From mboxrd@z Thu Jan  1 00:00:00 1970
From: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Subject: [PATCH] tests/gem_reset_stats: add close-pending-fork
Date: Mon,  2 Dec 2013 16:47:46 +0200
Message-ID: <1385995666-3541-1-git-send-email-mika.kuoppala@intel.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <intel-gfx-bounces@lists.freedesktop.org>
Received: from mga02.intel.com (mga02.intel.com [134.134.136.20])
	by gabe.freedesktop.org (Postfix) with ESMTP id 01118FA993
	for <intel-gfx@lists.freedesktop.org>;
	Mon,  2 Dec 2013 06:47:56 -0800 (PST)
List-Unsubscribe: <http://lists.freedesktop.org/mailman/options/intel-gfx>,
	<mailto:intel-gfx-request@lists.freedesktop.org?subject=unsubscribe>
List-Archive: <http://lists.freedesktop.org/archives/intel-gfx>
List-Post: <mailto:intel-gfx@lists.freedesktop.org>
List-Help: <mailto:intel-gfx-request@lists.freedesktop.org?subject=help>
List-Subscribe: <http://lists.freedesktop.org/mailman/listinfo/intel-gfx>,
	<mailto:intel-gfx-request@lists.freedesktop.org?subject=subscribe>
Sender: intel-gfx-bounces@lists.freedesktop.org
Errors-To: intel-gfx-bounces@lists.freedesktop.org
To: intel-gfx@lists.freedesktop.org
List-Id: intel-gfx@lists.freedesktop.org

Fork and create another filedesc to wait access to already
hung GPU and then kill it. This triggers use after free of the
request->batch_obj.

Signed-off-by: Mika Kuoppala <mika.kuoppala@intel.com>
---
 tests/gem_reset_stats.c |   63 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)

diff --git a/tests/gem_reset_stats.c b/tests/gem_reset_stats.c
index 6c22bce..242300c 100644
--- a/tests/gem_reset_stats.c
+++ b/tests/gem_reset_stats.c
@@ -25,6 +25,7 @@
  *
  */
 
+#define _GNU_SOURCE
 #include <unistd.h>
 #include <stdlib.h>
 #include <stdio.h>
@@ -36,6 +37,7 @@
 #include <sys/ioctl.h>
 #include <sys/mman.h>
 #include <time.h>
+#include <signal.h>
 
 #include "i915_drm.h"
 #include "intel_bufmgr.h"
@@ -637,6 +639,64 @@ static void test_close_pending(void)
 	close(fd);
 }
 
+static int __test_open_any(void)
+{
+	char *name;
+	int ret, fd;
+
+	ret = asprintf(&name, "/dev/dri/card%d", drm_get_card());
+	if (ret == -1)
+		return -1;
+
+	fd = open(name, O_RDWR);
+	free(name);
+
+	return fd;
+}
+
+static void test_close_pending_fork(void)
+{
+	int pid;
+	int fd, fd2, h;
+
+	fd = drm_open_any();
+	igt_assert(fd >= 0);
+
+	assert_reset_status(fd, 0, RS_NO_ERROR);
+
+	igt_disable_exit_handler();
+
+	h = inject_hang(fd, 0);
+	igt_assert(h >= 0);
+
+	sleep(1);
+
+	pid = fork();
+	if (pid == 0) {
+		fd2 = __test_open_any();
+		igt_assert(fd2 >= 0);
+		gem_quiescent_gpu(fd2);
+		close(fd2);
+	} else {
+		igt_assert(pid > 0);
+		sleep(1);
+		kill(pid, SIGKILL);
+	}
+
+	gem_close(fd, h);
+	close(fd);
+
+	fd = drm_open_any();
+	igt_assert(fd >= 0);
+
+	h = exec_valid(fd, 0);
+	igt_assert(h >= 0);
+
+	gem_sync(fd, h);
+	gem_close(fd, h);
+	close(fd);
+}
+
 static void drop_root(void)
 {
 	igt_assert(getuid() == 0);
@@ -837,6 +897,9 @@ igt_main
 	igt_subtest("close-pending")
 		test_close_pending();
 
+	igt_subtest("close-pending-fork")
+		test_close_pending_fork();
+
 	igt_subtest("params")
 		test_params();
 }
-- 
1.7.9.5