1 // SPDX-License-Identifier: GPL-2.0
2 #define _GNU_SOURCE
3 #define __SANE_USERSPACE_TYPES__
4
5 #include <dirent.h>
6 #include <errno.h>
7 #include <fcntl.h>
8 #include <limits.h>
9 #include <net/if.h>
10 #include <sched.h>
11 #include <signal.h>
12 #include <stdio.h>
13 #include <stdlib.h>
14 #include <string.h>
15 #include <time.h>
16 #include <unistd.h>
17 #include <sys/ioctl.h>
18 #include <sys/mount.h>
19 #include <sys/socket.h>
20 #include <sys/stat.h>
21 #include <sys/syscall.h>
22 #include <sys/xattr.h>
23
24 #include "kselftest_harness.h"
25 #include "wrappers.h"
26
TEST(kernfs_listxattr)27 TEST(kernfs_listxattr)
28 {
29 ssize_t len;
30 int fd;
31
32 /* Read-only file that can never have any extended attributes set.
33 * However, on systems with SELinux enabled, security.selinux xattr
34 * may be present. Skip the content check if any xattrs are found.
35 */
36 fd = open("/sys/kernel/warn_count", O_RDONLY | O_CLOEXEC);
37 ASSERT_GE(fd, 0);
38
39 len = flistxattr(fd, NULL, 0);
40 ASSERT_GE(len, 0);
41
42 if (len > 0) {
43 close(fd);
44 SKIP(return, "xattrs present on /sys/kernel/warn_count, skipping xattr content check");
45 }
46
47 EXPECT_EQ(close(fd), 0);
48 }
49
TEST(kernfs_getxattr)50 TEST(kernfs_getxattr)
51 {
52 int fd;
53 char buf[1];
54
55 /* Read-only file that can never have any extended attributes set. */
56 fd = open("/sys/kernel/warn_count", O_RDONLY | O_CLOEXEC);
57 ASSERT_GE(fd, 0);
58 ASSERT_LT(fgetxattr(fd, "user.foo", buf, sizeof(buf)), 0);
59 ASSERT_EQ(errno, ENODATA);
60 EXPECT_EQ(close(fd), 0);
61 }
62
63 /*
64 * Exercise the kernfs dentry cache: lookup, revalidation of positive and
65 * negative dentries, readdir and namespace tagging.
66 *
67 * These drive kernfs from kernel context rather than VFS create/unlink,
68 * which is what ->d_revalidate() exists for: writing cgroup.subtree_control
69 * adds and removes files in every child cgroup with no VFS operation
70 * touching those names.
71 */
72
73 #define CG_SCRATCH "kernfs_selftest"
74 #define TEST_IFNAME "kfstest0"
75
76 /*
77 * Controllers that add a file to each child cgroup when enabled. The probe
78 * file must be owned by the controller: cgroup_base_files[] entries such as
79 * cpu.stat exist in every cgroup regardless, and every file the cpu
80 * controller does own is behind a Kconfig symbol, so cpu is not usable here.
81 */
82 static const struct {
83 const char *name;
84 const char *probe_file;
85 } controllers[] = {
86 { "memory", "memory.current" },
87 { "pids", "pids.current" },
88 };
89
find_cgroup2_root(char * buf,size_t len)90 static int find_cgroup2_root(char *buf, size_t len)
91 {
92 char line[PATH_MAX * 2];
93 FILE *f;
94 int ret = -1;
95
96 f = fopen("/proc/self/mounts", "re");
97 if (!f)
98 return -1;
99
100 while (fgets(line, sizeof(line), f)) {
101 char mnt[PATH_MAX], type[64];
102
103 /* Octal escaping can expand a path fourfold; bound both %s. */
104 if (sscanf(line, "%*s %4095s %63s", mnt, type) != 2)
105 continue;
106 if (strcmp(type, "cgroup2"))
107 continue;
108 if (strlen(mnt) >= len)
109 break;
110 strcpy(buf, mnt);
111 ret = 0;
112 break;
113 }
114
115 fclose(f);
116 return ret;
117 }
118
write_file(const char * path,const char * val)119 static int write_file(const char *path, const char *val)
120 {
121 ssize_t len = strlen(val);
122 int fd, ret;
123
124 fd = open(path, O_WRONLY | O_CLOEXEC);
125 if (fd < 0)
126 return -1;
127 ret = write(fd, val, len) == len ? 0 : -1;
128 close(fd);
129 return ret;
130 }
131
file_has_word(const char * path,const char * word)132 static bool file_has_word(const char *path, const char *word)
133 {
134 char buf[4096], *tok, *save;
135 bool found = false;
136 ssize_t n;
137 int fd;
138
139 fd = open(path, O_RDONLY | O_CLOEXEC);
140 if (fd < 0)
141 return false;
142 n = read(fd, buf, sizeof(buf) - 1);
143 close(fd);
144 if (n < 0)
145 return false;
146 buf[n] = '\0';
147
148 for (tok = strtok_r(buf, "\n ", &save); tok;
149 tok = strtok_r(NULL, "\n ", &save)) {
150 if (!strcmp(tok, word)) {
151 found = true;
152 break;
153 }
154 }
155 return found;
156 }
157
path_is_mounted(const char * path)158 static bool path_is_mounted(const char *path)
159 {
160 char line[PATH_MAX * 2];
161 bool found = false;
162 FILE *f;
163
164 f = fopen("/proc/self/mounts", "re");
165 if (!f)
166 return false;
167 while (fgets(line, sizeof(line), f)) {
168 char mnt[PATH_MAX];
169
170 if (sscanf(line, "%*s %4095s", mnt) != 1)
171 continue;
172 if (!strcmp(mnt, path)) {
173 found = true;
174 break;
175 }
176 }
177 fclose(f);
178 return found;
179 }
180
181 /* Shared by the stress tests below. */
stress_deadline(const struct timespec * end)182 static bool stress_deadline(const struct timespec *end)
183 {
184 struct timespec now;
185
186 clock_gettime(CLOCK_MONOTONIC, &now);
187 return now.tv_sec > end->tv_sec ||
188 (now.tv_sec == end->tv_sec && now.tv_nsec >= end->tv_nsec);
189 }
190
FIXTURE(kernfs_cgroup)191 FIXTURE(kernfs_cgroup)
192 {
193 char scratch[PATH_MAX]; /* <cg2>/kernfs_selftest.<pid> */
194 char child[PATH_MAX]; /* <scratch>/child */
195 char probe[PATH_MAX]; /* child's controller file */
196 char scratch_sc[PATH_MAX]; /* scratch's cgroup.subtree_control */
197 char root_sc[PATH_MAX]; /* root's cgroup.subtree_control */
198 char enable[32]; /* "+<controller>" */
199 char disable[32]; /* "-<controller>" */
200 char mnt[PATH_MAX]; /* our own mount, if we made one */
201 bool mounted;
202 bool enabled_at_root;
203 };
204
205 /* A cgroup stays busy briefly after its last task exits. */
rmdir_retry(const char * path)206 static void rmdir_retry(const char *path)
207 {
208 int i;
209
210 for (i = 0; i < 500; i++) {
211 if (!rmdir(path) || errno != EBUSY)
212 return;
213 usleep(10000);
214 }
215 }
216
217 /*
218 * Undo whatever SETUP managed to do. The harness skips TEARDOWN after a
219 * failed or skipped SETUP, so SETUP must call this before returning early.
220 */
kernfs_cgroup_undo(FIXTURE_DATA (kernfs_cgroup)* self)221 static void kernfs_cgroup_undo(FIXTURE_DATA(kernfs_cgroup) *self)
222 {
223 rmdir_retry(self->child);
224 rmdir(self->scratch);
225 if (self->enabled_at_root)
226 write_file(self->root_sc, self->disable);
227 if (self->mounted) {
228 umount2(self->mnt, MNT_DETACH);
229 rmdir(self->mnt);
230 }
231 self->enabled_at_root = false;
232 self->mounted = false;
233 }
234
FIXTURE_SETUP(kernfs_cgroup)235 FIXTURE_SETUP(kernfs_cgroup)
236 {
237 char root[PATH_MAX], ctl[PATH_MAX];
238 const char *probe_file = NULL;
239 size_t i;
240
241 if (geteuid())
242 SKIP(return, "test needs to run as root");
243
244 /*
245 * A private mount namespace stops our mounts leaking, but does not
246 * isolate the cgroup hierarchy: cgroup2 has one default hierarchy
247 * however many times it is mounted. The scratch cgroups live in the
248 * host's and must be removed, not discarded with the namespace.
249 */
250 if (unshare(CLONE_NEWNS))
251 SKIP(return, "unshare(CLONE_NEWNS): %s", strerror(errno));
252 if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL))
253 SKIP(return, "make / private: %s", strerror(errno));
254
255 /* Use an existing cgroup2 mount if there is one, else make our own. */
256 if (find_cgroup2_root(root, sizeof(root))) {
257 strcpy(self->mnt, "/tmp/kernfs_selftest_cg2.XXXXXX");
258 if (!mkdtemp(self->mnt))
259 SKIP(return, "mkdtemp: %s", strerror(errno));
260 if (mount("none", self->mnt, "cgroup2", 0, NULL)) {
261 rmdir(self->mnt);
262 SKIP(return, "mount cgroup2: %s", strerror(errno));
263 }
264 self->mounted = true;
265 strcpy(root, self->mnt);
266 }
267
268 snprintf(self->root_sc, sizeof(self->root_sc),
269 "%s/cgroup.subtree_control", root);
270 snprintf(ctl, sizeof(ctl), "%s/cgroup.controllers", root);
271
272 /* Named after our pid so we cannot collide with anything else. */
273 snprintf(self->scratch, sizeof(self->scratch), "%s/%s.%d", root,
274 CG_SCRATCH, getpid());
275 snprintf(self->child, sizeof(self->child), "%s/child", self->scratch);
276 snprintf(self->scratch_sc, sizeof(self->scratch_sc),
277 "%s/cgroup.subtree_control", self->scratch);
278
279 for (i = 0; i < ARRAY_SIZE(controllers); i++) {
280 if (!file_has_word(ctl, controllers[i].name))
281 continue;
282 snprintf(self->enable, sizeof(self->enable), "+%s",
283 controllers[i].name);
284 snprintf(self->disable, sizeof(self->disable), "-%s",
285 controllers[i].name);
286 probe_file = controllers[i].probe_file;
287
288 /*
289 * A controller must be in the root's subtree_control before
290 * it appears in our scratch cgroup. Note if we enabled it,
291 * so it can be put back.
292 */
293 self->enabled_at_root = !file_has_word(self->root_sc,
294 controllers[i].name);
295 if (self->enabled_at_root &&
296 write_file(self->root_sc, self->enable)) {
297 self->enabled_at_root = false;
298 probe_file = NULL;
299 continue;
300 }
301 break;
302 }
303 if (!probe_file) {
304 kernfs_cgroup_undo(self);
305 SKIP(return, "no usable cgroup2 controller");
306 }
307
308 snprintf(self->probe, sizeof(self->probe), "%s/%s", self->child,
309 probe_file);
310
311 /*
312 * Only an unusable environment may skip. A scratch cgroup named
313 * after our own pid should always be creatable, so failing to make
314 * one is a result -- skipping would let a broken kernel look green.
315 */
316 if (mkdir(self->scratch, 0755)) {
317 int err = errno;
318
319 kernfs_cgroup_undo(self);
320 if (err == EROFS || err == EACCES || err == EPERM)
321 SKIP(return, "mkdir %s: %s", self->scratch,
322 strerror(err));
323 ASSERT_EQ(err, 0) TH_LOG("mkdir %s: %s", self->scratch,
324 strerror(err));
325 }
326 if (mkdir(self->child, 0755)) {
327 int err = errno;
328
329 kernfs_cgroup_undo(self);
330 ASSERT_EQ(err, 0) TH_LOG("mkdir %s: %s", self->child,
331 strerror(err));
332 }
333
334 /*
335 * The tests below need the probe file to appear and disappear with
336 * the controller, so it must be absent now, before anything enables
337 * it in the scratch cgroup. Skip rather than fail: a probe file that
338 * is already there means the table names one the controller does not
339 * own, not that the kernel is broken.
340 */
341 if (!access(self->probe, F_OK)) {
342 kernfs_cgroup_undo(self);
343 SKIP(return, "%s is not owned by the %s controller",
344 probe_file, self->enable + 1);
345 }
346 }
347
FIXTURE_TEARDOWN(kernfs_cgroup)348 FIXTURE_TEARDOWN(kernfs_cgroup)
349 {
350 write_file(self->scratch_sc, self->disable);
351 kernfs_cgroup_undo(self);
352 }
353
354 /*
355 * Walking already-cached dentries must not invalidate them. Spurious
356 * invalidation is not merely slow: d_invalidate() calls detach_mounts(), so
357 * an unrelated lookup would silently tear down any mount below.
358 */
TEST_F(kernfs_cgroup,path_walk_does_not_invalidate)359 TEST_F(kernfs_cgroup, path_walk_does_not_invalidate)
360 {
361 char src[] = "/tmp/kernfs_selftest_bind.XXXXXX";
362 char sub[PATH_MAX], probe[PATH_MAX];
363 int i;
364
365 snprintf(sub, sizeof(sub), "%s/sub", self->child);
366 ASSERT_EQ(mkdir(sub, 0755), 0);
367
368 if (!mkdtemp(src)) {
369 rmdir(sub);
370 SKIP(return, "mkdtemp: %s", strerror(errno));
371 }
372 if (mount(src, sub, NULL, MS_BIND, NULL)) {
373 int err = errno;
374
375 rmdir(sub);
376 rmdir(src);
377 SKIP(return, "bind mount onto a cgroup dir: %s", strerror(err));
378 }
379 ASSERT_TRUE(path_is_mounted(sub));
380
381 /* Walk a sibling path through the same directory, repeatedly. */
382 snprintf(probe, sizeof(probe), "%s/cgroup.procs", self->child);
383 for (i = 0; i < 8; i++) {
384 int fd = open(probe, O_RDONLY | O_CLOEXEC);
385
386 if (fd >= 0)
387 close(fd);
388 }
389
390 EXPECT_TRUE(path_is_mounted(sub));
391
392 umount2(sub, MNT_DETACH);
393 rmdir(sub);
394 rmdir(src);
395 }
396
397 /*
398 * A cached negative dentry must be invalidated when the kernel creates the
399 * name behind the dcache's back. That is what kernfs_dir_changed() and
400 * kernfs_elem_dir::rev are for.
401 */
TEST_F(kernfs_cgroup,negative_dentry_invalidated_by_kernel_create)402 TEST_F(kernfs_cgroup, negative_dentry_invalidated_by_kernel_create)
403 {
404 struct stat st;
405
406 /* Caches a negative dentry for the probe file. */
407 ASSERT_EQ(stat(self->probe, &st), -1);
408 ASSERT_EQ(errno, ENOENT);
409
410 /* The kernel now creates it, with no VFS operation on that name. */
411 ASSERT_EQ(write_file(self->scratch_sc, self->enable), 0);
412
413 EXPECT_EQ(stat(self->probe, &st), 0);
414 }
415
416 /* The mirror image: a cached positive dentry must go when the node does. */
TEST_F(kernfs_cgroup,positive_dentry_invalidated_by_kernel_remove)417 TEST_F(kernfs_cgroup, positive_dentry_invalidated_by_kernel_remove)
418 {
419 struct stat st;
420
421 ASSERT_EQ(write_file(self->scratch_sc, self->enable), 0);
422 /* Caches a positive dentry. */
423 ASSERT_EQ(stat(self->probe, &st), 0);
424
425 ASSERT_EQ(write_file(self->scratch_sc, self->disable), 0);
426
427 ASSERT_EQ(stat(self->probe, &st), -1);
428 EXPECT_EQ(errno, ENOENT);
429 }
430
431 /* Opening a removed node fails; it never returns stale content. */
TEST_F(kernfs_cgroup,open_after_rmdir_fails)432 TEST_F(kernfs_cgroup, open_after_rmdir_fails)
433 {
434 char path[PATH_MAX];
435 char buf[64];
436 int fd;
437
438 snprintf(path, sizeof(path), "%s/cgroup.procs", self->child);
439
440 fd = open(path, O_RDONLY | O_CLOEXEC);
441 ASSERT_GE(fd, 0);
442
443 ASSERT_EQ(rmdir(self->child), 0);
444
445 /* Lookup by path must fail. */
446 EXPECT_EQ(open(path, O_RDONLY | O_CLOEXEC), -1);
447 EXPECT_EQ(errno, ENOENT);
448
449 /*
450 * An fd held across removal must fail rather than return stale
451 * content. rmdir() deactivates the node before it returns, so
452 * kernfs_seq_start() fails to get an active reference.
453 */
454 EXPECT_LT(read(fd, buf, sizeof(buf)), 0);
455 EXPECT_EQ(errno, ENODEV);
456 EXPECT_EQ(close(fd), 0);
457
458 ASSERT_EQ(mkdir(self->child, 0755), 0);
459 }
460
461 /* readdir returns every entry exactly once. */
TEST_F(kernfs_cgroup,readdir_no_duplicates)462 TEST_F(kernfs_cgroup, readdir_no_duplicates)
463 {
464 char names[512][NAME_MAX + 1];
465 struct dirent *de;
466 int n = 0, i, j;
467 DIR *d;
468
469 ASSERT_EQ(write_file(self->scratch_sc, self->enable), 0);
470
471 d = opendir(self->child);
472 ASSERT_NE(d, NULL);
473 while ((de = readdir(d))) {
474 if (!strcmp(de->d_name, ".") || !strcmp(de->d_name, ".."))
475 continue;
476 ASSERT_LT(n, (int)ARRAY_SIZE(names));
477 strncpy(names[n], de->d_name, NAME_MAX);
478 names[n][NAME_MAX] = '\0';
479 n++;
480 }
481 closedir(d);
482
483 ASSERT_GT(n, 0);
484 for (i = 0; i < n; i++)
485 for (j = i + 1; j < n; j++)
486 EXPECT_STRNE(names[i], names[j]);
487 }
488
489 #define RESUME_DIRS 24
490
491 /*
492 * Resuming at an entry that has gone must carry on after it, never before.
493 * Take a cookie for every entry, then remove each one, seek to its cookie
494 * and read the rest; nothing already reported may come back.
495 */
TEST_F(kernfs_cgroup,readdir_resume_at_removed_entry)496 TEST_F(kernfs_cgroup, readdir_resume_at_removed_entry)
497 {
498 /* The cgroup's own control files are listed alongside ours. */
499 char names[128][NAME_MAX + 1];
500 long pos[128];
501 char path[PATH_MAX];
502 struct dirent *de;
503 int n = 0, i, j;
504 DIR *d;
505
506 for (i = 0; i < RESUME_DIRS; i++) {
507 snprintf(path, sizeof(path), "%s/e%02d", self->scratch, i);
508 ASSERT_EQ(mkdir(path, 0755), 0);
509 }
510
511 /* Record the cookie before reading each entry, with its name. */
512 d = opendir(self->scratch);
513 ASSERT_NE(d, NULL);
514 while (1) {
515 long here = telldir(d);
516
517 de = readdir(d);
518 if (!de)
519 break;
520 if (!strcmp(de->d_name, ".") || !strcmp(de->d_name, ".."))
521 continue;
522 ASSERT_LT(n, (int)ARRAY_SIZE(pos));
523 pos[n] = here;
524 strncpy(names[n], de->d_name, NAME_MAX);
525 names[n][NAME_MAX] = '\0';
526 n++;
527 }
528 closedir(d);
529 ASSERT_GT(n, 1);
530
531 for (i = 0; i < n; i++) {
532 /* Only the directories we made can be removed and put back. */
533 if (strncmp(names[i], "e", 1))
534 continue;
535
536 snprintf(path, sizeof(path), "%s/%s", self->scratch, names[i]);
537 ASSERT_EQ(rmdir(path), 0);
538
539 /* Reopen so the seek has to reach the kernel. */
540 d = opendir(self->scratch);
541 ASSERT_NE(d, NULL);
542 seekdir(d, pos[i]);
543 while ((de = readdir(d))) {
544 if (!strcmp(de->d_name, ".") || !strcmp(de->d_name, ".."))
545 continue;
546 for (j = 0; j < i; j++)
547 ASSERT_STRNE(de->d_name, names[j])
548 TH_LOG("resuming at %s (gone) went back to %s",
549 names[i], names[j]);
550 }
551 closedir(d);
552
553 ASSERT_EQ(mkdir(path, 0755), 0);
554 }
555
556 for (i = 0; i < RESUME_DIRS; i++) {
557 snprintf(path, sizeof(path), "%s/e%02d", self->scratch, i);
558 EXPECT_EQ(rmdir(path), 0);
559 }
560 }
561
562 #define CHURN_ROUNDS 400
563 #define CHURN_BUFSZ 512 /* small, so a listing takes several calls */
564
565 /*
566 * The files appear at the end of the enabling write and go at the start of
567 * the disabling one, so the window where they exist is the short one.
568 */
569 #define CHURN_DWELL_ON 2000
570 #define CHURN_DWELL_OFF 200
571
572 struct kernfs_dirent64 {
573 unsigned long long d_ino;
574 long long d_off;
575 unsigned short d_reclen;
576 unsigned char d_type;
577 char d_name[];
578 };
579
580 /*
581 * The same resume, but inside one getdents(2) call. rmdir(2) cannot reach
582 * that window because iterate_dir() holds the listed directory's i_rwsem
583 * for the whole listing; cgroup.subtree_control can, having no VFS
584 * operation on the names it adds and removes. The files that are not the
585 * controller's stay throughout, so each must appear exactly once.
586 *
587 * A stress test: it has not been seen to catch the ordering bug, and is
588 * here to keep the unlocked window under load for lockdep and KASAN.
589 */
TEST_F(kernfs_cgroup,readdir_resume_vs_internal_remove)590 TEST_F(kernfs_cgroup, readdir_resume_vs_internal_remove)
591 {
592 char buf[CHURN_BUFSZ] __attribute__((aligned(8)));
593 char stable[128][NAME_MAX + 1];
594 int nstable = 0, i, r;
595 int withctl = 0, without = 0;
596 int seen[128], status;
597 pid_t churner;
598 DIR *d;
599
600 /* With the controller off, whatever is left is what must persist. */
601 ASSERT_EQ(write_file(self->scratch_sc, self->disable), 0);
602 d = opendir(self->child);
603 ASSERT_NE(d, NULL);
604 for (;;) {
605 struct dirent *de = readdir(d);
606
607 if (!de)
608 break;
609 if (!strcmp(de->d_name, ".") || !strcmp(de->d_name, ".."))
610 continue;
611 ASSERT_LT(nstable, (int)ARRAY_SIZE(stable));
612 strncpy(stable[nstable], de->d_name, NAME_MAX);
613 stable[nstable][NAME_MAX] = '\0';
614 nstable++;
615 }
616 closedir(d);
617 ASSERT_GT(nstable, 0);
618
619 churner = fork();
620 ASSERT_GE(churner, 0);
621 if (churner == 0) {
622 for (;;) {
623 if (write_file(self->scratch_sc, self->enable))
624 _exit(10);
625 usleep(CHURN_DWELL_ON);
626 if (write_file(self->scratch_sc, self->disable))
627 _exit(11);
628 usleep(CHURN_DWELL_OFF);
629 }
630 }
631
632 for (r = 0; r < CHURN_ROUNDS; r++) {
633 int fd = open(self->child, O_RDONLY | O_DIRECTORY);
634 int extra = 0;
635 int n;
636
637 ASSERT_GE(fd, 0);
638 memset(seen, 0, sizeof(seen));
639
640 while ((n = syscall(SYS_getdents64, fd, buf, sizeof(buf))) > 0) {
641 int off = 0;
642
643 while (off < n) {
644 struct kernfs_dirent64 *de = (void *)(buf + off);
645 bool known = false;
646
647 off += de->d_reclen;
648 for (i = 0; i < nstable; i++)
649 if (!strcmp(de->d_name, stable[i])) {
650 seen[i]++;
651 known = true;
652 }
653 if (!known && strcmp(de->d_name, ".") &&
654 strcmp(de->d_name, ".."))
655 extra++;
656 }
657 }
658 ASSERT_GE(n, 0);
659 EXPECT_EQ(close(fd), 0);
660
661 if (extra)
662 withctl++;
663 else
664 without++;
665
666 for (i = 0; i < nstable; i++)
667 ASSERT_EQ(seen[i], 1)
668 TH_LOG("round %d: %s seen %d times",
669 r, stable[i], seen[i]);
670 }
671
672 /* The churn must have been running, or the listings prove nothing. */
673 EXPECT_EQ(kill(churner, SIGKILL), 0);
674 ASSERT_EQ(waitpid(churner, &status, 0), churner);
675 ASSERT_TRUE(WIFSIGNALED(status) && WTERMSIG(status) == SIGKILL)
676 TH_LOG("churner exited on its own: status %d", status);
677
678 /*
679 * They also have to have overlapped it. How much depends on the
680 * machine, so say the race could not be arranged rather than fail.
681 */
682 if (!withctl || !without)
683 SKIP(return, "listings did not span the churn: %d with, %d without",
684 withctl, without);
685 }
686
687 /*
688 * A telldir() cookie must resolve back to the same entry after seekdir().
689 * kernfs encodes the cookie as the node's name hash, so this covers
690 * kernfs_dir_pos() as well as plain iteration.
691 */
TEST_F(kernfs_cgroup,readdir_seekdir_roundtrip)692 TEST_F(kernfs_cgroup, readdir_seekdir_roundtrip)
693 {
694 char names[512][NAME_MAX + 1];
695 struct dirent *de;
696 long pos[512];
697 int n = 0, i;
698 DIR *d;
699
700 ASSERT_EQ(write_file(self->scratch_sc, self->enable), 0);
701
702 d = opendir(self->child);
703 ASSERT_NE(d, NULL);
704
705 /* Record the cookie *before* reading each entry, with its name. */
706 while (1) {
707 long here = telldir(d);
708
709 de = readdir(d);
710 if (!de)
711 break;
712 if (!strcmp(de->d_name, ".") || !strcmp(de->d_name, ".."))
713 continue;
714 ASSERT_LT(n, (int)ARRAY_SIZE(pos));
715 pos[n] = here;
716 strncpy(names[n], de->d_name, NAME_MAX);
717 names[n][NAME_MAX] = '\0';
718 n++;
719 }
720 ASSERT_GT(n, 0);
721
722 /* Seeking back to a cookie must land on the entry it was taken at. */
723 for (i = 0; i < n; i++) {
724 seekdir(d, pos[i]);
725 de = readdir(d);
726 ASSERT_NE(de, NULL);
727 EXPECT_STREQ(de->d_name, names[i]);
728 }
729
730 closedir(d);
731 }
732
733 #define STRESS_SECS 2
734 #define STRESS_DIRS 4
735 #define STRESS_READERS 4
736
737 /*
738 * Hammer lookup against creation and removal. Revalidation holds no lock
739 * against the writers, so what makes it safe is that every answer it can
740 * give is one the caller already handles: a reader must only ever see
741 * success or an errno meaning "it went away", never garbage or a hang.
742 */
TEST_F(kernfs_cgroup,lookup_vs_create_remove_stress)743 TEST_F(kernfs_cgroup, lookup_vs_create_remove_stress)
744 {
745 pid_t pids[STRESS_DIRS + STRESS_READERS];
746 struct timespec end;
747 int i, status, n = 0;
748
749 clock_gettime(CLOCK_MONOTONIC, &end);
750 end.tv_sec += STRESS_SECS;
751
752 for (i = 0; i < STRESS_DIRS; i++) {
753 pid_t pid = fork();
754
755 ASSERT_GE(pid, 0);
756 if (pid == 0) {
757 char dir[PATH_MAX];
758
759 snprintf(dir, sizeof(dir), "%s/s%d", self->scratch, i);
760 while (!stress_deadline(&end)) {
761 if (mkdir(dir, 0755) && errno != EEXIST)
762 _exit(10);
763 if (rmdir(dir) && errno != ENOENT &&
764 errno != EBUSY)
765 _exit(11);
766 }
767 _exit(0);
768 }
769 pids[n++] = pid;
770 }
771
772 for (i = 0; i < STRESS_READERS; i++) {
773 pid_t pid = fork();
774
775 ASSERT_GE(pid, 0);
776 if (pid == 0) {
777 /* Start each reader on a different directory. */
778 unsigned int seq = i;
779
780 while (!stress_deadline(&end)) {
781 int which = seq++ % STRESS_DIRS;
782 char path[PATH_MAX];
783 struct stat st;
784 int fd;
785
786 snprintf(path, sizeof(path),
787 "%s/s%d/cgroup.procs",
788 self->scratch, which);
789
790 if (stat(path, &st) && errno != ENOENT &&
791 errno != ENODEV)
792 _exit(20);
793
794 fd = open(path, O_RDONLY | O_CLOEXEC);
795 if (fd < 0) {
796 if (errno != ENOENT && errno != ENODEV)
797 _exit(21);
798 } else {
799 close(fd);
800 }
801
802 if (access(path, F_OK) && errno != ENOENT &&
803 errno != ENODEV)
804 _exit(22);
805 }
806 _exit(0);
807 }
808 pids[n++] = pid;
809 }
810
811 for (i = 0; i < n; i++) {
812 ASSERT_EQ(waitpid(pids[i], &status, 0), pids[i]);
813 ASSERT_TRUE(WIFEXITED(status));
814 EXPECT_EQ(WEXITSTATUS(status), 0);
815 }
816
817 for (i = 0; i < STRESS_DIRS; i++) {
818 char dir[PATH_MAX];
819
820 snprintf(dir, sizeof(dir), "%s/s%d", self->scratch, i);
821 rmdir_retry(dir);
822 }
823 }
824
825 struct kernfs_handle {
826 struct file_handle h;
827 unsigned char buf[MAX_HANDLE_SZ];
828 };
829
kernfs_encode(const char * path,struct kernfs_handle * fh)830 static int kernfs_encode(const char *path, struct kernfs_handle *fh)
831 {
832 int mount_id;
833
834 memset(fh, 0, sizeof(*fh));
835 fh->h.handle_bytes = sizeof(fh->buf);
836 return name_to_handle_at(AT_FDCWD, path, &fh->h, &mount_id, 0);
837 }
838
839 /*
840 * Skip only where file handles do not work at all. ENOENT must still
841 * fail: mkdir leaves a negative dentry cached, so the name resolves only
842 * after ->d_revalidate() drops it. The encode tests revalidation too.
843 */
fh_unsupported(int err)844 static bool fh_unsupported(int err)
845 {
846 return err == EOPNOTSUPP || err == EPERM || err == ENOSYS;
847 }
848
849 /*
850 * Decoding a file needs CAP_DAC_READ_SEARCH in the initial user
851 * namespace. Probe once so the tests skip instead of fail.
852 */
fh_can_decode(int mfd,struct kernfs_handle * fh)853 static bool fh_can_decode(int mfd, struct kernfs_handle *fh)
854 {
855 int fd = open_by_handle_at(mfd, &fh->h, O_PATH);
856
857 if (fd < 0)
858 return errno != EPERM;
859 close(fd);
860 return true;
861 }
862
863 /*
864 * A file handle reaches a node without a lookup through its parent. A
865 * live node must decode. A removed one must not, because
866 * kernfs_find_and_get_node_by_id() refuses inactive nodes.
867 *
868 * Use O_PATH: opening a removed node fails with ENODEV, which would hide
869 * what is being tested.
870 */
TEST_F(kernfs_cgroup,exportfs_decode_and_stale)871 TEST_F(kernfs_cgroup, exportfs_decode_and_stale)
872 {
873 char victim[PATH_MAX], procs[PATH_MAX];
874 struct kernfs_handle fh;
875 struct stat st;
876 int mfd, fd;
877
878 snprintf(victim, sizeof(victim), "%s/fh", self->scratch);
879 snprintf(procs, sizeof(procs), "%s/cgroup.procs", victim);
880 ASSERT_EQ(mkdir(victim, 0755), 0);
881
882 /* Any fd on the filesystem identifies it to open_by_handle_at(). */
883 mfd = open(self->scratch, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
884 ASSERT_GE(mfd, 0);
885
886 if (kernfs_encode(procs, &fh)) {
887 int err = errno;
888
889 close(mfd);
890 rmdir(victim);
891 ASSERT_TRUE(fh_unsupported(err))
892 TH_LOG("name_to_handle_at: %s", strerror(err));
893 SKIP(return, "name_to_handle_at: %s", strerror(err));
894 }
895
896 if (!fh_can_decode(mfd, &fh)) {
897 close(mfd);
898 rmdir(victim);
899 SKIP(return, "open_by_handle_at: no CAP_DAC_READ_SEARCH");
900 }
901
902 fd = open_by_handle_at(mfd, &fh.h, O_PATH);
903 ASSERT_GE(fd, 0);
904 EXPECT_EQ(fstat(fd, &st), 0);
905 EXPECT_EQ(st.st_nlink, 1);
906 EXPECT_EQ(close(fd), 0);
907
908 ASSERT_EQ(rmdir(victim), 0);
909
910 fd = open_by_handle_at(mfd, &fh.h, O_PATH);
911 EXPECT_LT(fd, 0);
912 if (fd >= 0)
913 close(fd);
914 else
915 EXPECT_EQ(errno, ESTALE);
916
917 EXPECT_EQ(close(mfd), 0);
918 }
919
920 #define FH_STRESS_SECS 2
921 #define FH_DECODE_CAP 10000
922
923 /*
924 * Decode file handles while the node is being removed. A decode must
925 * answer with a usable handle or ESTALE, never garbage and never a hang.
926 *
927 * The link count is checked too. An inode that reaches the inode hash
928 * after the removal cleared link counts keeps the 1 it was born with, so
929 * it never gets an IN_DELETE_SELF. This has not been seen to fire: it
930 * needs the decode to stall between the lookup by id and the hash insert,
931 * and nothing there blocks. It is kept because it is cheap and only
932 * looks once the directory is gone, so it cannot fail falsely.
933 */
TEST_F(kernfs_cgroup,exportfs_decode_vs_rmdir_stress)934 TEST_F(kernfs_cgroup, exportfs_decode_vs_rmdir_stress)
935 {
936 int mfd, bad = 0, rounds = 0;
937 struct timespec end;
938
939 mfd = open(self->scratch, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
940 ASSERT_GE(mfd, 0);
941
942 clock_gettime(CLOCK_MONOTONIC, &end);
943 end.tv_sec += FH_STRESS_SECS;
944
945 while (!stress_deadline(&end)) {
946 char victim[PATH_MAX], procs[PATH_MAX];
947 int last = -1, fd, i;
948 struct kernfs_handle fh;
949 struct stat st;
950 pid_t pid;
951
952 snprintf(victim, sizeof(victim), "%s/fh%d", self->scratch,
953 rounds++);
954 snprintf(procs, sizeof(procs), "%s/cgroup.procs", victim);
955 if (mkdir(victim, 0755))
956 break;
957 if (kernfs_encode(procs, &fh)) {
958 int err = errno;
959
960 rmdir(victim);
961 ASSERT_TRUE(fh_unsupported(err))
962 TH_LOG("name_to_handle_at: %s", strerror(err));
963 SKIP(goto out, "name_to_handle_at: %s", strerror(err));
964 }
965 if (rounds == 1 && !fh_can_decode(mfd, &fh)) {
966 rmdir(victim);
967 SKIP(goto out,
968 "open_by_handle_at: no CAP_DAC_READ_SEARCH");
969 }
970
971 pid = fork();
972 ASSERT_GE(pid, 0);
973 if (pid == 0) {
974 rmdir_retry(victim);
975 _exit(0);
976 }
977
978 /*
979 * Decode until the removal deactivates the node. Keep the
980 * last one that worked: it ran closest to the removal.
981 */
982 for (i = 0; i < FH_DECODE_CAP; i++) {
983 fd = open_by_handle_at(mfd, &fh.h, O_PATH);
984 if (fd < 0)
985 break;
986 if (last >= 0)
987 close(last);
988 last = fd;
989 }
990 ASSERT_EQ(waitpid(pid, NULL, 0), pid);
991
992 if (last >= 0) {
993 if (access(victim, F_OK) && errno == ENOENT &&
994 !fstat(last, &st) && st.st_nlink != 0)
995 bad++;
996 close(last);
997 }
998 rmdir(victim);
999 }
1000
1001 EXPECT_EQ(bad, 0)
1002 TH_LOG("%d of %d rounds decoded a removed node whose inode kept its link count",
1003 bad, rounds);
1004 out:
1005 close(mfd);
1006 }
1007
1008 /*
1009 * sysfs is namespace tagged (KERNFS_NS) and supports rename; cgroup2 does
1010 * neither. Run in a private netns with its own sysfs so the host is
1011 * untouched.
1012 */
FIXTURE(kernfs_netns)1013 FIXTURE(kernfs_netns)
1014 {
1015 char mnt[PATH_MAX];
1016 char net[PATH_MAX];
1017 bool mounted;
1018 };
1019
FIXTURE_SETUP(kernfs_netns)1020 FIXTURE_SETUP(kernfs_netns)
1021 {
1022 if (geteuid())
1023 SKIP(return, "test needs to run as root");
1024
1025 if (unshare(CLONE_NEWNS | CLONE_NEWNET))
1026 SKIP(return, "unshare(CLONE_NEWNS|CLONE_NEWNET): %s",
1027 strerror(errno));
1028
1029 /* Don't let our sysfs mount escape into the parent namespace. */
1030 ASSERT_EQ(mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL), 0);
1031
1032 strcpy(self->mnt, "/tmp/kernfs_selftest_sysfs.XXXXXX");
1033 if (!mkdtemp(self->mnt))
1034 SKIP(return, "mkdtemp: %s", strerror(errno));
1035
1036 if (mount("none", self->mnt, "sysfs", 0, NULL)) {
1037 rmdir(self->mnt);
1038 SKIP(return, "mount sysfs: %s", strerror(errno));
1039 }
1040 self->mounted = true;
1041
1042 snprintf(self->net, sizeof(self->net), "%s/class/net", self->mnt);
1043 }
1044
FIXTURE_TEARDOWN(kernfs_netns)1045 FIXTURE_TEARDOWN(kernfs_netns)
1046 {
1047 if (self->mounted)
1048 umount2(self->mnt, MNT_DETACH);
1049 rmdir(self->mnt);
1050 }
1051
1052 /*
1053 * sysfs must show this network namespace's interfaces, not the parent's.
1054 *
1055 * Do not assume a fresh netns contains only "lo": fallback tunnel devices
1056 * (tunl0, sit0, gre0, ...) are created in every namespace unless
1057 * net.core.fb_tunnels_only_for_init_net is set, so which names appear
1058 * depends on the modules the host has. Check the set instead --
1059 * if_nametoindex() resolves in the current netns, so every name sysfs shows
1060 * must resolve there, and the counts must agree.
1061 *
1062 * Count only symlinks. Not every entry is a device: bonding adds a
1063 * bonding_masters attribute to /sys/class/net in every namespace.
1064 */
TEST_F(kernfs_netns,ns_tag_isolates_class_net)1065 TEST_F(kernfs_netns, ns_tag_isolates_class_net)
1066 {
1067 struct if_nameindex *idx, *i;
1068 bool found_lo = false;
1069 int n = 0, want = 0;
1070 struct dirent *de;
1071 DIR *d;
1072
1073 d = opendir(self->net);
1074 ASSERT_NE(d, NULL);
1075 while ((de = readdir(d))) {
1076 if (de->d_type != DT_LNK)
1077 continue;
1078 EXPECT_NE(if_nametoindex(de->d_name), 0u)
1079 TH_LOG("%s is not in this netns", de->d_name);
1080 if (!strcmp(de->d_name, "lo"))
1081 found_lo = true;
1082 n++;
1083 }
1084 closedir(d);
1085
1086 idx = if_nameindex();
1087 ASSERT_NE(idx, NULL);
1088 for (i = idx; i->if_index; i++)
1089 want++;
1090 if_freenameindex(idx);
1091
1092 EXPECT_TRUE(found_lo);
1093 EXPECT_EQ(n, want);
1094 }
1095
1096 /*
1097 * After a rename the old name must stop resolving and the new one must
1098 * start, even though both dentries are already cached.
1099 */
TEST_F(kernfs_netns,rename_is_revalidated)1100 TEST_F(kernfs_netns, rename_is_revalidated)
1101 {
1102 char old_path[PATH_MAX], new_path[PATH_MAX];
1103 struct ifreq ifr = {};
1104 struct stat st;
1105 int sk;
1106
1107 snprintf(old_path, sizeof(old_path), "%s/lo", self->net);
1108 snprintf(new_path, sizeof(new_path), "%s/%s", self->net, TEST_IFNAME);
1109
1110 /* Warm both dentries: one positive, one negative. */
1111 ASSERT_EQ(stat(old_path, &st), 0);
1112 ASSERT_EQ(stat(new_path, &st), -1);
1113 ASSERT_EQ(errno, ENOENT);
1114
1115 sk = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0);
1116 ASSERT_GE(sk, 0);
1117 strcpy(ifr.ifr_name, "lo");
1118 strcpy(ifr.ifr_newname, TEST_IFNAME);
1119 if (ioctl(sk, SIOCSIFNAME, &ifr)) {
1120 close(sk);
1121 SKIP(return, "SIOCSIFNAME: %s", strerror(errno));
1122 }
1123 close(sk);
1124
1125 EXPECT_EQ(stat(old_path, &st), -1);
1126 EXPECT_EQ(errno, ENOENT);
1127 EXPECT_EQ(stat(new_path, &st), 0);
1128 }
1129
netdev_rename(const char * from,const char * to)1130 static int netdev_rename(const char *from, const char *to)
1131 {
1132 struct ifreq ifr = {};
1133 int sk, ret;
1134
1135 sk = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0);
1136 if (sk < 0)
1137 return -1;
1138 strncpy(ifr.ifr_name, from, IFNAMSIZ - 1);
1139 strncpy(ifr.ifr_newname, to, IFNAMSIZ - 1);
1140 ret = ioctl(sk, SIOCSIFNAME, &ifr);
1141 close(sk);
1142 return ret;
1143 }
1144
1145 /*
1146 * Bounded by a count, not by time: every rename is logged and not rate
1147 * limited, so a timed loop would flood the kernel log.
1148 */
1149 #define RENAME_FLIPS 200
1150 #define RENAME_READERS 4
1151
1152 /*
1153 * Rename an interface while other tasks look up the names it moves
1154 * between. This renames its /sys/class/net entry through
1155 * kernfs_rename_ns() with the parent unchanged.
1156 *
1157 * The renamer checks what is certain: SIOCSIFNAME returns once the rename
1158 * is done and nothing else renames here, so the new name must resolve and
1159 * the old must not. The readers cannot check that, because the name can
1160 * move between their two lstat() calls. They only check that a lookup
1161 * returns success or ENOENT, and keep the lock busy while renames run.
1162 *
1163 * lstat() not stat(): /sys/class/net/<dev> is a symlink and is renamed
1164 * before the directory it points at, so the two are not atomic.
1165 */
TEST_F(kernfs_netns,rename_vs_lookup_stress)1166 TEST_F(kernfs_netns, rename_vs_lookup_stress)
1167 {
1168 char old_path[PATH_MAX], new_path[PATH_MAX];
1169 pid_t pids[RENAME_READERS];
1170 int i, status, n = 0, bad = 0;
1171 struct stat st;
1172 int done[2];
1173
1174 snprintf(old_path, sizeof(old_path), "%s/lo", self->net);
1175 snprintf(new_path, sizeof(new_path), "%s/%s", self->net, TEST_IFNAME);
1176
1177 if (netdev_rename("lo", TEST_IFNAME))
1178 SKIP(return, "SIOCSIFNAME: %s", strerror(errno));
1179 if (netdev_rename(TEST_IFNAME, "lo"))
1180 SKIP(return, "SIOCSIFNAME back: %s", strerror(errno));
1181
1182 /* Readers run until the renamer closes the write end. */
1183 ASSERT_EQ(pipe2(done, O_NONBLOCK | O_CLOEXEC), 0);
1184
1185 for (i = 0; i < RENAME_READERS; i++) {
1186 pid_t pid = fork();
1187
1188 ASSERT_GE(pid, 0);
1189 if (pid == 0) {
1190 struct stat rst;
1191 char c;
1192
1193 close(done[1]);
1194 while (read(done[0], &c, 1) < 0 && errno == EAGAIN) {
1195 if (lstat(old_path, &rst) && errno != ENOENT)
1196 _exit(20);
1197 if (lstat(new_path, &rst) && errno != ENOENT)
1198 _exit(21);
1199 }
1200 _exit(0);
1201 }
1202 pids[n++] = pid;
1203 }
1204 close(done[0]);
1205
1206 for (i = 0; i < RENAME_FLIPS; i++) {
1207 if (netdev_rename("lo", TEST_IFNAME))
1208 break;
1209 if (lstat(new_path, &st) || !lstat(old_path, &st)) {
1210 bad++;
1211 break;
1212 }
1213 if (netdev_rename(TEST_IFNAME, "lo"))
1214 break;
1215 if (lstat(old_path, &st) || !lstat(new_path, &st)) {
1216 bad++;
1217 break;
1218 }
1219 }
1220 close(done[1]);
1221
1222 for (i = 0; i < n; i++) {
1223 ASSERT_EQ(waitpid(pids[i], &status, 0), pids[i]);
1224 ASSERT_TRUE(WIFEXITED(status));
1225 EXPECT_EQ(WEXITSTATUS(status), 0);
1226 }
1227
1228 EXPECT_EQ(bad, 0)
1229 TH_LOG("a completed rename left the wrong name resolving");
1230
1231 /* Leave the interface as the fixture found it. */
1232 netdev_rename(TEST_IFNAME, "lo");
1233 }
1234
1235 TEST_HARNESS_MAIN
1236