1 /*
2 * Copyright (c) 2016 Fujitsu Ltd.
3 * Author: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
4 * Ported: Guangwen Feng <fenggw-fnst@cn.fujitsu.com>
5 *
6 * This program is free software: you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation, either version 2 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program, if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 /*
21 * This is a regression test for the race condition between move_pages()
22 * and freeing hugepages, where move_pages() calls follow_page(FOLL_GET)
23 * for hugepages internally and tries to get its refcount without
24 * preventing concurrent freeing.
25 *
26 * This test can crash the buggy kernel, and the bug was fixed in:
27 *
28 * commit e66f17ff71772b209eed39de35aaa99ba819c93d
29 * Author: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
30 * Date: Wed Feb 11 15:25:22 2015 -0800
31 *
32 * mm/hugetlb: take page table lock in follow_huge_pmd()
33 */
34
35 #include <errno.h>
36 #include <unistd.h>
37 #include <string.h>
38 #include <stdio.h>
39 #include <sys/types.h>
40 #include <sys/wait.h>
41
42 #include "tst_test.h"
43 #include "move_pages_support.h"
44 #include "lapi/mmap.h"
45
46 #ifdef HAVE_NUMA_V2
47
48 #define LOOPS 1000
49 #define PATH_MEMINFO "/proc/meminfo"
50 #define PATH_NR_HUGEPAGES "/proc/sys/vm/nr_hugepages"
51 #define PATH_HUGEPAGES "/sys/kernel/mm/hugepages/"
52 #define TEST_PAGES 2
53 #define TEST_NODES 2
54
55 static int pgsz, hpsz;
56 static long orig_hugepages = -1;
57 static char path_hugepages_node1[PATH_MAX];
58 static char path_hugepages_node2[PATH_MAX];
59 static long orig_hugepages_node1 = -1;
60 static long orig_hugepages_node2 = -1;
61 static unsigned int node1, node2;
62 static void *addr;
63
do_child(void)64 static void do_child(void)
65 {
66 int test_pages = TEST_PAGES * hpsz / pgsz;
67 int i, j;
68 int *nodes, *status;
69 void **pages;
70 pid_t ppid = getppid();
71
72 pages = SAFE_MALLOC(sizeof(char *) * test_pages);
73 nodes = SAFE_MALLOC(sizeof(int) * test_pages);
74 status = SAFE_MALLOC(sizeof(int) * test_pages);
75
76 for (i = 0; i < test_pages; i++)
77 pages[i] = addr + i * pgsz;
78
79 for (i = 0; ; i++) {
80 for (j = 0; j < test_pages; j++) {
81 if (i % 2 == 0)
82 nodes[j] = node1;
83 else
84 nodes[j] = node2;
85 status[j] = 0;
86 }
87
88 TEST(numa_move_pages(ppid, test_pages,
89 pages, nodes, status, MPOL_MF_MOVE_ALL));
90 if (TST_RET < 0) {
91 tst_res(TFAIL | TTERRNO, "move_pages failed");
92 break;
93 }
94 }
95
96 exit(0);
97 }
98
do_test(void)99 static void do_test(void)
100 {
101 int i;
102 pid_t cpid = -1;
103 int status;
104 unsigned int twenty_percent = (tst_timeout_remaining() / 5);
105
106 addr = SAFE_MMAP(NULL, TEST_PAGES * hpsz, PROT_READ | PROT_WRITE,
107 MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB, -1, 0);
108
109 SAFE_MUNMAP(addr, TEST_PAGES * hpsz);
110
111 cpid = SAFE_FORK();
112 if (cpid == 0)
113 do_child();
114
115 for (i = 0; i < LOOPS; i++) {
116 void *ptr;
117
118 ptr = SAFE_MMAP(NULL, TEST_PAGES * hpsz,
119 PROT_READ | PROT_WRITE,
120 MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB, -1, 0);
121 if (ptr != addr)
122 tst_brk(TBROK, "Failed to mmap at desired addr");
123
124 memset(addr, 0, TEST_PAGES * hpsz);
125
126 SAFE_MUNMAP(addr, TEST_PAGES * hpsz);
127
128 if (tst_timeout_remaining() < twenty_percent)
129 break;
130 }
131
132 SAFE_KILL(cpid, SIGKILL);
133 SAFE_WAITPID(cpid, &status, 0);
134 if (!WIFEXITED(status))
135 tst_res(TPASS, "Bug not reproduced");
136 }
137
alloc_free_huge_on_node(unsigned int node,size_t size)138 static void alloc_free_huge_on_node(unsigned int node, size_t size)
139 {
140 char *mem;
141 long ret;
142 struct bitmask *bm;
143
144 tst_res(TINFO, "Allocating and freeing %zu hugepages on node %u",
145 size / hpsz, node);
146
147 mem = mmap(NULL, size, PROT_READ | PROT_WRITE,
148 MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB, -1, 0);
149 if (mem == MAP_FAILED) {
150 if (errno == ENOMEM)
151 tst_brk(TCONF, "Cannot allocate huge pages");
152
153 tst_brk(TBROK | TERRNO, "mmap(..., MAP_HUGETLB, ...) failed");
154 }
155
156 bm = numa_bitmask_alloc(numa_max_possible_node() + 1);
157 if (!bm)
158 tst_brk(TBROK | TERRNO, "numa_bitmask_alloc() failed");
159
160 numa_bitmask_setbit(bm, node);
161
162 ret = mbind(mem, size, MPOL_BIND, bm->maskp, bm->size + 1, 0);
163 if (ret) {
164 if (errno == ENOMEM)
165 tst_brk(TCONF, "Cannot mbind huge pages");
166
167 tst_brk(TBROK | TERRNO, "mbind() failed");
168 }
169
170 TEST(mlock(mem, size));
171 if (TST_RET) {
172 SAFE_MUNMAP(mem, size);
173 if (TST_ERR == ENOMEM || TST_ERR == EAGAIN)
174 tst_brk(TCONF, "Cannot lock huge pages");
175 tst_brk(TBROK | TTERRNO, "mlock failed");
176 }
177
178 numa_bitmask_free(bm);
179
180 SAFE_MUNMAP(mem, size);
181 }
182
setup(void)183 static void setup(void)
184 {
185 int ret;
186 long memfree;
187
188 check_config(TEST_NODES);
189
190 if (access(PATH_HUGEPAGES, F_OK))
191 tst_brk(TCONF, "Huge page not supported");
192
193 ret = get_allowed_nodes(NH_MEMS, TEST_NODES, &node1, &node2);
194 if (ret < 0)
195 tst_brk(TBROK | TERRNO, "get_allowed_nodes: %d", ret);
196
197 pgsz = (int)get_page_size();
198 SAFE_FILE_LINES_SCANF(PATH_MEMINFO, "Hugepagesize: %d", &hpsz);
199
200 SAFE_FILE_LINES_SCANF(PATH_MEMINFO, "MemFree: %ld", &memfree);
201 tst_res(TINFO, "Free RAM %ld kB", memfree);
202
203 if (4 * hpsz > memfree)
204 tst_brk(TBROK, "Not enough free RAM");
205
206 snprintf(path_hugepages_node1, sizeof(path_hugepages_node1),
207 "/sys/devices/system/node/node%u/hugepages/hugepages-%dkB/nr_hugepages",
208 node1, hpsz);
209
210 snprintf(path_hugepages_node2, sizeof(path_hugepages_node2),
211 "/sys/devices/system/node/node%u/hugepages/hugepages-%dkB/nr_hugepages",
212 node2, hpsz);
213
214 if (!access(path_hugepages_node1, F_OK)) {
215 SAFE_FILE_SCANF(path_hugepages_node1,
216 "%ld", &orig_hugepages_node1);
217 tst_res(TINFO,
218 "Increasing %dkB hugepages pool on node %u to %ld",
219 hpsz, node1, orig_hugepages_node1 + 4);
220 SAFE_FILE_PRINTF(path_hugepages_node1,
221 "%ld", orig_hugepages_node1 + 4);
222 }
223
224 if (!access(path_hugepages_node2, F_OK)) {
225 SAFE_FILE_SCANF(path_hugepages_node2,
226 "%ld", &orig_hugepages_node2);
227 tst_res(TINFO,
228 "Increasing %dkB hugepages pool on node %u to %ld",
229 hpsz, node2, orig_hugepages_node2 + 4);
230 SAFE_FILE_PRINTF(path_hugepages_node2,
231 "%ld", orig_hugepages_node2 + 4);
232 }
233
234 hpsz *= 1024;
235
236 if (orig_hugepages_node1 == -1 || orig_hugepages_node2 == -1) {
237 SAFE_FILE_SCANF(PATH_NR_HUGEPAGES, "%ld", &orig_hugepages);
238 tst_res(TINFO, "Increasing global hugepages pool to %ld",
239 orig_hugepages + 8);
240 SAFE_FILE_PRINTF(PATH_NR_HUGEPAGES, "%ld", orig_hugepages + 8);
241 }
242
243 alloc_free_huge_on_node(node1, 4L * hpsz);
244 alloc_free_huge_on_node(node2, 4L * hpsz);
245 }
246
cleanup(void)247 static void cleanup(void)
248 {
249 if (orig_hugepages != -1)
250 SAFE_FILE_PRINTF(PATH_NR_HUGEPAGES, "%ld", orig_hugepages);
251
252 if (orig_hugepages_node1 != -1) {
253 SAFE_FILE_PRINTF(path_hugepages_node1,
254 "%ld", orig_hugepages_node1);
255 }
256
257 if (orig_hugepages_node2 != -1) {
258 SAFE_FILE_PRINTF(path_hugepages_node2,
259 "%ld", orig_hugepages_node2);
260 }
261 }
262
263 static struct tst_test test = {
264 .min_kver = "2.6.32",
265 .needs_root = 1,
266 .forks_child = 1,
267 .setup = setup,
268 .cleanup = cleanup,
269 .test_all = do_test,
270 };
271
272 #else
273 TST_TEST_TCONF(NUMA_ERROR_MSG);
274 #endif
275