/* * iteration_check.c: test races having to do with radix tree iteration * Copyright (c) 2016 Intel Corporation * Author: Ross Zwisler <ross.zwisler@linux.intel.com> * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, * version 2, as published by the Free Software Foundation. * * This program is distributed in the hope it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for * more details. */ #include <linux/radix-tree.h> #include <pthread.h> #include "test.h" #define NUM_THREADS 5 #define MAX_IDX 100 #define TAG 0 #define NEW_TAG 1 static pthread_mutex_t tree_lock = PTHREAD_MUTEX_INITIALIZER; static pthread_t threads[NUM_THREADS]; static unsigned int seeds[3]; static RADIX_TREE(tree, GFP_KERNEL); static bool test_complete; static int max_order; /* relentlessly fill the tree with tagged entries */ static void *add_entries_fn(void *arg) { rcu_register_thread(); while (!test_complete) { unsigned long pgoff; int order; for (pgoff = 0; pgoff < MAX_IDX; pgoff++) { pthread_mutex_lock(&tree_lock); for (order = max_order; order >= 0; order--) { if (item_insert_order(&tree, pgoff, order) == 0) { item_tag_set(&tree, pgoff, TAG); break; } } pthread_mutex_unlock(&tree_lock); } } rcu_unregister_thread(); return NULL; } /* * Iterate over the tagged entries, doing a radix_tree_iter_retry() as we find * things that have been removed and randomly resetting our iteration to the * next chunk with radix_tree_iter_resume(). Both radix_tree_iter_retry() and * radix_tree_iter_resume() cause radix_tree_next_slot() to be called with a * NULL 'slot' variable. */ static void *tagged_iteration_fn(void *arg) { struct radix_tree_iter iter; void **slot; rcu_register_thread(); while (!test_complete) { rcu_read_lock(); radix_tree_for_each_tagged(slot, &tree, &iter, 0, TAG) { void *entry = radix_tree_deref_slot(slot); if (unlikely(!entry)) continue; if (radix_tree_deref_retry(entry)) { slot = radix_tree_iter_retry(&iter); continue; } if (rand_r(&seeds[0]) % 50 == 0) { slot = radix_tree_iter_resume(slot, &iter); rcu_read_unlock(); rcu_barrier(); rcu_read_lock(); } } rcu_read_unlock(); } rcu_unregister_thread(); return NULL; } /* * Iterate over the entries, doing a radix_tree_iter_retry() as we find things * that have been removed and randomly resetting our iteration to the next * chunk with radix_tree_iter_resume(). Both radix_tree_iter_retry() and * radix_tree_iter_resume() cause radix_tree_next_slot() to be called with a * NULL 'slot' variable. */ static void *untagged_iteration_fn(void *arg) { struct radix_tree_iter iter; void **slot; rcu_register_thread(); while (!test_complete) { rcu_read_lock(); radix_tree_for_each_slot(slot, &tree, &iter, 0) { void *entry = radix_tree_deref_slot(slot); if (unlikely(!entry)) continue; if (radix_tree_deref_retry(entry)) { slot = radix_tree_iter_retry(&iter); continue; } if (rand_r(&seeds[1]) % 50 == 0) { slot = radix_tree_iter_resume(slot, &iter); rcu_read_unlock(); rcu_barrier(); rcu_read_lock(); } } rcu_read_unlock(); } rcu_unregister_thread(); return NULL; } /* * Randomly remove entries to help induce radix_tree_iter_retry() calls in the * two iteration functions. */ static void *remove_entries_fn(void *arg) { rcu_register_thread(); while (!test_complete) { int pgoff; pgoff = rand_r(&seeds[2]) % MAX_IDX; pthread_mutex_lock(&tree_lock); item_delete(&tree, pgoff); pthread_mutex_unlock(&tree_lock); } rcu_unregister_thread(); return NULL; } static void *tag_entries_fn(void *arg) { rcu_register_thread(); while (!test_complete) { tag_tagged_items(&tree, &tree_lock, 0, MAX_IDX, 10, TAG, NEW_TAG); } rcu_unregister_thread(); return NULL; } /* This is a unit test for a bug found by the syzkaller tester */ void iteration_test(unsigned order, unsigned test_duration) { int i; printf("Running %siteration tests for %d seconds\n", order > 0 ? "multiorder " : "", test_duration); max_order = order; test_complete = false; for (i = 0; i < 3; i++) seeds[i] = rand(); if (pthread_create(&threads[0], NULL, tagged_iteration_fn, NULL)) { perror("create tagged iteration thread"); exit(1); } if (pthread_create(&threads[1], NULL, untagged_iteration_fn, NULL)) { perror("create untagged iteration thread"); exit(1); } if (pthread_create(&threads[2], NULL, add_entries_fn, NULL)) { perror("create add entry thread"); exit(1); } if (pthread_create(&threads[3], NULL, remove_entries_fn, NULL)) { perror("create remove entry thread"); exit(1); } if (pthread_create(&threads[4], NULL, tag_entries_fn, NULL)) { perror("create tag entry thread"); exit(1); } sleep(test_duration); test_complete = true; for (i = 0; i < NUM_THREADS; i++) { if (pthread_join(threads[i], NULL)) { perror("pthread_join"); exit(1); } } item_kill_tree(&tree); } amp;id=e2160156bf2a7d5018e99a9993fbcdda0abac09b'>e2160156bf2a7d5018e99a9993fbcdda0abac09b</a> (<a href='/cgit.cgi/linux/net-next.git/patch/net/can/bcm.c?id=e2160156bf2a7d5018e99a9993fbcdda0abac09b'>patch</a>)</td></tr> <tr><th>tree</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/tree/?h=nds-private-remove&id=e2160156bf2a7d5018e99a9993fbcdda0abac09b'>1a70cb13dcfa7ade4c48d8a64d20543abebfb1dc</a> /<a href='/cgit.cgi/linux/net-next.git/tree/net/can/bcm.c?h=nds-private-remove&id=e2160156bf2a7d5018e99a9993fbcdda0abac09b'>net/can/bcm.c</a></td></tr> <tr><th>parent</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/net/can/bcm.c?h=nds-private-remove&id=62e13097c46c69dbd7544ab2cd585ccf48f360a4'>62e13097c46c69dbd7544ab2cd585ccf48f360a4</a> (<a href='/cgit.cgi/linux/net-next.git/diff/net/can/bcm.c?h=nds-private-remove&id=e2160156bf2a7d5018e99a9993fbcdda0abac09b&id2=62e13097c46c69dbd7544ab2cd585ccf48f360a4'>diff</a>)</td></tr><tr><th>parent</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/net/can/bcm.c?h=nds-private-remove&id=6d04dfc8966019b8b0977b2cb942351f13d2b178'>6d04dfc8966019b8b0977b2cb942351f13d2b178</a> (<a href='/cgit.cgi/linux/net-next.git/diff/net/can/bcm.c?h=nds-private-remove&id=e2160156bf2a7d5018e99a9993fbcdda0abac09b&id2=6d04dfc8966019b8b0977b2cb942351f13d2b178'>diff</a>)</td></tr></table> <div class='commit-subject'>Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net</div><div class='commit-msg'>All merge conflicts were simple overlapping changes. Signed-off-by: David S. Miller <davem@davemloft.net> </div><div class='diffstat-header'><a href='/cgit.cgi/linux/net-next.git/diff/?h=nds-private-remove&id=e2160156bf2a7d5018e99a9993fbcdda0abac09b'>Diffstat</a> (limited to 'net/can/bcm.c')</div><table summary='diffstat' class='diffstat'><tr><td class='mode'>-rw-r--r--</td><td class='upd'><a href='/cgit.cgi/linux/net-next.git/diff/net/can/bcm.c?h=nds-private-remove&id=e2160156bf2a7d5018e99a9993fbcdda0abac09b'>net/can/bcm.c</a></td><td class='right'>27</td><td class='graph'><table summary='file diffstat' width='27%'><tr><td class='add' style='width: 66.7%;'/><td class='rem' style='width: 33.3%;'/><td class='none' style='width: 0.0%;'/></tr></table></td></tr> </table><div class='diffstat-summary'>1 files changed, 18 insertions, 9 deletions</div><table summary='diff' class='diff'><tr><td><div class='head'>diff --git a/net/can/bcm.c b/net/can/bcm.c