Commit | Line | Data |
---|---|---|
d273fd4b MD |
1 | // SPDX-License-Identifier: MIT |
2 | // SPDX-FileCopyrightText: 2024 Mathieu Desnoyers <mathieu.desnoyers@efficios.com> | |
3 | /* | |
4 | * rseq memory pool test. | |
5 | */ | |
6 | ||
7 | #ifndef _GNU_SOURCE | |
8 | #define _GNU_SOURCE | |
9 | #endif | |
10 | #include <assert.h> | |
11 | #include <sched.h> | |
12 | #include <signal.h> | |
13 | #include <stdio.h> | |
14 | #include <string.h> | |
15 | #include <sys/time.h> | |
16 | #include <inttypes.h> | |
17 | #include <stdlib.h> | |
c15b99f6 OD |
18 | #include <sys/wait.h> |
19 | #include <unistd.h> | |
d273fd4b MD |
20 | |
21 | #include <rseq/mempool.h> | |
c3fad074 | 22 | #include "../src/rseq-utils.h" |
d273fd4b MD |
23 | |
24 | #include "list.h" | |
25 | #include "tap.h" | |
26 | ||
455e090e MD |
27 | #if RSEQ_BITS_PER_LONG == 64 |
28 | # define POISON_VALUE 0xABCDABCDABCDABCDULL | |
29 | #else | |
30 | # define POISON_VALUE 0xABCDABCDUL | |
31 | #endif | |
32 | ||
d273fd4b | 33 | struct test_data { |
5e000535 | 34 | uintptr_t value[2]; |
d273fd4b MD |
35 | struct test_data __rseq_percpu *backref; |
36 | struct list_head node; | |
37 | }; | |
38 | ||
53569d03 MD |
39 | static void test_mempool_fill(enum rseq_mempool_populate_policy policy, |
40 | unsigned long max_nr_ranges, size_t stride) | |
d273fd4b MD |
41 | { |
42 | struct test_data __rseq_percpu *ptr; | |
84a5a73a | 43 | struct test_data *iter, *tmp; |
0ba2a93e MD |
44 | struct rseq_mempool *mempool; |
45 | struct rseq_mempool_attr *attr; | |
d273fd4b MD |
46 | uint64_t count = 0; |
47 | LIST_HEAD(list); | |
5e000535 | 48 | int ret, i, size_order; |
e62b6d54 MD |
49 | struct test_data init_value = { |
50 | .value = { | |
51 | 123, | |
52 | 456, | |
53 | }, | |
54 | .backref = NULL, | |
55 | .node = {}, | |
56 | }; | |
d273fd4b | 57 | |
0ba2a93e | 58 | attr = rseq_mempool_attr_create(); |
a8ad787a | 59 | ok(attr, "Create pool attribute"); |
0ba2a93e | 60 | ret = rseq_mempool_attr_set_robust(attr); |
d273fd4b | 61 | ok(ret == 0, "Setting mempool robust attribute"); |
cb475906 MD |
62 | ret = rseq_mempool_attr_set_percpu(attr, stride, CPU_SETSIZE); |
63 | ok(ret == 0, "Setting mempool percpu type"); | |
dcb59d50 MD |
64 | ret = rseq_mempool_attr_set_max_nr_ranges(attr, max_nr_ranges); |
65 | ok(ret == 0, "Setting mempool max_nr_ranges=%lu", max_nr_ranges); | |
455e090e MD |
66 | ret = rseq_mempool_attr_set_poison(attr, POISON_VALUE); |
67 | ok(ret == 0, "Setting mempool poison"); | |
53569d03 MD |
68 | ret = rseq_mempool_attr_set_populate_policy(attr, policy); |
69 | ok(ret == 0, "Setting mempool populate policy to %s", | |
4e8ae59d | 70 | policy == RSEQ_MEMPOOL_POPULATE_PRIVATE_NONE ? "NONE" : "ALL"); |
0ba2a93e | 71 | mempool = rseq_mempool_create("test_data", |
cb475906 | 72 | sizeof(struct test_data), attr); |
f2981623 | 73 | ok(mempool, "Create mempool of size %zu", stride); |
0ba2a93e | 74 | rseq_mempool_attr_destroy(attr); |
d273fd4b MD |
75 | |
76 | for (;;) { | |
77 | struct test_data *cpuptr; | |
78 | ||
15da5c27 | 79 | ptr = (struct test_data __rseq_percpu *) rseq_mempool_percpu_zmalloc(mempool); |
d273fd4b MD |
80 | if (!ptr) |
81 | break; | |
82 | /* Link items in cpu 0. */ | |
06e0b1c0 | 83 | cpuptr = rseq_percpu_ptr(ptr, 0, stride); |
d273fd4b MD |
84 | cpuptr->backref = ptr; |
85 | /* Randomize items in list. */ | |
86 | if (count & 1) | |
87 | list_add(&cpuptr->node, &list); | |
88 | else | |
89 | list_add_tail(&cpuptr->node, &list); | |
90 | count++; | |
91 | } | |
92 | ||
5e000535 MD |
93 | size_order = rseq_get_count_order_ulong(sizeof(struct test_data)); |
94 | ok(count * (1U << size_order) == stride * max_nr_ranges, | |
dcb59d50 | 95 | "Allocated %" PRIu64 " objects in pool", count); |
d273fd4b MD |
96 | |
97 | list_for_each_entry(iter, &list, node) { | |
98 | ptr = iter->backref; | |
99 | for (i = 0; i < CPU_SETSIZE; i++) { | |
06e0b1c0 | 100 | struct test_data *cpuptr = rseq_percpu_ptr(ptr, i, stride); |
d273fd4b | 101 | |
5e000535 | 102 | if (cpuptr->value[0] != 0) |
d273fd4b | 103 | abort(); |
5e000535 | 104 | cpuptr->value[0]++; |
d273fd4b MD |
105 | } |
106 | } | |
d273fd4b MD |
107 | ok(1, "Check for pool content corruption"); |
108 | ||
84a5a73a | 109 | list_for_each_entry_safe(iter, tmp, &list, node) { |
d273fd4b | 110 | ptr = iter->backref; |
15da5c27 | 111 | rseq_mempool_percpu_free(ptr, stride); |
d273fd4b | 112 | } |
c6a3de0e MD |
113 | ok(1, "Free all objects"); |
114 | ||
115 | ptr = (struct test_data __rseq_percpu *) rseq_mempool_percpu_zmalloc(mempool); | |
116 | if (!ptr) | |
117 | abort(); | |
118 | ok(1, "Allocate one object"); | |
119 | ||
120 | rseq_mempool_percpu_free(ptr, stride); | |
121 | ok(1, "Free one object"); | |
122 | ||
e62b6d54 MD |
123 | ptr = (struct test_data __rseq_percpu *) |
124 | rseq_mempool_percpu_malloc_init(mempool, | |
125 | &init_value, sizeof(struct test_data)); | |
126 | if (!ptr) | |
127 | abort(); | |
128 | ok(1, "Allocate one initialized object"); | |
129 | ||
130 | ok(ptr->value[0] == 123 && ptr->value[1] == 456, "Validate initial values"); | |
131 | ||
132 | rseq_mempool_percpu_free(ptr, stride); | |
133 | ok(1, "Free one object"); | |
134 | ||
0ba2a93e | 135 | ret = rseq_mempool_destroy(mempool); |
d273fd4b MD |
136 | ok(ret == 0, "Destroy mempool"); |
137 | } | |
138 | ||
fbe55804 MD |
139 | static void test_robust_double_free(struct rseq_mempool *pool, |
140 | enum rseq_mempool_populate_policy policy __attribute__((unused))) | |
c15b99f6 OD |
141 | { |
142 | struct test_data __rseq_percpu *ptr; | |
143 | ||
15da5c27 | 144 | ptr = (struct test_data __rseq_percpu *) rseq_mempool_percpu_malloc(pool); |
c15b99f6 | 145 | |
15da5c27 MD |
146 | rseq_mempool_percpu_free(ptr); |
147 | rseq_mempool_percpu_free(ptr); | |
c15b99f6 OD |
148 | } |
149 | ||
fbe55804 MD |
150 | static void test_robust_corrupt_after_free(struct rseq_mempool *pool, |
151 | enum rseq_mempool_populate_policy policy) | |
c15b99f6 OD |
152 | { |
153 | struct test_data __rseq_percpu *ptr; | |
154 | struct test_data *cpuptr; | |
155 | ||
15da5c27 | 156 | ptr = (struct test_data __rseq_percpu *) rseq_mempool_percpu_malloc(pool); |
fbe55804 MD |
157 | /* |
158 | * Corrupt free list: For robust pools, the free list is located | |
159 | * after the last cpu memory range for populate all, and after | |
160 | * the init values memory range for populate none. | |
161 | */ | |
4e8ae59d | 162 | if (policy == RSEQ_MEMPOOL_POPULATE_PRIVATE_ALL) |
fbe55804 MD |
163 | cpuptr = (struct test_data *) rseq_percpu_ptr(ptr, rseq_mempool_get_max_nr_cpus(pool)); |
164 | else | |
165 | cpuptr = (struct test_data *) rseq_percpu_ptr(ptr, rseq_mempool_get_max_nr_cpus(pool) + 1); | |
c15b99f6 | 166 | |
15da5c27 | 167 | rseq_mempool_percpu_free(ptr); |
5e000535 | 168 | cpuptr->value[0] = (uintptr_t) test_robust_corrupt_after_free; |
c15b99f6 | 169 | |
0ba2a93e | 170 | rseq_mempool_destroy(pool); |
c15b99f6 OD |
171 | } |
172 | ||
fbe55804 MD |
173 | static void test_robust_memory_leak(struct rseq_mempool *pool, |
174 | enum rseq_mempool_populate_policy policy __attribute__((unused))) | |
c15b99f6 | 175 | { |
15da5c27 | 176 | (void) rseq_mempool_percpu_malloc(pool); |
c15b99f6 | 177 | |
0ba2a93e | 178 | rseq_mempool_destroy(pool); |
c15b99f6 OD |
179 | } |
180 | ||
fbe55804 MD |
181 | static void test_robust_free_list_corruption(struct rseq_mempool *pool, |
182 | enum rseq_mempool_populate_policy policy) | |
c15b99f6 OD |
183 | { |
184 | struct test_data __rseq_percpu *ptr; | |
185 | struct test_data *cpuptr; | |
186 | ||
15da5c27 | 187 | ptr = (struct test_data __rseq_percpu *) rseq_mempool_percpu_malloc(pool); |
fbe55804 MD |
188 | /* |
189 | * Corrupt free list: For robust pools, the free list is located | |
190 | * after the last cpu memory range for populate all, and after | |
191 | * the init values memory range for populate none. | |
192 | */ | |
4e8ae59d | 193 | if (policy == RSEQ_MEMPOOL_POPULATE_PRIVATE_ALL) |
fbe55804 MD |
194 | cpuptr = (struct test_data *) rseq_percpu_ptr(ptr, rseq_mempool_get_max_nr_cpus(pool)); |
195 | else | |
196 | cpuptr = (struct test_data *) rseq_percpu_ptr(ptr, rseq_mempool_get_max_nr_cpus(pool) + 1); | |
c15b99f6 | 197 | |
15da5c27 | 198 | rseq_mempool_percpu_free(ptr); |
c15b99f6 | 199 | |
5e000535 | 200 | cpuptr->value[0] = (uintptr_t) cpuptr; |
c15b99f6 | 201 | |
15da5c27 MD |
202 | (void) rseq_mempool_percpu_malloc(pool); |
203 | (void) rseq_mempool_percpu_malloc(pool); | |
c15b99f6 OD |
204 | } |
205 | ||
fbe55804 MD |
206 | static void test_robust_poison_corruption_malloc(struct rseq_mempool *pool, |
207 | enum rseq_mempool_populate_policy policy __attribute__((unused))) | |
5e000535 MD |
208 | { |
209 | struct test_data __rseq_percpu *ptr; | |
210 | struct test_data *cpuptr; | |
211 | ||
212 | ptr = (struct test_data __rseq_percpu *) rseq_mempool_percpu_malloc(pool); | |
213 | cpuptr = (struct test_data *) rseq_percpu_ptr(ptr, 0); | |
214 | ||
215 | rseq_mempool_percpu_free(ptr); | |
216 | ||
fbe55804 | 217 | cpuptr->value[0] = 1; |
5e000535 MD |
218 | |
219 | (void) rseq_mempool_percpu_malloc(pool); | |
220 | } | |
221 | ||
fbe55804 MD |
222 | static void test_robust_poison_corruption_destroy(struct rseq_mempool *pool, |
223 | enum rseq_mempool_populate_policy policy __attribute__((unused))) | |
5e000535 MD |
224 | { |
225 | struct test_data __rseq_percpu *ptr; | |
226 | struct test_data *cpuptr; | |
227 | ||
228 | ptr = (struct test_data __rseq_percpu *) rseq_mempool_percpu_malloc(pool); | |
229 | cpuptr = (struct test_data *) rseq_percpu_ptr(ptr, 0); | |
230 | ||
231 | rseq_mempool_percpu_free(ptr); | |
232 | ||
fbe55804 | 233 | cpuptr->value[0] = 1; |
5e000535 MD |
234 | |
235 | rseq_mempool_destroy(pool); | |
236 | } | |
237 | ||
fbe55804 MD |
238 | static int run_robust_test(void (*test)(struct rseq_mempool *, enum rseq_mempool_populate_policy), |
239 | struct rseq_mempool *pool, enum rseq_mempool_populate_policy policy) | |
c15b99f6 OD |
240 | { |
241 | pid_t cpid; | |
242 | int status; | |
243 | ||
244 | cpid = fork(); | |
245 | ||
246 | switch (cpid) { | |
247 | case -1: | |
248 | return 0; | |
249 | case 0: | |
fbe55804 | 250 | test(pool, policy); |
c15b99f6 OD |
251 | _exit(EXIT_FAILURE); |
252 | default: | |
253 | waitpid(cpid, &status, 0); | |
254 | } | |
255 | ||
256 | if (WIFSIGNALED(status) && | |
257 | (SIGABRT == WTERMSIG(status))) | |
258 | return 1; | |
259 | ||
260 | return 0; | |
261 | } | |
262 | ||
53569d03 | 263 | static void run_robust_tests(enum rseq_mempool_populate_policy policy) |
c15b99f6 | 264 | { |
0ba2a93e MD |
265 | struct rseq_mempool_attr *attr; |
266 | struct rseq_mempool *pool; | |
cb475906 | 267 | int ret; |
c15b99f6 | 268 | |
0ba2a93e | 269 | attr = rseq_mempool_attr_create(); |
cb475906 MD |
270 | ok(attr, "Create mempool attributes"); |
271 | ||
272 | ret = rseq_mempool_attr_set_robust(attr); | |
273 | ok(ret == 0, "Setting mempool robust attribute"); | |
c15b99f6 | 274 | |
cb475906 MD |
275 | ret = rseq_mempool_attr_set_percpu(attr, RSEQ_MEMPOOL_STRIDE, 1); |
276 | ok(ret == 0, "Setting mempool percpu type"); | |
c15b99f6 | 277 | |
53569d03 MD |
278 | ret = rseq_mempool_attr_set_populate_policy(attr, policy); |
279 | ok(ret == 0, "Setting mempool populate policy to %s", | |
4e8ae59d | 280 | policy == RSEQ_MEMPOOL_POPULATE_PRIVATE_NONE ? "PRIVATE_NONE" : "PRIVATE_ALL"); |
a5694a4d | 281 | |
0ba2a93e | 282 | pool = rseq_mempool_create("mempool-robust", |
5e000535 | 283 | sizeof(struct test_data), attr); |
c15b99f6 | 284 | |
0ba2a93e | 285 | rseq_mempool_attr_destroy(attr); |
c15b99f6 | 286 | |
fbe55804 | 287 | ok(run_robust_test(test_robust_double_free, pool, policy), |
c15b99f6 OD |
288 | "robust-double-free"); |
289 | ||
fbe55804 | 290 | ok(run_robust_test(test_robust_memory_leak, pool, policy), |
c15b99f6 OD |
291 | "robust-memory-leak"); |
292 | ||
fbe55804 | 293 | ok(run_robust_test(test_robust_poison_corruption_malloc, pool, policy), |
5e000535 MD |
294 | "robust-poison-corruption-malloc"); |
295 | ||
fbe55804 | 296 | ok(run_robust_test(test_robust_poison_corruption_destroy, pool, policy), |
5e000535 MD |
297 | "robust-poison-corruption-destroy"); |
298 | ||
fbe55804 MD |
299 | ok(run_robust_test(test_robust_corrupt_after_free, pool, policy), |
300 | "robust-corrupt-after-free"); | |
301 | ||
302 | ok(run_robust_test(test_robust_free_list_corruption, pool, policy), | |
303 | "robust-free-list-corruption"); | |
53569d03 | 304 | |
0ba2a93e | 305 | rseq_mempool_destroy(pool); |
c15b99f6 OD |
306 | } |
307 | ||
d273fd4b MD |
308 | int main(void) |
309 | { | |
310 | size_t len; | |
dcb59d50 | 311 | unsigned long nr_ranges; |
d273fd4b | 312 | |
579badcb MD |
313 | plan_no_plan(); |
314 | ||
dcb59d50 MD |
315 | for (nr_ranges = 1; nr_ranges < 32; nr_ranges <<= 1) { |
316 | /* From page size to 64kB */ | |
317 | for (len = rseq_get_page_len(); len < 65536; len <<= 1) { | |
4e8ae59d MD |
318 | test_mempool_fill(RSEQ_MEMPOOL_POPULATE_PRIVATE_ALL, nr_ranges, len); |
319 | test_mempool_fill(RSEQ_MEMPOOL_POPULATE_PRIVATE_NONE, nr_ranges, len); | |
dcb59d50 | 320 | } |
d273fd4b MD |
321 | } |
322 | ||
dcb59d50 MD |
323 | len = rseq_get_page_len(); |
324 | if (len < 65536) | |
325 | len = 65536; | |
326 | /* From min(page size, 64kB) to 4MB */ | |
53569d03 | 327 | for (; len < 4096 * 1024; len <<= 1) { |
4e8ae59d MD |
328 | test_mempool_fill(RSEQ_MEMPOOL_POPULATE_PRIVATE_ALL, 1, len); |
329 | test_mempool_fill(RSEQ_MEMPOOL_POPULATE_PRIVATE_NONE, 1, len); | |
53569d03 | 330 | } |
dcb59d50 | 331 | |
4e8ae59d MD |
332 | run_robust_tests(RSEQ_MEMPOOL_POPULATE_PRIVATE_ALL); |
333 | run_robust_tests(RSEQ_MEMPOOL_POPULATE_PRIVATE_NONE); | |
c15b99f6 | 334 | |
d273fd4b MD |
335 | exit(exit_status()); |
336 | } |