332 lines · c
1// SPDX-License-Identifier: GPL-2.02/*3 * memfd GUP test-case4 * This tests memfd interactions with get_user_pages(). We require the5 * fuse_mnt.c program to provide a fake direct-IO FUSE mount-point for us. This6 * file-system delays _all_ reads by 1s and forces direct-IO. This means, any7 * read() on files in that file-system will pin the receive-buffer pages for at8 * least 1s via get_user_pages().9 *10 * We use this trick to race ADD_SEALS against a write on a memfd object. The11 * ADD_SEALS must fail if the memfd pages are still pinned. Note that we use12 * the read() syscall with our memory-mapped memfd object as receive buffer to13 * force the kernel to write into our memfd object.14 */15 16#define _GNU_SOURCE17#define __EXPORTED_HEADERS__18 19#include <errno.h>20#include <inttypes.h>21#include <limits.h>22#include <linux/falloc.h>23#include <fcntl.h>24#include <linux/memfd.h>25#include <linux/types.h>26#include <sched.h>27#include <stdio.h>28#include <stdlib.h>29#include <signal.h>30#include <string.h>31#include <sys/mman.h>32#include <sys/stat.h>33#include <sys/syscall.h>34#include <sys/wait.h>35#include <unistd.h>36 37#include "common.h"38 39#define MFD_DEF_SIZE 819240#define STACK_SIZE 6553641 42static size_t mfd_def_size = MFD_DEF_SIZE;43 44static int mfd_assert_new(const char *name, loff_t sz, unsigned int flags)45{46 int r, fd;47 48 fd = sys_memfd_create(name, flags);49 if (fd < 0) {50 printf("memfd_create(\"%s\", %u) failed: %m\n",51 name, flags);52 abort();53 }54 55 r = ftruncate(fd, sz);56 if (r < 0) {57 printf("ftruncate(%llu) failed: %m\n", (unsigned long long)sz);58 abort();59 }60 61 return fd;62}63 64static __u64 mfd_assert_get_seals(int fd)65{66 long r;67 68 r = fcntl(fd, F_GET_SEALS);69 if (r < 0) {70 printf("GET_SEALS(%d) failed: %m\n", fd);71 abort();72 }73 74 return r;75}76 77static void mfd_assert_has_seals(int fd, __u64 seals)78{79 __u64 s;80 81 s = mfd_assert_get_seals(fd);82 if (s != seals) {83 printf("%llu != %llu = GET_SEALS(%d)\n",84 (unsigned long long)seals, (unsigned long long)s, fd);85 abort();86 }87}88 89static void mfd_assert_add_seals(int fd, __u64 seals)90{91 long r;92 __u64 s;93 94 s = mfd_assert_get_seals(fd);95 r = fcntl(fd, F_ADD_SEALS, seals);96 if (r < 0) {97 printf("ADD_SEALS(%d, %llu -> %llu) failed: %m\n",98 fd, (unsigned long long)s, (unsigned long long)seals);99 abort();100 }101}102 103static int mfd_busy_add_seals(int fd, __u64 seals)104{105 long r;106 __u64 s;107 108 r = fcntl(fd, F_GET_SEALS);109 if (r < 0)110 s = 0;111 else112 s = r;113 114 r = fcntl(fd, F_ADD_SEALS, seals);115 if (r < 0 && errno != EBUSY) {116 printf("ADD_SEALS(%d, %llu -> %llu) didn't fail as expected with EBUSY: %m\n",117 fd, (unsigned long long)s, (unsigned long long)seals);118 abort();119 }120 121 return r;122}123 124static void *mfd_assert_mmap_shared(int fd)125{126 void *p;127 128 p = mmap(NULL,129 mfd_def_size,130 PROT_READ | PROT_WRITE,131 MAP_SHARED,132 fd,133 0);134 if (p == MAP_FAILED) {135 printf("mmap() failed: %m\n");136 abort();137 }138 139 return p;140}141 142static void *mfd_assert_mmap_private(int fd)143{144 void *p;145 146 p = mmap(NULL,147 mfd_def_size,148 PROT_READ | PROT_WRITE,149 MAP_PRIVATE,150 fd,151 0);152 if (p == MAP_FAILED) {153 printf("mmap() failed: %m\n");154 abort();155 }156 157 return p;158}159 160static int global_mfd = -1;161static void *global_p = NULL;162 163static int sealing_thread_fn(void *arg)164{165 int sig, r;166 167 /*168 * This thread first waits 200ms so any pending operation in the parent169 * is correctly started. After that, it tries to seal @global_mfd as170 * SEAL_WRITE. This _must_ fail as the parent thread has a read() into171 * that memory mapped object still ongoing.172 * We then wait one more second and try sealing again. This time it173 * must succeed as there shouldn't be anyone else pinning the pages.174 */175 176 /* wait 200ms for FUSE-request to be active */177 usleep(200000);178 179 /* unmount mapping before sealing to avoid i_mmap_writable failures */180 munmap(global_p, mfd_def_size);181 182 /* Try sealing the global file; expect EBUSY or success. Current183 * kernels will never succeed, but in the future, kernels might184 * implement page-replacements or other fancy ways to avoid racing185 * writes. */186 r = mfd_busy_add_seals(global_mfd, F_SEAL_WRITE);187 if (r >= 0) {188 printf("HURRAY! This kernel fixed GUP races!\n");189 } else {190 /* wait 1s more so the FUSE-request is done */191 sleep(1);192 193 /* try sealing the global file again */194 mfd_assert_add_seals(global_mfd, F_SEAL_WRITE);195 }196 197 return 0;198}199 200static pid_t spawn_sealing_thread(void)201{202 uint8_t *stack;203 pid_t pid;204 205 stack = malloc(STACK_SIZE);206 if (!stack) {207 printf("malloc(STACK_SIZE) failed: %m\n");208 abort();209 }210 211 pid = clone(sealing_thread_fn,212 stack + STACK_SIZE,213 SIGCHLD | CLONE_FILES | CLONE_FS | CLONE_VM,214 NULL);215 if (pid < 0) {216 printf("clone() failed: %m\n");217 abort();218 }219 220 return pid;221}222 223static void join_sealing_thread(pid_t pid)224{225 waitpid(pid, NULL, 0);226}227 228int main(int argc, char **argv)229{230 char *zero;231 int fd, mfd, r;232 void *p;233 int was_sealed;234 pid_t pid;235 236 if (argc < 2) {237 printf("error: please pass path to file in fuse_mnt mount-point\n");238 abort();239 }240 241 if (argc >= 3) {242 if (!strcmp(argv[2], "hugetlbfs")) {243 unsigned long hpage_size = default_huge_page_size();244 245 if (!hpage_size) {246 printf("Unable to determine huge page size\n");247 abort();248 }249 250 hugetlbfs_test = 1;251 mfd_def_size = hpage_size * 2;252 } else {253 printf("Unknown option: %s\n", argv[2]);254 abort();255 }256 }257 258 zero = calloc(sizeof(*zero), mfd_def_size);259 260 /* open FUSE memfd file for GUP testing */261 printf("opening: %s\n", argv[1]);262 fd = open(argv[1], O_RDONLY | O_CLOEXEC);263 if (fd < 0) {264 printf("cannot open(\"%s\"): %m\n", argv[1]);265 abort();266 }267 268 /* create new memfd-object */269 mfd = mfd_assert_new("kern_memfd_fuse",270 mfd_def_size,271 MFD_CLOEXEC | MFD_ALLOW_SEALING);272 273 /* mmap memfd-object for writing */274 p = mfd_assert_mmap_shared(mfd);275 276 /* pass mfd+mapping to a separate sealing-thread which tries to seal277 * the memfd objects with SEAL_WRITE while we write into it */278 global_mfd = mfd;279 global_p = p;280 pid = spawn_sealing_thread();281 282 /* Use read() on the FUSE file to read into our memory-mapped memfd283 * object. This races the other thread which tries to seal the284 * memfd-object.285 * If @fd is on the memfd-fake-FUSE-FS, the read() is delayed by 1s.286 * This guarantees that the receive-buffer is pinned for 1s until the287 * data is written into it. The racing ADD_SEALS should thus fail as288 * the pages are still pinned. */289 r = read(fd, p, mfd_def_size);290 if (r < 0) {291 printf("read() failed: %m\n");292 abort();293 } else if (!r) {294 printf("unexpected EOF on read()\n");295 abort();296 }297 298 was_sealed = mfd_assert_get_seals(mfd) & F_SEAL_WRITE;299 300 /* Wait for sealing-thread to finish and verify that it301 * successfully sealed the file after the second try. */302 join_sealing_thread(pid);303 mfd_assert_has_seals(mfd, F_SEAL_WRITE);304 305 /* *IF* the memfd-object was sealed at the time our read() returned,306 * then the kernel did a page-replacement or canceled the read() (or307 * whatever magic it did..). In that case, the memfd object is still308 * all zero.309 * In case the memfd-object was *not* sealed, the read() was successful310 * and the memfd object must *not* be all zero.311 * Note that in real scenarios, there might be a mixture of both, but312 * in this test-cases, we have explicit 200ms delays which should be313 * enough to avoid any in-flight writes. */314 315 p = mfd_assert_mmap_private(mfd);316 if (was_sealed && memcmp(p, zero, mfd_def_size)) {317 printf("memfd sealed during read() but data not discarded\n");318 abort();319 } else if (!was_sealed && !memcmp(p, zero, mfd_def_size)) {320 printf("memfd sealed after read() but data discarded\n");321 abort();322 }323 324 close(mfd);325 close(fd);326 327 printf("fuse: DONE\n");328 free(zero);329 330 return 0;331}332