1 /*
2 * Copyright (c) 2018 Google, Inc.
3 *
4 * This program is free software: you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, either version 2 of the License, or
7 * (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program, if not, see <http://www.gnu.org/licenses/>.
16 */
17
18 /*
19 * Regression test for commit 966031f340185 ("n_tty: fix EXTPROC vs ICANON
20 * interaction with TIOCINQ (aka FIONREAD)"). The test reproduces a hang
21 * (infinite loop in the kernel) after a pseudoterminal is put in both canonical
22 * (ICANON) and external processing (EXTPROC) mode, some data is written to the
23 * master and read from the slave, and the FIONREAD ioctl is called on the
24 * slave. This is simplified from a syzkaller-generated reproducer.
25 */
26
27 #include <stdlib.h>
28 #include <errno.h>
29 #include <termio.h>
30
31 #include "tst_test.h"
32 #include "lapi/termbits.h"
33
do_test(void)34 static void do_test(void)
35 {
36 struct termios io;
37 int ptmx, pts;
38 char c = 'A';
39 int nbytes;
40
41 ptmx = SAFE_OPEN("/dev/ptmx", O_WRONLY);
42
43 if (tcgetattr(ptmx, &io) != 0)
44 tst_brk(TBROK | TERRNO, "tcgetattr() failed");
45
46 io.c_lflag = EXTPROC | ICANON;
47
48 TEST(tcsetattr(ptmx, TCSANOW, &io));
49 if (TST_RET == -1) {
50 if (TST_ERR == EINVAL)
51 tst_brk(TCONF, "tcsetattr(, , EXTPROC | ICANON) is not supported");
52 tst_brk(TBROK | TERRNO, "tcsetattr() failed");
53 }
54
55 if (unlockpt(ptmx) != 0)
56 tst_brk(TBROK | TERRNO, "unlockpt() failed");
57
58 pts = SAFE_OPEN(ptsname(ptmx), O_RDONLY);
59 /* write newline to ptmx to avoid read() on pts to block */
60 SAFE_WRITE(1, ptmx, "A\n", 2);
61 SAFE_READ(1, pts, &c, 1);
62
63 tst_res(TINFO, "Calling FIONREAD, this will hang in n_tty_ioctl() if the bug is present...");
64 SAFE_IOCTL(pts, FIONREAD, &nbytes);
65
66 SAFE_CLOSE(ptmx);
67 SAFE_CLOSE(pts);
68
69 tst_res(TPASS, "Got to the end without hanging");
70 }
71
72 static struct tst_test test = {
73 .test_all = do_test,
74 };
75