1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * memfd GUP test-case
4  * This tests memfd interactions with get_user_pages(). We require the
5  * fuse_mnt.c program to provide a fake direct-IO FUSE mount-point for us. This
6  * file-system delays _all_ reads by 1s and forces direct-IO. This means, any
7  * read() on files in that file-system will pin the receive-buffer pages for at
8  * least 1s via get_user_pages().
9  *
10  * We use this trick to race ADD_SEALS against a write on a memfd object. The
11  * ADD_SEALS must fail if the memfd pages are still pinned. Note that we use
12  * the read() syscall with our memory-mapped memfd object as receive buffer to
13  * force the kernel to write into our memfd object.
14  */
15 
16 #define _GNU_SOURCE
17 #define __EXPORTED_HEADERS__
18 
19 #include <errno.h>
20 #include <inttypes.h>
21 #include <limits.h>
22 #include <linux/falloc.h>
23 #include <fcntl.h>
24 #include <linux/memfd.h>
25 #include <linux/types.h>
26 #include <sched.h>
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <signal.h>
30 #include <string.h>
31 #include <sys/mman.h>
32 #include <sys/stat.h>
33 #include <sys/syscall.h>
34 #include <sys/wait.h>
35 #include <unistd.h>
36 
37 #include "common.h"
38 
39 #define MFD_DEF_SIZE 8192
40 #define STACK_SIZE 65536
41 
42 static size_t mfd_def_size = MFD_DEF_SIZE;
43 
44 static int mfd_assert_new(const char *name, loff_t sz, unsigned int flags)
45 {
46 	int r, fd;
47 
48 	fd = sys_memfd_create(name, flags);
49 	if (fd < 0) {
50 		printf("memfd_create(\"%s\", %u) failed: %m\n",
51 		       name, flags);
52 		abort();
53 	}
54 
55 	r = ftruncate(fd, sz);
56 	if (r < 0) {
57 		printf("ftruncate(%llu) failed: %m\n", (unsigned long long)sz);
58 		abort();
59 	}
60 
61 	return fd;
62 }
63 
64 static __u64 mfd_assert_get_seals(int fd)
65 {
66 	long r;
67 
68 	r = fcntl(fd, F_GET_SEALS);
69 	if (r < 0) {
70 		printf("GET_SEALS(%d) failed: %m\n", fd);
71 		abort();
72 	}
73 
74 	return r;
75 }
76 
77 static void mfd_assert_has_seals(int fd, __u64 seals)
78 {
79 	__u64 s;
80 
81 	s = mfd_assert_get_seals(fd);
82 	if (s != seals) {
83 		printf("%llu != %llu = GET_SEALS(%d)\n",
84 		       (unsigned long long)seals, (unsigned long long)s, fd);
85 		abort();
86 	}
87 }
88 
89 static void mfd_assert_add_seals(int fd, __u64 seals)
90 {
91 	long r;
92 	__u64 s;
93 
94 	s = mfd_assert_get_seals(fd);
95 	r = fcntl(fd, F_ADD_SEALS, seals);
96 	if (r < 0) {
97 		printf("ADD_SEALS(%d, %llu -> %llu) failed: %m\n",
98 		       fd, (unsigned long long)s, (unsigned long long)seals);
99 		abort();
100 	}
101 }
102 
103 static int mfd_busy_add_seals(int fd, __u64 seals)
104 {
105 	long r;
106 	__u64 s;
107 
108 	r = fcntl(fd, F_GET_SEALS);
109 	if (r < 0)
110 		s = 0;
111 	else
112 		s = r;
113 
114 	r = fcntl(fd, F_ADD_SEALS, seals);
115 	if (r < 0 && errno != EBUSY) {
116 		printf("ADD_SEALS(%d, %llu -> %llu) didn't fail as expected with EBUSY: %m\n",
117 		       fd, (unsigned long long)s, (unsigned long long)seals);
118 		abort();
119 	}
120 
121 	return r;
122 }
123 
124 static void *mfd_assert_mmap_shared(int fd)
125 {
126 	void *p;
127 
128 	p = mmap(NULL,
129 		 mfd_def_size,
130 		 PROT_READ | PROT_WRITE,
131 		 MAP_SHARED,
132 		 fd,
133 		 0);
134 	if (p == MAP_FAILED) {
135 		printf("mmap() failed: %m\n");
136 		abort();
137 	}
138 
139 	return p;
140 }
141 
142 static void *mfd_assert_mmap_private(int fd)
143 {
144 	void *p;
145 
146 	p = mmap(NULL,
147 		 mfd_def_size,
148 		 PROT_READ | PROT_WRITE,
149 		 MAP_PRIVATE,
150 		 fd,
151 		 0);
152 	if (p == MAP_FAILED) {
153 		printf("mmap() failed: %m\n");
154 		abort();
155 	}
156 
157 	return p;
158 }
159 
160 static int global_mfd = -1;
161 static void *global_p = NULL;
162 
163 static int sealing_thread_fn(void *arg)
164 {
165 	int sig, r;
166 
167 	/*
168 	 * This thread first waits 200ms so any pending operation in the parent
169 	 * is correctly started. After that, it tries to seal @global_mfd as
170 	 * SEAL_WRITE. This _must_ fail as the parent thread has a read() into
171 	 * that memory mapped object still ongoing.
172 	 * We then wait one more second and try sealing again. This time it
173 	 * must succeed as there shouldn't be anyone else pinning the pages.
174 	 */
175 
176 	/* wait 200ms for FUSE-request to be active */
177 	usleep(200000);
178 
179 	/* unmount mapping before sealing to avoid i_mmap_writable failures */
180 	munmap(global_p, mfd_def_size);
181 
182 	/* Try sealing the global file; expect EBUSY or success. Current
183 	 * kernels will never succeed, but in the future, kernels might
184 	 * implement page-replacements or other fancy ways to avoid racing
185 	 * writes. */
186 	r = mfd_busy_add_seals(global_mfd, F_SEAL_WRITE);
187 	if (r >= 0) {
188 		printf("HURRAY! This kernel fixed GUP races!\n");
189 	} else {
190 		/* wait 1s more so the FUSE-request is done */
191 		sleep(1);
192 
193 		/* try sealing the global file again */
194 		mfd_assert_add_seals(global_mfd, F_SEAL_WRITE);
195 	}
196 
197 	return 0;
198 }
199 
200 static pid_t spawn_sealing_thread(void)
201 {
202 	uint8_t *stack;
203 	pid_t pid;
204 
205 	stack = malloc(STACK_SIZE);
206 	if (!stack) {
207 		printf("malloc(STACK_SIZE) failed: %m\n");
208 		abort();
209 	}
210 
211 	pid = clone(sealing_thread_fn,
212 		    stack + STACK_SIZE,
213 		    SIGCHLD | CLONE_FILES | CLONE_FS | CLONE_VM,
214 		    NULL);
215 	if (pid < 0) {
216 		printf("clone() failed: %m\n");
217 		abort();
218 	}
219 
220 	return pid;
221 }
222 
223 static void join_sealing_thread(pid_t pid)
224 {
225 	waitpid(pid, NULL, 0);
226 }
227 
228 int main(int argc, char **argv)
229 {
230 	char *zero;
231 	int fd, mfd, r;
232 	void *p;
233 	int was_sealed;
234 	pid_t pid;
235 
236 	if (argc < 2) {
237 		printf("error: please pass path to file in fuse_mnt mount-point\n");
238 		abort();
239 	}
240 
241 	if (argc >= 3) {
242 		if (!strcmp(argv[2], "hugetlbfs")) {
243 			unsigned long hpage_size = default_huge_page_size();
244 
245 			if (!hpage_size) {
246 				printf("Unable to determine huge page size\n");
247 				abort();
248 			}
249 
250 			hugetlbfs_test = 1;
251 			mfd_def_size = hpage_size * 2;
252 		} else {
253 			printf("Unknown option: %s\n", argv[2]);
254 			abort();
255 		}
256 	}
257 
258 	zero = calloc(sizeof(*zero), mfd_def_size);
259 
260 	/* open FUSE memfd file for GUP testing */
261 	printf("opening: %s\n", argv[1]);
262 	fd = open(argv[1], O_RDONLY | O_CLOEXEC);
263 	if (fd < 0) {
264 		printf("cannot open(\"%s\"): %m\n", argv[1]);
265 		abort();
266 	}
267 
268 	/* create new memfd-object */
269 	mfd = mfd_assert_new("kern_memfd_fuse",
270 			     mfd_def_size,
271 			     MFD_CLOEXEC | MFD_ALLOW_SEALING);
272 
273 	/* mmap memfd-object for writing */
274 	p = mfd_assert_mmap_shared(mfd);
275 
276 	/* pass mfd+mapping to a separate sealing-thread which tries to seal
277 	 * the memfd objects with SEAL_WRITE while we write into it */
278 	global_mfd = mfd;
279 	global_p = p;
280 	pid = spawn_sealing_thread();
281 
282 	/* Use read() on the FUSE file to read into our memory-mapped memfd
283 	 * object. This races the other thread which tries to seal the
284 	 * memfd-object.
285 	 * If @fd is on the memfd-fake-FUSE-FS, the read() is delayed by 1s.
286 	 * This guarantees that the receive-buffer is pinned for 1s until the
287 	 * data is written into it. The racing ADD_SEALS should thus fail as
288 	 * the pages are still pinned. */
289 	r = read(fd, p, mfd_def_size);
290 	if (r < 0) {
291 		printf("read() failed: %m\n");
292 		abort();
293 	} else if (!r) {
294 		printf("unexpected EOF on read()\n");
295 		abort();
296 	}
297 
298 	was_sealed = mfd_assert_get_seals(mfd) & F_SEAL_WRITE;
299 
300 	/* Wait for sealing-thread to finish and verify that it
301 	 * successfully sealed the file after the second try. */
302 	join_sealing_thread(pid);
303 	mfd_assert_has_seals(mfd, F_SEAL_WRITE);
304 
305 	/* *IF* the memfd-object was sealed at the time our read() returned,
306 	 * then the kernel did a page-replacement or canceled the read() (or
307 	 * whatever magic it did..). In that case, the memfd object is still
308 	 * all zero.
309 	 * In case the memfd-object was *not* sealed, the read() was successfull
310 	 * and the memfd object must *not* be all zero.
311 	 * Note that in real scenarios, there might be a mixture of both, but
312 	 * in this test-cases, we have explicit 200ms delays which should be
313 	 * enough to avoid any in-flight writes. */
314 
315 	p = mfd_assert_mmap_private(mfd);
316 	if (was_sealed && memcmp(p, zero, mfd_def_size)) {
317 		printf("memfd sealed during read() but data not discarded\n");
318 		abort();
319 	} else if (!was_sealed && !memcmp(p, zero, mfd_def_size)) {
320 		printf("memfd sealed after read() but data discarded\n");
321 		abort();
322 	}
323 
324 	close(mfd);
325 	close(fd);
326 
327 	printf("fuse: DONE\n");
328 	free(zero);
329 
330 	return 0;
331 }
332