1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (C) 2021 SUSE LLC <mdoucha@suse.cz>
4 */
5
6 /*\
7 * [Description]
8 *
9 * Check for potential issues in writev() if the first iovec entry is NULL
10 * and the next one is not present in RAM. This can result in a brief window
11 * where writev() first writes uninitialized data into the file (possibly
12 * exposing internal kernel structures) and then overwrites it with the real
13 * iovec contents later.
14 */
15
16 /*
17 * Bugs fixed in:
18 * commit d4690f1e1cdabb4d61207b6787b1605a0dc0aeab
19 * Author: Al Viro <viro@ZenIV.linux.org.uk>
20 * Date: Fri Sep 16 00:11:45 2016 +0100
21 *
22 * fix iov_iter_fault_in_readable()
23 */
24
25 #include <sys/uio.h>
26 #include "tst_test.h"
27 #include "tst_atomic.h"
28 #include "tst_fuzzy_sync.h"
29
30 #define CHUNK_SIZE 256
31 #define BUF_SIZE (2 * CHUNK_SIZE)
32 #define MNTPOINT "mntpoint"
33 #define TEMPFILE MNTPOINT "/test_file"
34 #define MAPFILE MNTPOINT "/map_file"
35
36 static unsigned char buf[BUF_SIZE], *map_ptr;
37 static int mapfd = -1, writefd = -1, readfd = -1;
38 static int written;
39 static struct tst_fzsync_pair fzsync_pair;
40 struct iovec iov[5];
41
setup(void)42 static void setup(void)
43 {
44 int i;
45
46 for (i = 0; i < BUF_SIZE; i++)
47 buf[i] = i & 0xff;
48
49 mapfd = SAFE_OPEN(MAPFILE, O_CREAT|O_RDWR|O_TRUNC, 0644);
50 SAFE_WRITE(1, mapfd, buf, BUF_SIZE);
51
52 fzsync_pair.exec_time_p = 0.25;
53 tst_fzsync_pair_init(&fzsync_pair);
54 }
55
thread_run(void * arg)56 static void *thread_run(void *arg)
57 {
58 while (tst_fzsync_run_b(&fzsync_pair)) {
59 writefd = SAFE_OPEN(TEMPFILE, O_CREAT|O_WRONLY|O_TRUNC, 0644);
60 written = BUF_SIZE;
61 tst_fzsync_wait_b(&fzsync_pair);
62
63 /*
64 * Do *NOT* preload the data using MAP_POPULATE or touching
65 * the mapped range. We're testing whether writev() handles
66 * fault-in correctly.
67 */
68 map_ptr = SAFE_MMAP(NULL, BUF_SIZE, PROT_READ, MAP_SHARED,
69 mapfd, 0);
70 iov[1].iov_base = map_ptr;
71 iov[1].iov_len = CHUNK_SIZE;
72 iov[3].iov_base = map_ptr + CHUNK_SIZE;
73 iov[3].iov_len = CHUNK_SIZE;
74
75 tst_fzsync_start_race_b(&fzsync_pair);
76 tst_atomic_store(writev(writefd, iov, ARRAY_SIZE(iov)),
77 &written);
78 tst_fzsync_end_race_b(&fzsync_pair);
79
80 SAFE_MUNMAP(map_ptr, BUF_SIZE);
81 map_ptr = NULL;
82 SAFE_CLOSE(writefd);
83 }
84
85 return arg;
86 }
87
run(void)88 static void run(void)
89 {
90 int total_read;
91 unsigned char readbuf[BUF_SIZE + 1];
92
93 tst_fzsync_pair_reset(&fzsync_pair, thread_run);
94
95 while (tst_fzsync_run_a(&fzsync_pair)) {
96 tst_fzsync_wait_a(&fzsync_pair);
97 readfd = SAFE_OPEN(TEMPFILE, O_RDONLY);
98 tst_fzsync_start_race_a(&fzsync_pair);
99
100 for (total_read = 0; total_read < tst_atomic_load(&written);) {
101 total_read += SAFE_READ(0, readfd, readbuf+total_read,
102 BUF_SIZE + 1 - total_read);
103 }
104
105 tst_fzsync_end_race_a(&fzsync_pair);
106 SAFE_CLOSE(readfd);
107
108 if (total_read > BUF_SIZE)
109 tst_brk(TBROK, "writev() wrote too much data");
110
111 if (total_read <= 0)
112 continue;
113
114 if (memcmp(readbuf, buf, total_read)) {
115 tst_res(TFAIL, "writev() wrote invalid data");
116 return;
117 }
118 }
119
120 tst_res(TPASS, "writev() handles page fault-in correctly");
121 }
122
cleanup(void)123 static void cleanup(void)
124 {
125 if (map_ptr && map_ptr != MAP_FAILED)
126 SAFE_MUNMAP(map_ptr, BUF_SIZE);
127
128 if (mapfd >= 0)
129 SAFE_CLOSE(mapfd);
130
131 if (readfd >= 0)
132 SAFE_CLOSE(readfd);
133
134 if (writefd >= 0)
135 SAFE_CLOSE(writefd);
136
137 tst_fzsync_pair_cleanup(&fzsync_pair);
138 }
139
140 static struct tst_test test = {
141 .test_all = run,
142 .needs_root = 1,
143 .mount_device = 1,
144 .mntpoint = MNTPOINT,
145 .all_filesystems = 1,
146 .min_cpus = 2,
147 .setup = setup,
148 .cleanup = cleanup,
149 .tags = (const struct tst_tag[]) {
150 {"linux-git", "d4690f1e1cda"},
151 {}
152 }
153 };
154