1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2015 SUSE Linux. All Rights Reserved.
4 * Author: Jan Kara <[email protected]>
5 */
6
7 /*\
8 * [Description]
9 *
10 * Test for inotify mark destruction race.
11 *
12 * Kernels prior to 4.2 have a race when inode is being deleted while
13 * inotify group watching that inode is being torn down. When the race is
14 * hit, the kernel crashes or loops.
15 *
16 * The problem has been fixed by commit:
17 * 8f2f3eb59dff ("fsnotify: fix oops in fsnotify_clear_marks_by_group_flags()").
18 */
19
20 #include "config.h"
21
22 #include <stdio.h>
23 #include <unistd.h>
24 #include <stdlib.h>
25 #include <fcntl.h>
26 #include <time.h>
27 #include <signal.h>
28 #include <sys/time.h>
29 #include <sys/wait.h>
30 #include <sys/syscall.h>
31
32 #include "tst_test.h"
33 #include "inotify.h"
34
35 #if defined(HAVE_SYS_INOTIFY_H)
36 #include <sys/inotify.h>
37
38 /* Number of test loops to run the test for */
39 #define TEARDOWNS 400
40
41 /* Number of files to test (must be > 1) */
42 #define FILES 5
43
44 #define PROCFILE "/proc/sys/fs/inotify/max_user_instances"
45
46 static char names[FILES][PATH_MAX];
47 static pid_t pid;
48 static int old_proc_limit;
49
setup(void)50 static void setup(void)
51 {
52 int i;
53
54 for (i = 0; i < FILES; i++)
55 sprintf(names[i], "fname_%d", i);
56
57 SAFE_FILE_SCANF(PROCFILE, "%d", &old_proc_limit);
58
59 if (old_proc_limit >= 0 && old_proc_limit < TEARDOWNS)
60 SAFE_FILE_PRINTF(PROCFILE, "%d", TEARDOWNS + 128);
61 }
62
verify_inotify(void)63 static void verify_inotify(void)
64 {
65 int inotify_fd, fd;
66 int i, tests;
67
68 pid = SAFE_FORK();
69 if (pid == 0) {
70 while (1) {
71 for (i = 0; i < FILES; i++) {
72 fd = SAFE_OPEN(names[i], O_CREAT | O_RDWR, 0600);
73 SAFE_CLOSE(fd);
74 }
75 for (i = 0; i < FILES; i++)
76 SAFE_UNLINK(names[i]);
77 }
78 }
79
80 for (tests = 0; tests < TEARDOWNS; tests++) {
81 inotify_fd = SAFE_MYINOTIFY_INIT1(O_NONBLOCK);
82
83 for (i = 0; i < FILES; i++) {
84 /*
85 * Both failure and success are fine since
86 * files are being deleted in parallel - this
87 * is what provokes the race we want to test
88 * for...
89 */
90 myinotify_add_watch(inotify_fd, names[i], IN_MODIFY);
91 }
92 SAFE_CLOSE(inotify_fd);
93
94 if (!tst_remaining_runtime()) {
95 tst_res(TINFO, "Test out of runtime, exiting");
96 break;
97 }
98 }
99 /* We survived for given time - test succeeded */
100 tst_res(TPASS, "kernel survived inotify beating");
101
102 /* Kill the child creating / deleting files and wait for it */
103 SAFE_KILL(pid, SIGKILL);
104 pid = 0;
105 SAFE_WAIT(NULL);
106 }
107
cleanup(void)108 static void cleanup(void)
109 {
110 if (pid) {
111 SAFE_KILL(pid, SIGKILL);
112 SAFE_WAIT(NULL);
113 }
114
115 SAFE_FILE_PRINTF(PROCFILE, "%d", old_proc_limit);
116 }
117
118 static struct tst_test test = {
119 .max_runtime = 600,
120 .needs_root = 1,
121 .needs_tmpdir = 1,
122 .forks_child = 1,
123 .setup = setup,
124 .cleanup = cleanup,
125 .test_all = verify_inotify,
126 };
127
128 #else
129 TST_TEST_TCONF("system doesn't have required inotify support");
130 #endif
131