1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2015 SUSE Linux. All Rights Reserved.
4 * Author: Jan Kara <jack@suse.cz>
5 *
6 * DESCRIPTION
7 * Test for inotify mark destruction race.
8 *
9 * Kernels prior to 4.2 have a race when inode is being deleted while
10 * inotify group watching that inode is being torn down. When the race is
11 * hit, the kernel crashes or loops.
12 *
13 * The problem has been fixed by commit:
14 * 8f2f3eb59dff "fsnotify: fix oops in fsnotify_clear_marks_by_group_flags()".
15 */
16
17 #include "config.h"
18
19 #include <stdio.h>
20 #include <unistd.h>
21 #include <stdlib.h>
22 #include <fcntl.h>
23 #include <time.h>
24 #include <signal.h>
25 #include <sys/time.h>
26 #include <sys/wait.h>
27 #include <sys/syscall.h>
28
29 #include "tst_test.h"
30 #include "inotify.h"
31
32 #if defined(HAVE_SYS_INOTIFY_H)
33 #include <sys/inotify.h>
34
35 /* Number of test loops to run the test for */
36 #define TEARDOWNS 400
37
38 /* Number of files to test (must be > 1) */
39 #define FILES 5
40
41 #define PROCFILE "/proc/sys/fs/inotify/max_user_instances"
42
43 static char names[FILES][PATH_MAX];
44 static pid_t pid;
45 static int old_proc_limit;
46
setup(void)47 static void setup(void)
48 {
49 int i;
50
51 for (i = 0; i < FILES; i++)
52 sprintf(names[i], "fname_%d", i);
53
54 SAFE_FILE_SCANF(PROCFILE, "%d", &old_proc_limit);
55
56 if (old_proc_limit >= 0 && old_proc_limit < TEARDOWNS)
57 SAFE_FILE_PRINTF(PROCFILE, "%d", TEARDOWNS + 128);
58 }
59
verify_inotify(void)60 static void verify_inotify(void)
61 {
62 int inotify_fd, fd;
63 int i, tests;
64
65 pid = SAFE_FORK();
66 if (pid == 0) {
67 while (1) {
68 for (i = 0; i < FILES; i++) {
69 fd = SAFE_OPEN(names[i], O_CREAT | O_RDWR, 0600);
70 SAFE_CLOSE(fd);
71 }
72 for (i = 0; i < FILES; i++)
73 SAFE_UNLINK(names[i]);
74 }
75 }
76
77 for (tests = 0; tests < TEARDOWNS; tests++) {
78 inotify_fd = SAFE_MYINOTIFY_INIT1(O_NONBLOCK);
79
80 for (i = 0; i < FILES; i++) {
81 /*
82 * Both failure and success are fine since
83 * files are being deleted in parallel - this
84 * is what provokes the race we want to test
85 * for...
86 */
87 myinotify_add_watch(inotify_fd, names[i], IN_MODIFY);
88 }
89 SAFE_CLOSE(inotify_fd);
90 }
91 /* We survived for given time - test succeeded */
92 tst_res(TPASS, "kernel survived inotify beating");
93
94 /* Kill the child creating / deleting files and wait for it */
95 SAFE_KILL(pid, SIGKILL);
96 pid = 0;
97 SAFE_WAIT(NULL);
98 }
99
cleanup(void)100 static void cleanup(void)
101 {
102 if (pid) {
103 SAFE_KILL(pid, SIGKILL);
104 SAFE_WAIT(NULL);
105 }
106
107 SAFE_FILE_PRINTF(PROCFILE, "%d", old_proc_limit);
108 }
109
110 static struct tst_test test = {
111 .timeout = 600,
112 .needs_root = 1,
113 .needs_tmpdir = 1,
114 .forks_child = 1,
115 .setup = setup,
116 .cleanup = cleanup,
117 .test_all = verify_inotify,
118 };
119
120 #else
121 TST_TEST_TCONF("system doesn't have required inotify support");
122 #endif
123