1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2015 SUSE Linux. All Rights Reserved.
4 * Author: Jan Kara <jack@suse.cz>
5 *
6 * DESCRIPTION
7 * Test for inotify mark destruction race.
8 *
9 * Kernels prior to 4.2 have a race when inode is being deleted while
10 * inotify group watching that inode is being torn down. When the race is
11 * hit, the kernel crashes or loops.
12 *
13 * The problem has been fixed by commit:
14 * 8f2f3eb59dff "fsnotify: fix oops in fsnotify_clear_marks_by_group_flags()".
15 */
16
17 #include "config.h"
18
19 #include <stdio.h>
20 #include <unistd.h>
21 #include <stdlib.h>
22 #include <fcntl.h>
23 #include <time.h>
24 #include <signal.h>
25 #include <sys/time.h>
26 #include <sys/wait.h>
27 #include <sys/syscall.h>
28
29 #include "tst_test.h"
30 #include "inotify.h"
31
32 #if defined(HAVE_SYS_INOTIFY_H)
33 #include <sys/inotify.h>
34
35 /* Number of test loops to run the test for */
36 #define TEARDOWNS 400
37
38 /* Number of files to test (must be > 1) */
39 #define FILES 5
40
41 #define PROCFILE "/proc/sys/fs/inotify/max_user_instances"
42
43 static char names[FILES][PATH_MAX];
44 static pid_t pid;
45 static int old_proc_limit;
46
setup(void)47 static void setup(void)
48 {
49 int i;
50
51 for (i = 0; i < FILES; i++)
52 sprintf(names[i], "fname_%d", i);
53
54 SAFE_FILE_SCANF(PROCFILE, "%d", &old_proc_limit);
55
56 if (old_proc_limit >= 0 && old_proc_limit < TEARDOWNS)
57 SAFE_FILE_PRINTF(PROCFILE, "%d", TEARDOWNS + 128);
58 }
59
verify_inotify(void)60 static void verify_inotify(void)
61 {
62 int inotify_fd, fd;
63 int i, tests;
64
65 pid = SAFE_FORK();
66 if (pid == 0) {
67 while (1) {
68 for (i = 0; i < FILES; i++) {
69 fd = SAFE_OPEN(names[i], O_CREAT | O_RDWR, 0600);
70 SAFE_CLOSE(fd);
71 }
72 for (i = 0; i < FILES; i++)
73 SAFE_UNLINK(names[i]);
74 }
75 }
76
77 for (tests = 0; tests < TEARDOWNS; tests++) {
78 inotify_fd = SAFE_MYINOTIFY_INIT1(O_NONBLOCK);
79
80 for (i = 0; i < FILES; i++) {
81 /*
82 * Both failure and success are fine since
83 * files are being deleted in parallel - this
84 * is what provokes the race we want to test
85 * for...
86 */
87 myinotify_add_watch(inotify_fd, names[i], IN_MODIFY);
88 }
89 SAFE_CLOSE(inotify_fd);
90
91 if (!tst_remaining_runtime()) {
92 tst_res(TINFO, "Test out of runtime, exiting");
93 break;
94 }
95 }
96 /* We survived for given time - test succeeded */
97 tst_res(TPASS, "kernel survived inotify beating");
98
99 /* Kill the child creating / deleting files and wait for it */
100 SAFE_KILL(pid, SIGKILL);
101 pid = 0;
102 SAFE_WAIT(NULL);
103 }
104
cleanup(void)105 static void cleanup(void)
106 {
107 if (pid) {
108 SAFE_KILL(pid, SIGKILL);
109 SAFE_WAIT(NULL);
110 }
111
112 SAFE_FILE_PRINTF(PROCFILE, "%d", old_proc_limit);
113 }
114
115 static struct tst_test test = {
116 .max_runtime = 600,
117 .needs_root = 1,
118 .needs_tmpdir = 1,
119 .forks_child = 1,
120 .setup = setup,
121 .cleanup = cleanup,
122 .test_all = verify_inotify,
123 };
124
125 #else
126 TST_TEST_TCONF("system doesn't have required inotify support");
127 #endif
128