1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2015-2017 Red Hat, Inc.
4 *
5 * DESCRIPTION
6 *
7 * There is a race condition if we map a same file on different processes.
8 * Region tracking is protected by mmap_sem and hugetlb_instantiation_mutex.
9 * When we do mmap, we don't grab a hugetlb_instantiation_mutex, but only
10 * mmap_sem (exclusively). This doesn't prevent other tasks from modifying
11 * the region structure, so it can be modified by two processes concurrently.
12 *
13 * This bug was fixed on stable kernel by commits:
14 * f522c3ac00a4(mm, hugetlb: change variable name reservations to resv)
15 * 9119a41e9091(mm, hugetlb: unify region structure handling)
16 * 7b24d8616be3(mm, hugetlb: fix race in region tracking)
17 * 1406ec9ba6c6(mm, hugetlb: improve, cleanup resv_map parameters)
18 *
19 * AUTHOR:
20 * Herton R. Krzesinski <herton@redhat.com>
21 * Li Wang <liwang@redhat.com>
22 */
23
24 #define _GNU_SOURCE
25 #include <pthread.h>
26 #include <stdio.h>
27 #include "hugetlb.h"
28 #include "lapi/mmap.h"
29
30 static long hpage_size;
31
32 struct mp {
33 char *addr;
34 int sz;
35 };
36
37 #define ARSZ 50
38 #define LOOP 5
39
setup(void)40 static void setup(void)
41 {
42 if (tst_hugepages != test.request_hugepages)
43 tst_brk(TCONF, "System RAM is not enough to test.");
44 hpage_size = SAFE_READ_MEMINFO("Hugepagesize:") * 1024;
45 }
46
thr(void * arg)47 static void *thr(void *arg)
48 {
49 struct mp *mmap_sz = arg;
50 int i, lim, a, b, c;
51
52 srand(time(NULL));
53 lim = rand() % 10;
54 for (i = 0; i < lim; i++) {
55 a = rand() % mmap_sz->sz;
56 for (c = 0; c <= a; c++) {
57 b = rand() % mmap_sz->sz;
58 *(mmap_sz->addr + b * hpage_size) = rand();
59 }
60 }
61 return NULL;
62 }
63
do_mmap(unsigned int j LTP_ATTRIBUTE_UNUSED)64 static void do_mmap(unsigned int j LTP_ATTRIBUTE_UNUSED)
65 {
66 int i, sz = ARSZ + 1;
67 void *addr, *new_addr;
68 struct mp mmap_sz[ARSZ];
69 pthread_t tid[ARSZ];
70
71 addr = mmap(NULL, sz * hpage_size,
72 PROT_READ | PROT_WRITE,
73 MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB,
74 -1, 0);
75
76 if (addr == MAP_FAILED) {
77 if (errno == ENOMEM) {
78 tst_brk(TCONF,
79 "Cannot allocate hugepage, memory too fragmented?");
80 }
81
82 tst_brk(TBROK | TERRNO, "Cannot allocate hugepage");
83 }
84
85 for (i = 0; i < ARSZ; ++i, --sz) {
86 mmap_sz[i].sz = sz;
87 mmap_sz[i].addr = addr;
88
89 TEST(pthread_create(&tid[i], NULL, thr, &mmap_sz[i]));
90 if (TST_RET)
91 tst_brk(TBROK | TRERRNO,
92 "pthread_create failed");
93
94 new_addr = mmap(addr, (sz - 1) * hpage_size,
95 PROT_READ | PROT_WRITE,
96 MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB | MAP_FIXED,
97 -1, 0);
98
99 if (new_addr == MAP_FAILED)
100 tst_brk(TFAIL | TERRNO, "mmap failed");
101
102 addr = new_addr;
103 }
104
105 for (i = 0; i < ARSZ; ++i) {
106 TEST(pthread_join(tid[i], NULL));
107 if (TST_RET)
108 tst_brk(TBROK | TRERRNO,
109 "pthread_join failed");
110 }
111
112 if (munmap(addr, sz * hpage_size) == -1)
113 tst_brk(TFAIL | TERRNO, "huge munmap failed");
114
115 tst_res(TPASS, "No regression found.");
116 }
117
118 static struct tst_test test = {
119 .min_kver = "2.6.32",
120 .needs_root = 1,
121 .tcnt = LOOP,
122 .needs_tmpdir = 1,
123 .test = do_mmap,
124 .setup = setup,
125 .request_hugepages = (ARSZ + 1) * LOOP,
126 .tags = (const struct tst_tag[]) {
127 {"linux-git", "f522c3ac00a4"},
128 {"linux-git", "9119a41e9091"},
129 {"linux-git", "7b24d8616be3"},
130 {"linux-git", "1406ec9ba6c6"},
131 {}
132 }
133 };
134