1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright (c) 2021 Facebook */ 3 #define _GNU_SOURCE 4 #include <sched.h> 5 #include <test_progs.h> 6 #include <time.h> 7 #include <sys/mman.h> 8 #include <sys/syscall.h> 9 #include "fexit_sleep.lskel.h" 10 11 static int do_sleep(void *skel) 12 { 13 struct fexit_sleep_lskel *fexit_skel = skel; 14 struct timespec ts1 = { .tv_nsec = 1 }; 15 struct timespec ts2 = { .tv_sec = 10 }; 16 17 fexit_skel->bss->pid = getpid(); 18 (void)syscall(__NR_nanosleep, &ts1, NULL); 19 (void)syscall(__NR_nanosleep, &ts2, NULL); 20 return 0; 21 } 22 23 #define STACK_SIZE (1024 * 1024) 24 25 void test_fexit_sleep(void) 26 { 27 struct fexit_sleep_lskel *fexit_skel = NULL; 28 int wstatus, duration = 0; 29 pid_t cpid; 30 char *child_stack = NULL; 31 int err, fexit_cnt; 32 33 fexit_skel = fexit_sleep_lskel__open_and_load(); 34 if (CHECK(!fexit_skel, "fexit_skel_load", "fexit skeleton failed\n")) 35 goto cleanup; 36 37 err = fexit_sleep_lskel__attach(fexit_skel); 38 if (CHECK(err, "fexit_attach", "fexit attach failed: %d\n", err)) 39 goto cleanup; 40 41 child_stack = mmap(NULL, STACK_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | 42 MAP_ANONYMOUS | MAP_STACK, -1, 0); 43 if (!ASSERT_NEQ(child_stack, MAP_FAILED, "mmap")) 44 goto cleanup; 45 46 cpid = clone(do_sleep, child_stack + STACK_SIZE, CLONE_FILES | SIGCHLD, fexit_skel); 47 if (CHECK(cpid == -1, "clone", "%s\n", strerror(errno))) 48 goto cleanup; 49 50 /* wait until first sys_nanosleep ends and second sys_nanosleep starts */ 51 while (READ_ONCE(fexit_skel->bss->fentry_cnt) != 2); 52 fexit_cnt = READ_ONCE(fexit_skel->bss->fexit_cnt); 53 if (CHECK(fexit_cnt != 1, "fexit_cnt", "%d", fexit_cnt)) 54 goto cleanup; 55 56 /* close progs and detach them. That will trigger two nop5->jmp5 rewrites 57 * in the trampolines to skip nanosleep_fexit prog. 58 * The nanosleep_fentry prog will get detached first. 59 * The nanosleep_fexit prog will get detached second. 60 * Detaching will trigger freeing of both progs JITed images. 61 * There will be two dying bpf_tramp_image-s, but only the initial 62 * bpf_tramp_image (with both _fentry and _fexit progs will be stuck 63 * waiting for percpu_ref_kill to confirm). The other one 64 * will be freed quickly. 65 */ 66 close(fexit_skel->progs.nanosleep_fentry.prog_fd); 67 close(fexit_skel->progs.nanosleep_fexit.prog_fd); 68 fexit_sleep_lskel__detach(fexit_skel); 69 70 /* kill the thread to unwind sys_nanosleep stack through the trampoline */ 71 kill(cpid, 9); 72 73 if (CHECK(waitpid(cpid, &wstatus, 0) == -1, "waitpid", "%s\n", strerror(errno))) 74 goto cleanup; 75 if (CHECK(WEXITSTATUS(wstatus) != 0, "exitstatus", "failed")) 76 goto cleanup; 77 78 /* The bypassed nanosleep_fexit prog shouldn't have executed. 79 * Unlike progs the maps were not freed and directly accessible. 80 */ 81 fexit_cnt = READ_ONCE(fexit_skel->bss->fexit_cnt); 82 if (CHECK(fexit_cnt != 1, "fexit_cnt", "%d", fexit_cnt)) 83 goto cleanup; 84 85 cleanup: 86 munmap(child_stack, STACK_SIZE); 87 fexit_sleep_lskel__destroy(fexit_skel); 88 } 89