPOINT,
.all_filesystems = 1,
.min_cpus = 2,
.setup = setup,
.cleanup = cleanup,
.tags = (const struct tst_tag[]) {
{"linux-git", "d4690f1e1cda"},
{}
}
};