1// SPDX-License-Identifier: GPL-2.0
2/*
3 * memfd GUP test-case
4 * This tests memfd interactions with get_user_pages(). We require the
5 * fuse_mnt.c program to provide a fake direct-IO FUSE mount-point for us. This
6 * file-system delays _all_ reads by 1s and forces direct-IO. This means, any
7 * read() on files in that file-system will pin the receive-buffer pages for at
8 * least 1s via get_user_pages().
9 *
10 * We use this trick to race ADD_SEALS against a write on a memfd object. The
11 * ADD_SEALS must fail if the memfd pages are still pinned. Note that we use
12 * the read() syscall with our memory-mapped memfd object as receive buffer to
13 * force the kernel to write into our memfd object.
14 */
15
16#define _GNU_SOURCE
17#define __EXPORTED_HEADERS__
18
19#include <errno.h>
20#include <inttypes.h>
21#include <limits.h>
22#include <linux/falloc.h>
23#include <fcntl.h>
24#include <linux/memfd.h>
25#include <linux/types.h>
26#include <sched.h>
27#include <stdio.h>
28#include <stdlib.h>
29#include <signal.h>
30#include <string.h>
31#include <sys/mman.h>
32#include <sys/stat.h>
33#include <sys/syscall.h>
34#include <sys/wait.h>
35#include <unistd.h>
36
37#include "common.h"
38
39#define MFD_DEF_SIZE 8192
40#define STACK_SIZE 65536
41
42static size_t mfd_def_size = MFD_DEF_SIZE;
43
44static int mfd_assert_new(const char *name, loff_t sz, unsigned int flags)
45{
46	int r, fd;
47
48	fd = sys_memfd_create(name, flags);
49	if (fd < 0) {
50		printf("memfd_create(\"%s\", %u) failed: %m\n",
51		       name, flags);
52		abort();
53	}
54
55	r = ftruncate(fd, sz);
56	if (r < 0) {
57		printf("ftruncate(%llu) failed: %m\n", (unsigned long long)sz);
58		abort();
59	}
60
61	return fd;
62}
63
64static __u64 mfd_assert_get_seals(int fd)
65{
66	long r;
67
68	r = fcntl(fd, F_GET_SEALS);
69	if (r < 0) {
70		printf("GET_SEALS(%d) failed: %m\n", fd);
71		abort();
72	}
73
74	return r;
75}
76
77static void mfd_assert_has_seals(int fd, __u64 seals)
78{
79	__u64 s;
80
81	s = mfd_assert_get_seals(fd);
82	if (s != seals) {
83		printf("%llu != %llu = GET_SEALS(%d)\n",
84		       (unsigned long long)seals, (unsigned long long)s, fd);
85		abort();
86	}
87}
88
89static void mfd_assert_add_seals(int fd, __u64 seals)
90{
91	long r;
92	__u64 s;
93
94	s = mfd_assert_get_seals(fd);
95	r = fcntl(fd, F_ADD_SEALS, seals);
96	if (r < 0) {
97		printf("ADD_SEALS(%d, %llu -> %llu) failed: %m\n",
98		       fd, (unsigned long long)s, (unsigned long long)seals);
99		abort();
100	}
101}
102
103static int mfd_busy_add_seals(int fd, __u64 seals)
104{
105	long r;
106	__u64 s;
107
108	r = fcntl(fd, F_GET_SEALS);
109	if (r < 0)
110		s = 0;
111	else
112		s = r;
113
114	r = fcntl(fd, F_ADD_SEALS, seals);
115	if (r < 0 && errno != EBUSY) {
116		printf("ADD_SEALS(%d, %llu -> %llu) didn't fail as expected with EBUSY: %m\n",
117		       fd, (unsigned long long)s, (unsigned long long)seals);
118		abort();
119	}
120
121	return r;
122}
123
124static void *mfd_assert_mmap_shared(int fd)
125{
126	void *p;
127
128	p = mmap(NULL,
129		 mfd_def_size,
130		 PROT_READ | PROT_WRITE,
131		 MAP_SHARED,
132		 fd,
133		 0);
134	if (p == MAP_FAILED) {
135		printf("mmap() failed: %m\n");
136		abort();
137	}
138
139	return p;
140}
141
142static void *mfd_assert_mmap_private(int fd)
143{
144	void *p;
145
146	p = mmap(NULL,
147		 mfd_def_size,
148		 PROT_READ | PROT_WRITE,
149		 MAP_PRIVATE,
150		 fd,
151		 0);
152	if (p == MAP_FAILED) {
153		printf("mmap() failed: %m\n");
154		abort();
155	}
156
157	return p;
158}
159
160static int global_mfd = -1;
161static void *global_p = NULL;
162
163static int sealing_thread_fn(void *arg)
164{
165	int sig, r;
166
167	/*
168	 * This thread first waits 200ms so any pending operation in the parent
169	 * is correctly started. After that, it tries to seal @global_mfd as
170	 * SEAL_WRITE. This _must_ fail as the parent thread has a read() into
171	 * that memory mapped object still ongoing.
172	 * We then wait one more second and try sealing again. This time it
173	 * must succeed as there shouldn't be anyone else pinning the pages.
174	 */
175
176	/* wait 200ms for FUSE-request to be active */
177	usleep(200000);
178
179	/* unmount mapping before sealing to avoid i_mmap_writable failures */
180	munmap(global_p, mfd_def_size);
181
182	/* Try sealing the global file; expect EBUSY or success. Current
183	 * kernels will never succeed, but in the future, kernels might
184	 * implement page-replacements or other fancy ways to avoid racing
185	 * writes. */
186	r = mfd_busy_add_seals(global_mfd, F_SEAL_WRITE);
187	if (r >= 0) {
188		printf("HURRAY! This kernel fixed GUP races!\n");
189	} else {
190		/* wait 1s more so the FUSE-request is done */
191		sleep(1);
192
193		/* try sealing the global file again */
194		mfd_assert_add_seals(global_mfd, F_SEAL_WRITE);
195	}
196
197	return 0;
198}
199
200static pid_t spawn_sealing_thread(void)
201{
202	uint8_t *stack;
203	pid_t pid;
204
205	stack = malloc(STACK_SIZE);
206	if (!stack) {
207		printf("malloc(STACK_SIZE) failed: %m\n");
208		abort();
209	}
210
211	pid = clone(sealing_thread_fn,
212		    stack + STACK_SIZE,
213		    SIGCHLD | CLONE_FILES | CLONE_FS | CLONE_VM,
214		    NULL);
215	if (pid < 0) {
216		printf("clone() failed: %m\n");
217		abort();
218	}
219
220	return pid;
221}
222
223static void join_sealing_thread(pid_t pid)
224{
225	waitpid(pid, NULL, 0);
226}
227
228int main(int argc, char **argv)
229{
230	char *zero;
231	int fd, mfd, r;
232	void *p;
233	int was_sealed;
234	pid_t pid;
235
236	if (argc < 2) {
237		printf("error: please pass path to file in fuse_mnt mount-point\n");
238		abort();
239	}
240
241	if (argc >= 3) {
242		if (!strcmp(argv[2], "hugetlbfs")) {
243			unsigned long hpage_size = default_huge_page_size();
244
245			if (!hpage_size) {
246				printf("Unable to determine huge page size\n");
247				abort();
248			}
249
250			hugetlbfs_test = 1;
251			mfd_def_size = hpage_size * 2;
252		} else {
253			printf("Unknown option: %s\n", argv[2]);
254			abort();
255		}
256	}
257
258	zero = calloc(sizeof(*zero), mfd_def_size);
259
260	/* open FUSE memfd file for GUP testing */
261	printf("opening: %s\n", argv[1]);
262	fd = open(argv[1], O_RDONLY | O_CLOEXEC);
263	if (fd < 0) {
264		printf("cannot open(\"%s\"): %m\n", argv[1]);
265		abort();
266	}
267
268	/* create new memfd-object */
269	mfd = mfd_assert_new("kern_memfd_fuse",
270			     mfd_def_size,
271			     MFD_CLOEXEC | MFD_ALLOW_SEALING);
272
273	/* mmap memfd-object for writing */
274	p = mfd_assert_mmap_shared(mfd);
275
276	/* pass mfd+mapping to a separate sealing-thread which tries to seal
277	 * the memfd objects with SEAL_WRITE while we write into it */
278	global_mfd = mfd;
279	global_p = p;
280	pid = spawn_sealing_thread();
281
282	/* Use read() on the FUSE file to read into our memory-mapped memfd
283	 * object. This races the other thread which tries to seal the
284	 * memfd-object.
285	 * If @fd is on the memfd-fake-FUSE-FS, the read() is delayed by 1s.
286	 * This guarantees that the receive-buffer is pinned for 1s until the
287	 * data is written into it. The racing ADD_SEALS should thus fail as
288	 * the pages are still pinned. */
289	r = read(fd, p, mfd_def_size);
290	if (r < 0) {
291		printf("read() failed: %m\n");
292		abort();
293	} else if (!r) {
294		printf("unexpected EOF on read()\n");
295		abort();
296	}
297
298	was_sealed = mfd_assert_get_seals(mfd) & F_SEAL_WRITE;
299
300	/* Wait for sealing-thread to finish and verify that it
301	 * successfully sealed the file after the second try. */
302	join_sealing_thread(pid);
303	mfd_assert_has_seals(mfd, F_SEAL_WRITE);
304
305	/* *IF* the memfd-object was sealed at the time our read() returned,
306	 * then the kernel did a page-replacement or canceled the read() (or
307	 * whatever magic it did..). In that case, the memfd object is still
308	 * all zero.
309	 * In case the memfd-object was *not* sealed, the read() was successfull
310	 * and the memfd object must *not* be all zero.
311	 * Note that in real scenarios, there might be a mixture of both, but
312	 * in this test-cases, we have explicit 200ms delays which should be
313	 * enough to avoid any in-flight writes. */
314
315	p = mfd_assert_mmap_private(mfd);
316	if (was_sealed && memcmp(p, zero, mfd_def_size)) {
317		printf("memfd sealed during read() but data not discarded\n");
318		abort();
319	} else if (!was_sealed && !memcmp(p, zero, mfd_def_size)) {
320		printf("memfd sealed after read() but data discarded\n");
321		abort();
322	}
323
324	close(mfd);
325	close(fd);
326
327	printf("fuse: DONE\n");
328	free(zero);
329
330	return 0;
331}
332