1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (C) 2021 SUSE LLC <[email protected]>
4 */
5
6 /*\
7 * [Description]
8 *
9 * Check for potential issues in writev() if the first iovec entry is NULL
10 * and the next one is not present in RAM. This can result in a brief window
11 * where writev() first writes uninitialized data into the file (possibly
12 * exposing internal kernel structures) and then overwrites it with the real
13 * iovec contents later.
14 */
15
16 /*
17 * Bugs fixed in:
18 * commit d4690f1e1cdabb4d61207b6787b1605a0dc0aeab
19 * Author: Al Viro <[email protected]>
20 * Date: Fri Sep 16 00:11:45 2016 +0100
21 *
22 * fix iov_iter_fault_in_readable()
23 */
24
25 #include <sys/uio.h>
26 #include "tst_test.h"
27 #include "tst_atomic.h"
28 #include "tst_fuzzy_sync.h"
29
30 #define CHUNK_SIZE 256
31 #define BUF_SIZE (2 * CHUNK_SIZE)
32 #define MNTPOINT "mntpoint"
33 #define TEMPFILE MNTPOINT "/test_file"
34 #define MAPFILE MNTPOINT "/map_file"
35
36 static unsigned char buf[BUF_SIZE], *map_ptr;
37 static int mapfd = -1, writefd = -1, readfd = -1;
38 static int written;
39 static struct tst_fzsync_pair fzsync_pair;
40 struct iovec iov[5];
41
setup(void)42 static void setup(void)
43 {
44 int i;
45
46 for (i = 0; i < BUF_SIZE; i++)
47 buf[i] = i & 0xff;
48
49 mapfd = SAFE_OPEN(MAPFILE, O_CREAT|O_RDWR|O_TRUNC, 0644);
50 SAFE_WRITE(SAFE_WRITE_ALL, mapfd, buf, BUF_SIZE);
51
52 tst_fzsync_pair_init(&fzsync_pair);
53 }
54
thread_run(void * arg)55 static void *thread_run(void *arg)
56 {
57 while (tst_fzsync_run_b(&fzsync_pair)) {
58 writefd = SAFE_OPEN(TEMPFILE, O_CREAT|O_WRONLY|O_TRUNC, 0644);
59 written = BUF_SIZE;
60 tst_fzsync_wait_b(&fzsync_pair);
61
62 /*
63 * Do *NOT* preload the data using MAP_POPULATE or touching
64 * the mapped range. We're testing whether writev() handles
65 * fault-in correctly.
66 */
67 map_ptr = SAFE_MMAP(NULL, BUF_SIZE, PROT_READ, MAP_SHARED,
68 mapfd, 0);
69 iov[1].iov_base = map_ptr;
70 iov[1].iov_len = CHUNK_SIZE;
71 iov[3].iov_base = map_ptr + CHUNK_SIZE;
72 iov[3].iov_len = CHUNK_SIZE;
73
74 tst_fzsync_start_race_b(&fzsync_pair);
75 tst_atomic_store(writev(writefd, iov, ARRAY_SIZE(iov)),
76 &written);
77 tst_fzsync_end_race_b(&fzsync_pair);
78
79 SAFE_MUNMAP(map_ptr, BUF_SIZE);
80 map_ptr = NULL;
81 SAFE_CLOSE(writefd);
82 }
83
84 return arg;
85 }
86
run(void)87 static void run(void)
88 {
89 int total_read;
90 unsigned char readbuf[BUF_SIZE + 1];
91
92 tst_fzsync_pair_reset(&fzsync_pair, thread_run);
93
94 while (tst_fzsync_run_a(&fzsync_pair)) {
95 tst_fzsync_wait_a(&fzsync_pair);
96 readfd = SAFE_OPEN(TEMPFILE, O_RDONLY);
97 tst_fzsync_start_race_a(&fzsync_pair);
98
99 for (total_read = 0; total_read < tst_atomic_load(&written);) {
100 total_read += SAFE_READ(0, readfd, readbuf+total_read,
101 BUF_SIZE + 1 - total_read);
102 }
103
104 tst_fzsync_end_race_a(&fzsync_pair);
105 SAFE_CLOSE(readfd);
106
107 if (total_read > BUF_SIZE)
108 tst_brk(TBROK, "writev() wrote too much data");
109
110 if (total_read <= 0)
111 continue;
112
113 if (memcmp(readbuf, buf, total_read)) {
114 tst_res(TFAIL, "writev() wrote invalid data");
115 return;
116 }
117 }
118
119 tst_res(TPASS, "writev() handles page fault-in correctly");
120 }
121
cleanup(void)122 static void cleanup(void)
123 {
124 if (map_ptr && map_ptr != MAP_FAILED)
125 SAFE_MUNMAP(map_ptr, BUF_SIZE);
126
127 if (mapfd >= 0)
128 SAFE_CLOSE(mapfd);
129
130 if (readfd >= 0)
131 SAFE_CLOSE(readfd);
132
133 if (writefd >= 0)
134 SAFE_CLOSE(writefd);
135
136 tst_fzsync_pair_cleanup(&fzsync_pair);
137 }
138
139 static struct tst_test test = {
140 .test_all = run,
141 .needs_root = 1,
142 .mount_device = 1,
143 .mntpoint = MNTPOINT,
144 .all_filesystems = 1,
145 .min_cpus = 2,
146 .setup = setup,
147 .cleanup = cleanup,
148 .max_runtime = 75,
149 .tags = (const struct tst_tag[]) {
150 {"linux-git", "d4690f1e1cda"},
151 {}
152 }
153 };
154