1// SPDX-License-Identifier: GPL-2.0
 2/* Copyright (c) 2021 Facebook */
 3#define _GNU_SOURCE
 4#include <sched.h>
 5#include <test_progs.h>
 6#include <time.h>
 7#include <sys/mman.h>
 8#include <sys/syscall.h>
 9#include "fexit_sleep.lskel.h"
10
11static int do_sleep(void *skel)
12{
13	struct fexit_sleep_lskel *fexit_skel = skel;
14	struct timespec ts1 = { .tv_nsec = 1 };
15	struct timespec ts2 = { .tv_sec = 10 };
16
17	fexit_skel->bss->pid = getpid();
18	(void)syscall(__NR_nanosleep, &ts1, NULL);
19	(void)syscall(__NR_nanosleep, &ts2, NULL);
20	return 0;
21}
22
23#define STACK_SIZE (1024 * 1024)
24
25void test_fexit_sleep(void)
26{
27	struct fexit_sleep_lskel *fexit_skel = NULL;
28	int wstatus, duration = 0;
29	pid_t cpid;
30	char *child_stack = NULL;
31	int err, fexit_cnt;
32
33	fexit_skel = fexit_sleep_lskel__open_and_load();
34	if (CHECK(!fexit_skel, "fexit_skel_load", "fexit skeleton failed\n"))
35		goto cleanup;
36
37	err = fexit_sleep_lskel__attach(fexit_skel);
38	if (CHECK(err, "fexit_attach", "fexit attach failed: %d\n", err))
39		goto cleanup;
40
41	child_stack = mmap(NULL, STACK_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE |
42			   MAP_ANONYMOUS | MAP_STACK, -1, 0);
43	if (!ASSERT_NEQ(child_stack, MAP_FAILED, "mmap"))
44		goto cleanup;
45
46	cpid = clone(do_sleep, child_stack + STACK_SIZE, CLONE_FILES | SIGCHLD, fexit_skel);
47	if (CHECK(cpid == -1, "clone", "%s\n", strerror(errno)))
48		goto cleanup;
49
50	/* wait until first sys_nanosleep ends and second sys_nanosleep starts */
51	while (READ_ONCE(fexit_skel->bss->fentry_cnt) != 2);
52	fexit_cnt = READ_ONCE(fexit_skel->bss->fexit_cnt);
53	if (CHECK(fexit_cnt != 1, "fexit_cnt", "%d", fexit_cnt))
54		goto cleanup;
55
56	/* close progs and detach them. That will trigger two nop5->jmp5 rewrites
57	 * in the trampolines to skip nanosleep_fexit prog.
58	 * The nanosleep_fentry prog will get detached first.
59	 * The nanosleep_fexit prog will get detached second.
60	 * Detaching will trigger freeing of both progs JITed images.
61	 * There will be two dying bpf_tramp_image-s, but only the initial
62	 * bpf_tramp_image (with both _fentry and _fexit progs will be stuck
63	 * waiting for percpu_ref_kill to confirm). The other one
64	 * will be freed quickly.
65	 */
66	close(fexit_skel->progs.nanosleep_fentry.prog_fd);
67	close(fexit_skel->progs.nanosleep_fexit.prog_fd);
68	fexit_sleep_lskel__detach(fexit_skel);
69
70	/* kill the thread to unwind sys_nanosleep stack through the trampoline */
71	kill(cpid, 9);
72
73	if (CHECK(waitpid(cpid, &wstatus, 0) == -1, "waitpid", "%s\n", strerror(errno)))
74		goto cleanup;
75	if (CHECK(WEXITSTATUS(wstatus) != 0, "exitstatus", "failed"))
76		goto cleanup;
77
78	/* The bypassed nanosleep_fexit prog shouldn't have executed.
79	 * Unlike progs the maps were not freed and directly accessible.
80	 */
81	fexit_cnt = READ_ONCE(fexit_skel->bss->fexit_cnt);
82	if (CHECK(fexit_cnt != 1, "fexit_cnt", "%d", fexit_cnt))
83		goto cleanup;
84
85cleanup:
86	munmap(child_stack, STACK_SIZE);
87	fexit_sleep_lskel__destroy(fexit_skel);
88}