1*8a272653SPeter Holm#!/bin/sh 2*8a272653SPeter Holm 3*8a272653SPeter Holm# 4*8a272653SPeter Holm# SPDX-License-Identifier: BSD-2-Clause-FreeBSD 5*8a272653SPeter Holm# 6*8a272653SPeter Holm# Copyright (c) 2019 Dell EMC Isilon 7*8a272653SPeter Holm# 8*8a272653SPeter Holm# Redistribution and use in source and binary forms, with or without 9*8a272653SPeter Holm# modification, are permitted provided that the following conditions 10*8a272653SPeter Holm# are met: 11*8a272653SPeter Holm# 1. Redistributions of source code must retain the above copyright 12*8a272653SPeter Holm# notice, this list of conditions and the following disclaimer. 13*8a272653SPeter Holm# 2. Redistributions in binary form must reproduce the above copyright 14*8a272653SPeter Holm# notice, this list of conditions and the following disclaimer in the 15*8a272653SPeter Holm# documentation and/or other materials provided with the distribution. 16*8a272653SPeter Holm# 17*8a272653SPeter Holm# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18*8a272653SPeter Holm# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19*8a272653SPeter Holm# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20*8a272653SPeter Holm# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21*8a272653SPeter Holm# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22*8a272653SPeter Holm# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23*8a272653SPeter Holm# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24*8a272653SPeter Holm# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25*8a272653SPeter Holm# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26*8a272653SPeter Holm# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27*8a272653SPeter Holm# SUCH DAMAGE. 28*8a272653SPeter Holm# 29*8a272653SPeter Holm 30*8a272653SPeter Holm# Regression test for https://reviews.freebsd.org/D20800 31*8a272653SPeter Holm# "Use a consistent snapshot of the fd's rights in fget_mmap()" 32*8a272653SPeter Holm# https://people.freebsd.org/~pho/stress/log/mmap37.txt 33*8a272653SPeter Holm 34*8a272653SPeter Holm# Reported by syzbot+ae359438769fda1840f8@syzkaller.appspotmail.com 35*8a272653SPeter Holm# Test scenario suggestion by markj@ 36*8a272653SPeter Holm# Fixed by r349547 37*8a272653SPeter Holm 38*8a272653SPeter Holm. ../default.cfg 39*8a272653SPeter Holm 40*8a272653SPeter Holmodir=`pwd` 41*8a272653SPeter Holmcd /tmp 42*8a272653SPeter Holmsed '1,/^EOF/d' < $odir/$0 > mmap37.c 43*8a272653SPeter Holmmycc -o mmap37 -Wall -Wextra -O0 mmap37.c -lpthread || exit 1 44*8a272653SPeter Holmrm -f mmap37.c 45*8a272653SPeter Holm 46*8a272653SPeter Holmset -e 47*8a272653SPeter Holmmount | grep "on $mntpoint " | grep -q /dev/md && umount -f $mntpoint 48*8a272653SPeter Holm[ -c /dev/md$mdstart ] && mdconfig -d -u $mdstart 49*8a272653SPeter Holmmdconfig -a -t swap -s 2g -u $mdstart 50*8a272653SPeter Holmnewfs $newfs_flags md$mdstart > /dev/null 51*8a272653SPeter Holmmount /dev/md$mdstart $mntpoint 52*8a272653SPeter Holmset +e 53*8a272653SPeter Holm 54*8a272653SPeter Holmcd $mntpoint 55*8a272653SPeter Holm/tmp/mmap37 56*8a272653SPeter Holmcd $odir 57*8a272653SPeter Holm 58*8a272653SPeter Holmfor i in `jot 6`; do 59*8a272653SPeter Holm mount | grep -q "on $mntpoint " || break 60*8a272653SPeter Holm umount $mntpoint && break || sleep 10 61*8a272653SPeter Holm [ $i -eq 6 ] && 62*8a272653SPeter Holm { echo FATAL; fstat -mf $mntpoint; exit 1; } 63*8a272653SPeter Holmdone 64*8a272653SPeter Holmmdconfig -d -u $mdstart 65*8a272653SPeter Holmrm -f /tmp/mmap37 66*8a272653SPeter Holmexit 67*8a272653SPeter Holm 68*8a272653SPeter HolmEOF 69*8a272653SPeter Holm#include <sys/types.h> 70*8a272653SPeter Holm#include <sys/mman.h> 71*8a272653SPeter Holm#include <sys/param.h> 72*8a272653SPeter Holm 73*8a272653SPeter Holm#include <err.h> 74*8a272653SPeter Holm#include <errno.h> 75*8a272653SPeter Holm#include <fcntl.h> 76*8a272653SPeter Holm#include <pthread.h> 77*8a272653SPeter Holm#include <stdio.h> 78*8a272653SPeter Holm#include <stdlib.h> 79*8a272653SPeter Holm#include <string.h> 80*8a272653SPeter Holm#include <unistd.h> 81*8a272653SPeter Holm#include <unistd.h> 82*8a272653SPeter Holm 83*8a272653SPeter Holm#define THREADS 2 84*8a272653SPeter Holm#define SIZ 0x06400000U /* 100 Mb */ 85*8a272653SPeter Holm 86*8a272653SPeter Holmstatic volatile int go; 87*8a272653SPeter Holmstatic char path[128]; 88*8a272653SPeter Holm 89*8a272653SPeter Holmvoid * 90*8a272653SPeter Holmthr(void *arg) 91*8a272653SPeter Holm{ 92*8a272653SPeter Holm size_t len; 93*8a272653SPeter Holm void *p; 94*8a272653SPeter Holm int fd; 95*8a272653SPeter Holm 96*8a272653SPeter Holm fd = 0; 97*8a272653SPeter Holm len = SIZ; 98*8a272653SPeter Holm if (*(int *)arg == 0) { 99*8a272653SPeter Holm while (go == 1) { 100*8a272653SPeter Holm if ((fd = open(path, 2)) == -1) 101*8a272653SPeter Holm err(1,"open()"); 102*8a272653SPeter Holm p = mmap(NULL, len, PROT_READ | PROT_WRITE, 103*8a272653SPeter Holm MAP_SHARED, fd, 0); 104*8a272653SPeter Holm munmap(p, len); 105*8a272653SPeter Holm close(fd); 106*8a272653SPeter Holm usleep(10); 107*8a272653SPeter Holm } 108*8a272653SPeter Holm } else { 109*8a272653SPeter Holm while (go == 1) { 110*8a272653SPeter Holm close(fd); 111*8a272653SPeter Holm usleep(10); 112*8a272653SPeter Holm } 113*8a272653SPeter Holm } 114*8a272653SPeter Holm 115*8a272653SPeter Holm return (0); 116*8a272653SPeter Holm} 117*8a272653SPeter Holm 118*8a272653SPeter Holmint 119*8a272653SPeter Holmmain(void) 120*8a272653SPeter Holm{ 121*8a272653SPeter Holm pthread_t threads[THREADS]; 122*8a272653SPeter Holm size_t len; 123*8a272653SPeter Holm int nr[THREADS]; 124*8a272653SPeter Holm int i, fd, r; 125*8a272653SPeter Holm 126*8a272653SPeter Holm sprintf(path, "mmap37.%06d", getpid()); 127*8a272653SPeter Holm if ((fd = open(path, O_CREAT | O_TRUNC | O_RDWR, 0622)) == -1) 128*8a272653SPeter Holm err(1,"open()"); 129*8a272653SPeter Holm len = SIZ; 130*8a272653SPeter Holm if (ftruncate(fd, len) == -1) 131*8a272653SPeter Holm err(1, "ftruncate"); 132*8a272653SPeter Holm close(fd); 133*8a272653SPeter Holm 134*8a272653SPeter Holm go = 1; 135*8a272653SPeter Holm for (i = 0; i < THREADS; i++) { 136*8a272653SPeter Holm nr[i] = i; 137*8a272653SPeter Holm if ((r = pthread_create(&threads[i], NULL, thr, 138*8a272653SPeter Holm (void *)&nr[i])) != 0) 139*8a272653SPeter Holm errc(1, r, "pthread_create()"); 140*8a272653SPeter Holm } 141*8a272653SPeter Holm 142*8a272653SPeter Holm sleep(30); 143*8a272653SPeter Holm go = 0; 144*8a272653SPeter Holm 145*8a272653SPeter Holm for (i = 0; i < THREADS; i++) { 146*8a272653SPeter Holm if ((r = pthread_join(threads[i], NULL)) != 0) 147*8a272653SPeter Holm errc(1, r, "pthread_join(%d)", i); 148*8a272653SPeter Holm } 149*8a272653SPeter Holm if (unlink(path) == -1) 150*8a272653SPeter Holm err(1, "unlink(%s)", path); 151*8a272653SPeter Holm 152*8a272653SPeter Holm return (0); 153*8a272653SPeter Holm} 154