Re: [PATCH] fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE

Christian Brauner
2024-08-05T07:22:12Z

> Reproducer follows:
>
> #define __GNU_SOURCE
> #include <linux/close_range.h>
> #include <unistd.h>
> #include <fcntl.h>
> #include <signal.h>
> #include <sched.h>
> #include <stdio.h>
> #include <stdbool.h>
> #include <sys/mman.h>
>
> void is_open(int fd)
> {
> printf("#%d is %s\n", fd,
> fcntl(fd, F_GETFD) >= 0 ? "opened" : "not opened");
> }
>
> int child(void *unused)
> {
> while(1) {
> }
> return 0;
> }
>
> int main(void)
> {
> char *stack;
> pid_t pid;
>
> stack = mmap(NULL, 1024*1024, PROT_READ | PROT_WRITE,
> MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0);
> if (stack == MAP_FAILED) {
> perror("mmap");
> return -1;
> }
>
> pid = clone(child, stack + 1024*1024, CLONE_FILES | SIGCHLD, NULL);
> if (pid == -1) {
> perror("clone");
> return -1;
> }
> for (int i = 2; i < 128; i++)
> dup2(0, i);
> close_range(64, ~0U, CLOSE_RANGE_UNSHARE);
>
> is_open(64);
> printf("dup(0) => %d, expected 64\n", dup(0));
>
> kill(pid, 9);
> return 0;

Could you please add that reproducer to
tools/testing/selftests/core/close_range_test.c

TEST(close_range_bitmap_corruption)
{
}

Really, it doesn't have to be pretty but these repros in there really
have been helpful finding such corruptions when run with a proper k*san
config.