]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - tools/testing/radix-tree/idr-test.c
idr: fix invalid ptr dereference on item delete
[mirror_ubuntu-bionic-kernel.git] / tools / testing / radix-tree / idr-test.c
1 /*
2 * idr-test.c: Test the IDR API
3 * Copyright (c) 2016 Matthew Wilcox <willy@infradead.org>
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms and conditions of the GNU General Public License,
7 * version 2, as published by the Free Software Foundation.
8 *
9 * This program is distributed in the hope it will be useful, but WITHOUT
10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
12 * more details.
13 */
14 #include <linux/bitmap.h>
15 #include <linux/idr.h>
16 #include <linux/slab.h>
17 #include <linux/kernel.h>
18 #include <linux/errno.h>
19
20 #include "test.h"
21
22 #define DUMMY_PTR ((void *)0x12)
23
24 int item_idr_free(int id, void *p, void *data)
25 {
26 struct item *item = p;
27 assert(item->index == id);
28 free(p);
29
30 return 0;
31 }
32
33 void item_idr_remove(struct idr *idr, int id)
34 {
35 struct item *item = idr_find(idr, id);
36 assert(item->index == id);
37 idr_remove(idr, id);
38 free(item);
39 }
40
41 void idr_alloc_test(void)
42 {
43 unsigned long i;
44 DEFINE_IDR(idr);
45
46 assert(idr_alloc_cyclic(&idr, DUMMY_PTR, 0, 0x4000, GFP_KERNEL) == 0);
47 assert(idr_alloc_cyclic(&idr, DUMMY_PTR, 0x3ffd, 0x4000, GFP_KERNEL) == 0x3ffd);
48 idr_remove(&idr, 0x3ffd);
49 idr_remove(&idr, 0);
50
51 for (i = 0x3ffe; i < 0x4003; i++) {
52 int id;
53 struct item *item;
54
55 if (i < 0x4000)
56 item = item_create(i, 0);
57 else
58 item = item_create(i - 0x3fff, 0);
59
60 id = idr_alloc_cyclic(&idr, item, 1, 0x4000, GFP_KERNEL);
61 assert(id == item->index);
62 }
63
64 idr_for_each(&idr, item_idr_free, &idr);
65 idr_destroy(&idr);
66 }
67
68 void idr_replace_test(void)
69 {
70 DEFINE_IDR(idr);
71
72 idr_alloc(&idr, (void *)-1, 10, 11, GFP_KERNEL);
73 idr_replace(&idr, &idr, 10);
74
75 idr_destroy(&idr);
76 }
77
78 /*
79 * Unlike the radix tree, you can put a NULL pointer -- with care -- into
80 * the IDR. Some interfaces, like idr_find() do not distinguish between
81 * "present, value is NULL" and "not present", but that's exactly what some
82 * users want.
83 */
84 void idr_null_test(void)
85 {
86 int i;
87 DEFINE_IDR(idr);
88
89 assert(idr_is_empty(&idr));
90
91 assert(idr_alloc(&idr, NULL, 0, 0, GFP_KERNEL) == 0);
92 assert(!idr_is_empty(&idr));
93 idr_remove(&idr, 0);
94 assert(idr_is_empty(&idr));
95
96 assert(idr_alloc(&idr, NULL, 0, 0, GFP_KERNEL) == 0);
97 assert(!idr_is_empty(&idr));
98 idr_destroy(&idr);
99 assert(idr_is_empty(&idr));
100
101 for (i = 0; i < 10; i++) {
102 assert(idr_alloc(&idr, NULL, 0, 0, GFP_KERNEL) == i);
103 }
104
105 assert(idr_replace(&idr, DUMMY_PTR, 3) == NULL);
106 assert(idr_replace(&idr, DUMMY_PTR, 4) == NULL);
107 assert(idr_replace(&idr, NULL, 4) == DUMMY_PTR);
108 assert(idr_replace(&idr, DUMMY_PTR, 11) == ERR_PTR(-ENOENT));
109 idr_remove(&idr, 5);
110 assert(idr_alloc(&idr, NULL, 0, 0, GFP_KERNEL) == 5);
111 idr_remove(&idr, 5);
112
113 for (i = 0; i < 9; i++) {
114 idr_remove(&idr, i);
115 assert(!idr_is_empty(&idr));
116 }
117 idr_remove(&idr, 8);
118 assert(!idr_is_empty(&idr));
119 idr_remove(&idr, 9);
120 assert(idr_is_empty(&idr));
121
122 assert(idr_alloc(&idr, NULL, 0, 0, GFP_KERNEL) == 0);
123 assert(idr_replace(&idr, DUMMY_PTR, 3) == ERR_PTR(-ENOENT));
124 assert(idr_replace(&idr, DUMMY_PTR, 0) == NULL);
125 assert(idr_replace(&idr, NULL, 0) == DUMMY_PTR);
126
127 idr_destroy(&idr);
128 assert(idr_is_empty(&idr));
129
130 for (i = 1; i < 10; i++) {
131 assert(idr_alloc(&idr, NULL, 1, 0, GFP_KERNEL) == i);
132 }
133
134 idr_destroy(&idr);
135 assert(idr_is_empty(&idr));
136 }
137
138 void idr_nowait_test(void)
139 {
140 unsigned int i;
141 DEFINE_IDR(idr);
142
143 idr_preload(GFP_KERNEL);
144
145 for (i = 0; i < 3; i++) {
146 struct item *item = item_create(i, 0);
147 assert(idr_alloc(&idr, item, i, i + 1, GFP_NOWAIT) == i);
148 }
149
150 idr_preload_end();
151
152 idr_for_each(&idr, item_idr_free, &idr);
153 idr_destroy(&idr);
154 }
155
156 void idr_get_next_test(void)
157 {
158 unsigned long i;
159 int nextid;
160 DEFINE_IDR(idr);
161
162 int indices[] = {4, 7, 9, 15, 65, 128, 1000, 99999, 0};
163
164 for(i = 0; indices[i]; i++) {
165 struct item *item = item_create(indices[i], 0);
166 assert(idr_alloc(&idr, item, indices[i], indices[i+1],
167 GFP_KERNEL) == indices[i]);
168 }
169
170 for(i = 0, nextid = 0; indices[i]; i++) {
171 idr_get_next(&idr, &nextid);
172 assert(nextid == indices[i]);
173 nextid++;
174 }
175
176 idr_for_each(&idr, item_idr_free, &idr);
177 idr_destroy(&idr);
178 }
179
180 void idr_checks(void)
181 {
182 unsigned long i;
183 DEFINE_IDR(idr);
184
185 for (i = 0; i < 10000; i++) {
186 struct item *item = item_create(i, 0);
187 assert(idr_alloc(&idr, item, 0, 20000, GFP_KERNEL) == i);
188 }
189
190 assert(idr_alloc(&idr, DUMMY_PTR, 5, 30, GFP_KERNEL) < 0);
191
192 for (i = 0; i < 5000; i++)
193 item_idr_remove(&idr, i);
194
195 idr_remove(&idr, 3);
196
197 idr_for_each(&idr, item_idr_free, &idr);
198 idr_destroy(&idr);
199
200 assert(idr_is_empty(&idr));
201
202 idr_remove(&idr, 3);
203 idr_remove(&idr, 0);
204
205 assert(idr_alloc(&idr, DUMMY_PTR, 0, 0, GFP_KERNEL) == 0);
206 idr_remove(&idr, 1);
207 for (i = 1; i < RADIX_TREE_MAP_SIZE; i++)
208 assert(idr_alloc(&idr, DUMMY_PTR, 0, 0, GFP_KERNEL) == i);
209 idr_remove(&idr, 1 << 30);
210 idr_destroy(&idr);
211
212 for (i = INT_MAX - 3UL; i < INT_MAX + 1UL; i++) {
213 struct item *item = item_create(i, 0);
214 assert(idr_alloc(&idr, item, i, i + 10, GFP_KERNEL) == i);
215 }
216 assert(idr_alloc(&idr, DUMMY_PTR, i - 2, i, GFP_KERNEL) == -ENOSPC);
217
218 idr_for_each(&idr, item_idr_free, &idr);
219 idr_destroy(&idr);
220 idr_destroy(&idr);
221
222 assert(idr_is_empty(&idr));
223
224 for (i = 1; i < 10000; i++) {
225 struct item *item = item_create(i, 0);
226 assert(idr_alloc(&idr, item, 1, 20000, GFP_KERNEL) == i);
227 }
228
229 idr_for_each(&idr, item_idr_free, &idr);
230 idr_destroy(&idr);
231
232 idr_replace_test();
233 idr_alloc_test();
234 idr_null_test();
235 idr_nowait_test();
236 idr_get_next_test();
237 }
238
239 /*
240 * Check that we get the correct error when we run out of memory doing
241 * allocations. To ensure we run out of memory, just "forget" to preload.
242 * The first test is for not having a bitmap available, and the second test
243 * is for not being able to allocate a level of the radix tree.
244 */
245 void ida_check_nomem(void)
246 {
247 DEFINE_IDA(ida);
248 int id, err;
249
250 err = ida_get_new_above(&ida, 256, &id);
251 assert(err == -EAGAIN);
252 err = ida_get_new_above(&ida, 1UL << 30, &id);
253 assert(err == -EAGAIN);
254 }
255
256 /*
257 * Check what happens when we fill a leaf and then delete it. This may
258 * discover mishandling of IDR_FREE.
259 */
260 void ida_check_leaf(void)
261 {
262 DEFINE_IDA(ida);
263 int id;
264 unsigned long i;
265
266 for (i = 0; i < IDA_BITMAP_BITS; i++) {
267 assert(ida_pre_get(&ida, GFP_KERNEL));
268 assert(!ida_get_new(&ida, &id));
269 assert(id == i);
270 }
271
272 ida_destroy(&ida);
273 assert(ida_is_empty(&ida));
274
275 assert(ida_pre_get(&ida, GFP_KERNEL));
276 assert(!ida_get_new(&ida, &id));
277 assert(id == 0);
278 ida_destroy(&ida);
279 assert(ida_is_empty(&ida));
280 }
281
282 /*
283 * Check handling of conversions between exceptional entries and full bitmaps.
284 */
285 void ida_check_conv(void)
286 {
287 DEFINE_IDA(ida);
288 int id;
289 unsigned long i;
290
291 for (i = 0; i < IDA_BITMAP_BITS * 2; i += IDA_BITMAP_BITS) {
292 assert(ida_pre_get(&ida, GFP_KERNEL));
293 assert(!ida_get_new_above(&ida, i + 1, &id));
294 assert(id == i + 1);
295 assert(!ida_get_new_above(&ida, i + BITS_PER_LONG, &id));
296 assert(id == i + BITS_PER_LONG);
297 ida_remove(&ida, i + 1);
298 ida_remove(&ida, i + BITS_PER_LONG);
299 assert(ida_is_empty(&ida));
300 }
301
302 assert(ida_pre_get(&ida, GFP_KERNEL));
303
304 for (i = 0; i < IDA_BITMAP_BITS * 2; i++) {
305 assert(ida_pre_get(&ida, GFP_KERNEL));
306 assert(!ida_get_new(&ida, &id));
307 assert(id == i);
308 }
309
310 for (i = IDA_BITMAP_BITS * 2; i > 0; i--) {
311 ida_remove(&ida, i - 1);
312 }
313 assert(ida_is_empty(&ida));
314
315 for (i = 0; i < IDA_BITMAP_BITS + BITS_PER_LONG - 4; i++) {
316 assert(ida_pre_get(&ida, GFP_KERNEL));
317 assert(!ida_get_new(&ida, &id));
318 assert(id == i);
319 }
320
321 for (i = IDA_BITMAP_BITS + BITS_PER_LONG - 4; i > 0; i--) {
322 ida_remove(&ida, i - 1);
323 }
324 assert(ida_is_empty(&ida));
325
326 radix_tree_cpu_dead(1);
327 for (i = 0; i < 1000000; i++) {
328 int err = ida_get_new(&ida, &id);
329 if (err == -EAGAIN) {
330 assert((i % IDA_BITMAP_BITS) == (BITS_PER_LONG - 2));
331 assert(ida_pre_get(&ida, GFP_KERNEL));
332 err = ida_get_new(&ida, &id);
333 } else {
334 assert((i % IDA_BITMAP_BITS) != (BITS_PER_LONG - 2));
335 }
336 assert(!err);
337 assert(id == i);
338 }
339 ida_destroy(&ida);
340 }
341
342 /*
343 * Check allocations up to and slightly above the maximum allowed (2^31-1) ID.
344 * Allocating up to 2^31-1 should succeed, and then allocating the next one
345 * should fail.
346 */
347 void ida_check_max(void)
348 {
349 DEFINE_IDA(ida);
350 int id, err;
351 unsigned long i, j;
352
353 for (j = 1; j < 65537; j *= 2) {
354 unsigned long base = (1UL << 31) - j;
355 for (i = 0; i < j; i++) {
356 assert(ida_pre_get(&ida, GFP_KERNEL));
357 assert(!ida_get_new_above(&ida, base, &id));
358 assert(id == base + i);
359 }
360 assert(ida_pre_get(&ida, GFP_KERNEL));
361 err = ida_get_new_above(&ida, base, &id);
362 assert(err == -ENOSPC);
363 ida_destroy(&ida);
364 assert(ida_is_empty(&ida));
365 rcu_barrier();
366 }
367 }
368
369 void ida_check_random(void)
370 {
371 DEFINE_IDA(ida);
372 DECLARE_BITMAP(bitmap, 2048);
373 int id, err;
374 unsigned int i;
375 time_t s = time(NULL);
376
377 repeat:
378 memset(bitmap, 0, sizeof(bitmap));
379 for (i = 0; i < 100000; i++) {
380 int i = rand();
381 int bit = i & 2047;
382 if (test_bit(bit, bitmap)) {
383 __clear_bit(bit, bitmap);
384 ida_remove(&ida, bit);
385 } else {
386 __set_bit(bit, bitmap);
387 do {
388 ida_pre_get(&ida, GFP_KERNEL);
389 err = ida_get_new_above(&ida, bit, &id);
390 } while (err == -ENOMEM);
391 assert(!err);
392 assert(id == bit);
393 }
394 }
395 ida_destroy(&ida);
396 if (time(NULL) < s + 10)
397 goto repeat;
398 }
399
400 void ida_simple_get_remove_test(void)
401 {
402 DEFINE_IDA(ida);
403 unsigned long i;
404
405 for (i = 0; i < 10000; i++) {
406 assert(ida_simple_get(&ida, 0, 20000, GFP_KERNEL) == i);
407 }
408 assert(ida_simple_get(&ida, 5, 30, GFP_KERNEL) < 0);
409
410 for (i = 0; i < 10000; i++) {
411 ida_simple_remove(&ida, i);
412 }
413 assert(ida_is_empty(&ida));
414
415 ida_destroy(&ida);
416 }
417
418 void ida_checks(void)
419 {
420 DEFINE_IDA(ida);
421 int id;
422 unsigned long i;
423
424 radix_tree_cpu_dead(1);
425 ida_check_nomem();
426
427 for (i = 0; i < 10000; i++) {
428 assert(ida_pre_get(&ida, GFP_KERNEL));
429 assert(!ida_get_new(&ida, &id));
430 assert(id == i);
431 }
432
433 ida_remove(&ida, 20);
434 ida_remove(&ida, 21);
435 for (i = 0; i < 3; i++) {
436 assert(ida_pre_get(&ida, GFP_KERNEL));
437 assert(!ida_get_new(&ida, &id));
438 if (i == 2)
439 assert(id == 10000);
440 }
441
442 for (i = 0; i < 5000; i++)
443 ida_remove(&ida, i);
444
445 assert(ida_pre_get(&ida, GFP_KERNEL));
446 assert(!ida_get_new_above(&ida, 5000, &id));
447 assert(id == 10001);
448
449 ida_destroy(&ida);
450
451 assert(ida_is_empty(&ida));
452
453 assert(ida_pre_get(&ida, GFP_KERNEL));
454 assert(!ida_get_new_above(&ida, 1, &id));
455 assert(id == 1);
456
457 ida_remove(&ida, id);
458 assert(ida_is_empty(&ida));
459 ida_destroy(&ida);
460 assert(ida_is_empty(&ida));
461
462 assert(ida_pre_get(&ida, GFP_KERNEL));
463 assert(!ida_get_new_above(&ida, 1, &id));
464 ida_destroy(&ida);
465 assert(ida_is_empty(&ida));
466
467 assert(ida_pre_get(&ida, GFP_KERNEL));
468 assert(!ida_get_new_above(&ida, 1, &id));
469 assert(id == 1);
470 assert(ida_pre_get(&ida, GFP_KERNEL));
471 assert(!ida_get_new_above(&ida, 1025, &id));
472 assert(id == 1025);
473 assert(ida_pre_get(&ida, GFP_KERNEL));
474 assert(!ida_get_new_above(&ida, 10000, &id));
475 assert(id == 10000);
476 ida_remove(&ida, 1025);
477 ida_destroy(&ida);
478 assert(ida_is_empty(&ida));
479
480 ida_check_leaf();
481 ida_check_max();
482 ida_check_conv();
483 ida_check_random();
484 ida_simple_get_remove_test();
485
486 radix_tree_cpu_dead(1);
487 }
488
489 static void *ida_random_fn(void *arg)
490 {
491 rcu_register_thread();
492 ida_check_random();
493 rcu_unregister_thread();
494 return NULL;
495 }
496
497 void ida_thread_tests(void)
498 {
499 pthread_t threads[10];
500 int i;
501
502 for (i = 0; i < ARRAY_SIZE(threads); i++)
503 if (pthread_create(&threads[i], NULL, ida_random_fn, NULL)) {
504 perror("creating ida thread");
505 exit(1);
506 }
507
508 while (i--)
509 pthread_join(threads[i], NULL);
510 }
511
512 int __weak main(void)
513 {
514 radix_tree_init();
515 idr_checks();
516 ida_checks();
517 ida_thread_tests();
518 radix_tree_cpu_dead(1);
519 rcu_barrier();
520 if (nr_allocated)
521 printf("nr_allocated = %d\n", nr_allocated);
522 return 0;
523 }