1/*
  2 * Copyright © 2018 Alexey Dobriyan <adobriyan@gmail.com>
  3 *
  4 * Permission to use, copy, modify, and distribute this software for any
  5 * purpose with or without fee is hereby granted, provided that the above
  6 * copyright notice and this permission notice appear in all copies.
  7 *
  8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 15 */
 16// Test that /proc/$KERNEL_THREAD/fd/ is empty.
 17
 18#undef NDEBUG
 19#include <sys/syscall.h>
 20#include <assert.h>
 21#include <dirent.h>
 22#include <limits.h>
 23#include <stdio.h>
 24#include <string.h>
 25#include <sys/types.h>
 26#include <sys/stat.h>
 27#include <fcntl.h>
 28#include <unistd.h>
 29
 30#include "proc.h"
 31
 32#define PF_KHTREAD 0x00200000
 33
 34/*
 35 * Test for kernel threadness atomically with openat().
 36 *
 37 * Return /proc/$PID/fd descriptor if process is kernel thread.
 38 * Return -1 if a process is userspace process.
 39 */
 40static int kernel_thread_fd(unsigned int pid)
 41{
 42	unsigned int flags = 0;
 43	char buf[4096];
 44	int dir_fd, fd;
 45	ssize_t rv;
 46
 47	snprintf(buf, sizeof(buf), "/proc/%u", pid);
 48	dir_fd = open(buf, O_RDONLY|O_DIRECTORY);
 49	if (dir_fd == -1)
 50		return -1;
 51
 52	/*
 53	 * Believe it or not, struct task_struct::flags is directly exposed
 54	 * to userspace!
 55	 */
 56	fd = openat(dir_fd, "stat", O_RDONLY);
 57	if (fd == -1) {
 58		close(dir_fd);
 59		return -1;
 60	}
 61	rv = read(fd, buf, sizeof(buf));
 62	close(fd);
 63	if (0 < rv && rv <= sizeof(buf)) {
 64		unsigned long long flags_ull;
 65		char *p, *end;
 66		int i;
 67
 68		assert(buf[rv - 1] == '\n');
 69		buf[rv - 1] = '\0';
 70
 71		/* Search backwards: ->comm can contain whitespace and ')'. */
 72		for (i = 0; i < 43; i++) {
 73			p = strrchr(buf, ' ');
 74			assert(p);
 75			*p = '\0';
 76		}
 77
 78		p = strrchr(buf, ' ');
 79		assert(p);
 80
 81		flags_ull = xstrtoull(p + 1, &end);
 82		assert(*end == '\0');
 83		assert(flags_ull == (unsigned int)flags_ull);
 84
 85		flags = flags_ull;
 86	}
 87
 88	fd = -1;
 89	if (flags & PF_KHTREAD) {
 90		fd = openat(dir_fd, "fd", O_RDONLY|O_DIRECTORY);
 91	}
 92	close(dir_fd);
 93	return fd;
 94}
 95
 96static void test_readdir(int fd)
 97{
 98	DIR *d;
 99	struct dirent *de;
100
101	d = fdopendir(fd);
102	assert(d);
103
104	de = xreaddir(d);
105	assert(streq(de->d_name, "."));
106	assert(de->d_type == DT_DIR);
107
108	de = xreaddir(d);
109	assert(streq(de->d_name, ".."));
110	assert(de->d_type == DT_DIR);
111
112	de = xreaddir(d);
113	assert(!de);
114}
115
116static inline int sys_statx(int dirfd, const char *pathname, int flags,
117			    unsigned int mask, void *stx)
118{
119	return syscall(SYS_statx, dirfd, pathname, flags, mask, stx);
120}
121
122static void test_lookup_fail(int fd, const char *pathname)
123{
124	char stx[256] __attribute__((aligned(8)));
125	int rv;
126
127	rv = sys_statx(fd, pathname, AT_SYMLINK_NOFOLLOW, 0, (void *)stx);
128	assert(rv == -1 && errno == ENOENT);
129}
130
131static void test_lookup(int fd)
132{
133	char buf[64];
134	unsigned int u;
135	int i;
136
137	for (i = INT_MIN; i < INT_MIN + 1024; i++) {
138		snprintf(buf, sizeof(buf), "%d", i);
139		test_lookup_fail(fd, buf);
140	}
141	for (i = -1024; i < 1024; i++) {
142		snprintf(buf, sizeof(buf), "%d", i);
143		test_lookup_fail(fd, buf);
144	}
145	for (u = INT_MAX - 1024; u < (unsigned int)INT_MAX + 1024; u++) {
146		snprintf(buf, sizeof(buf), "%u", u);
147		test_lookup_fail(fd, buf);
148	}
149	for (u = UINT_MAX - 1024; u != 0; u++) {
150		snprintf(buf, sizeof(buf), "%u", u);
151		test_lookup_fail(fd, buf);
152	}
153}
154
155int main(void)
156{
157	unsigned int pid;
158	int fd;
159
160	/*
161	 * In theory this will loop indefinitely if kernel threads are exiled
162	 * from /proc.
163	 *
164	 * Start with kthreadd.
165	 */
166	pid = 2;
167	while ((fd = kernel_thread_fd(pid)) == -1 && pid < 1024) {
168		pid++;
169	}
170	/* EACCES if run as non-root. */
171	if (pid >= 1024)
172		return 1;
173
174	test_readdir(fd);
175	test_lookup(fd);
176
177	return 0;
178}