Add new perf_mmap_close bug test

CHANGES

@@ -1,3 +1,6 @@
+22 May 2013
++ Add perf_mmap_close_bug
+
 30 April 2013
 + Added new offcore_response_mask test
 + Added crash test case for sw event overflow

README

@@ -31,6 +31,9 @@ There are various subdirectories:
                   kernel versions from userspace.
                   * USE CAUTION RUNNING THESE TESTS *
 
+   + fuzzer    -- a fuzzer tool that tries to hit the extremes of
+                  the perf_event interface and find bugs in the kernel
+
    + generalized_events -- tests that check the validity of the various
                   perf_event generalized events, such as "instructions"
                   or "cycles"

bugs/Makefile

@@ -7,6 +7,7 @@ all:	\
 	check_papi_multiplexing \
 	check_schedulability \
 	nmi_watchdog_group_leader \
+	perf_mmap_close_bug \
 	read_group_attached \
 	sync_read_required \
 
@@ -107,12 +108,23 @@ nmi_watchdog_group_leader.o:	nmi_watchdog_group_leader.c
 
 ###
 
+perf_mmap_close_bug:	perf_mmap_close_bug.o \
+			../lib/perf_helpers.o
+	$(CC) $(LFLAGS) -o perf_mmap_close_bug perf_mmap_close_bug.o \
+			../lib/perf_helpers.o
+
+perf_mmap_close_bug.o:	perf_mmap_close_bug.c
+	$(CC) $(CFLAGS) -c perf_mmap_close_bug.c
+
+####
+
 clean:	
 	rm -f *~ *.o \
 	check_multiplexing \
 	check_papi_multiplexing \
 	check_schedulability \
 	nmi_watchdog_group_leader \
+	perf_mmap_close_bug \
 	read_group_attached \
 	sync_read_required \
 

bugs/perf_mmap_close_bug.c

@@ -0,0 +1,80 @@
+/* perf_mmap_close_bug.c */
+/* By Vince Weaver <vincent.weaver at maine.edu>                             */
+/* compile with "gcc -O2 -Wall -o perf_mmap_close_bug perf_mmap_close_bug.c  */
+/* This will reliably OOPS my core2 Linux 3.10-rc2 machine                   */
+
+#include <stdio.h>
+#include <linux/perf_event.h>
+#include <sys/mman.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <errno.h>
+
+#include "../include/perf_helpers.h"
+
+
+int main(int argc, char **argv) {
+
+	struct perf_event_attr pe1,pe2;
+	int fd1,fd2;
+
+	memset(&pe1,0,sizeof(struct perf_event_attr));
+	memset(&pe2,0,sizeof(struct perf_event_attr));
+
+	pe1.type=0;
+	pe1.size=0x60;
+	pe1.config=3;
+	pe1.sample_type=0x4f0;
+	pe1.read_format=5;
+	pe1.exclude_kernel=1;
+	pe1.bp_type=1;
+	pe1.config1=0x1d469257;
+	pe1.config2=2;
+
+	fd1=perf_event_open(&pe1,0,0,-1,3);
+	if (fd1<0) {
+		fprintf(stderr,"Error opening fd1 %s\n",strerror(errno));
+		exit(1);
+	}
+
+	mmap(NULL, 69632, PROT_READ|PROT_WRITE, MAP_SHARED, fd1, 0);
+
+	ioctl(fd1,PERF_EVENT_IOC_RESET,0);
+
+	pe2.type=1;
+	pe2.size=0x60;
+	pe2.config=2;
+	pe2.read_format=3;
+	pe2.exclusive=1;
+	pe2.exclude_user=1;
+	pe2.mmap=1;
+	pe2.inherit_stat=1;
+	pe2.enable_on_exec=1;
+	pe2.task=1;
+	pe2.watermark=1;
+	pe2.precise_ip=2;
+	pe2.sample_id_all=1;
+	pe2.exclude_guest=1;
+	pe2.wakeup_events=1500395763;
+
+	fd2=perf_event_open(&pe2,0,0,fd1,3);
+
+	fd1=perf_event_open(&pe1,0,0,-1,3);
+	if (fd2<0) {
+		fprintf(stderr,"Error opening fd2 %s\n",strerror(errno));
+		exit(1);
+	}
+
+	mmap(NULL, 69632, PROT_READ|PROT_WRITE, MAP_SHARED, fd2, 0);
+
+	ioctl(fd1,PERF_EVENT_IOC_ENABLE,0);
+
+	ioctl(fd2,PERF_EVENT_IOC_ENABLE,0);
+
+   	close(fd2);
+
+	return 0;
+}

run_crash_tests.sh

@@ -19,3 +19,4 @@ sleep 5
 ./crashes/oflo_sw_cpu_clock_crash
 ./crashes/sw_event_config_overflow
 ./crashes/offcore_response_mask
+./crashes/perf_mmap_close_bug