/*      $OpenBSD: kqueue-regress.c,v 1.5 2022/03/29 19:04:19 millert Exp $      */
/*
 *      Written by Anton Lindqvist <anton@openbsd.org> 2018 Public Domain
 */

#include <sys/types.h>
#include <sys/event.h>
#include <sys/mman.h>
#include <sys/resource.h>
#include <sys/select.h>
#include <sys/time.h>
#include <sys/wait.h>

#include <assert.h>
#include <err.h>
#include <poll.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#include "main.h"

static int do_regress1(void);
static int do_regress2(void);
static int do_regress3(void);
static int do_regress4(void);
static int do_regress5(void);
static int do_regress6(void);

static void make_chain(int);

int
do_regress(int n)
{
        switch (n) {
        case 1:
                return do_regress1();
        case 2:
                return do_regress2();
        case 3:
                return do_regress3();
        case 4:
                return do_regress4();
        case 5:
                return do_regress5();
        case 6:
                return do_regress6();
        default:
                errx(1, "unknown regress test number %d", n);
        }
}

/*
 * Regression test for NULL-deref in knote_processexit().
 */
static int
do_regress1(void)
{
        struct kevent kev[2];
        int kq;

        ASS((kq = kqueue()) >= 0,
            warn("kqueue"));

        EV_SET(&kev[0], kq, EVFILT_READ, EV_ADD, 0, 0, NULL);
        EV_SET(&kev[1], SIGINT, EVFILT_SIGNAL, EV_ADD, 0, 0, NULL);
        ASS(kevent(kq, kev, 2, NULL, 0, NULL) == 0,
            warn("can't register events on kqueue"));

        /* kq intentionally left open */

        return 0;
}

/*
 * Regression test for use-after-free in kqueue_close().
 */
static int
do_regress2(void)
{
        pid_t pid;
        int i, status;

        /* Run twice in order to trigger the panic faster, if still present. */
        for (i = 0; i < 2; i++) {
                pid = fork();
                if (pid == -1)
                        err(1, "fork");

                if (pid == 0) {
                        struct kevent kev[1];
                        int p0[2], p1[2];
                        int kq;

                        if (pipe(p0) == -1)
                                err(1, "pipe");
                        if (pipe(p1) == -1)
                                err(1, "pipe");

                        kq = kqueue();
                        if (kq == -1)
                                err(1, "kqueue");

                        EV_SET(&kev[0], p0[0], EVFILT_READ, EV_ADD, 0, 0, NULL);
                        if (kevent(kq, kev, 1, NULL, 0, NULL) == -1)
                                err(1, "kevent");

                        EV_SET(&kev[0], p1[1], EVFILT_READ, EV_ADD, 0, 0, NULL);
                        if (kevent(kq, kev, 1, NULL, 0, NULL) == -1)
                                err(1, "kevent");

                        EV_SET(&kev[0], p1[0], EVFILT_READ, EV_ADD, 0, 0, NULL);
                        if (kevent(kq, kev, 1, NULL, 0, NULL) == -1)
                                err(1, "kevent");

                        _exit(0);
                }

                if (waitpid(pid, &status, 0) == -1)
                        err(1, "waitpid");
                assert(WIFEXITED(status));
                assert(WEXITSTATUS(status) == 0);
        }

        return 0;
}

/*
 * Regression test for kernel stack exhaustion.
 */
static int
do_regress3(void)
{
        pid_t pid;
        int dir, status;

        for (dir = 0; dir < 2; dir++) {
                pid = fork();
                if (pid == -1)
                        err(1, "fork");

                if (pid == 0) {
                        make_chain(dir);
                        _exit(0);
                }

                if (waitpid(pid, &status, 0) == -1)
                        err(1, "waitpid");
                assert(WIFEXITED(status));
                assert(WEXITSTATUS(status) == 0);
        }

        return 0;
}

static void
make_chain(int dir)
{
        struct kevent kev[1];
        int i, kq, prev;

        /*
         * Build a chain of kqueues and leave the files open.
         * If the chain is long enough and properly oriented, a broken kernel
         * can exhaust the stack when this process exits.
         */
        for (i = 0, prev = -1; i < 120; i++, prev = kq) {
                kq = kqueue();
                if (kq == -1)
                        err(1, "kqueue");
                if (prev == -1)
                        continue;

                if (dir == 0) {
                        EV_SET(&kev[0], prev, EVFILT_READ, EV_ADD, 0, 0, NULL);
                        if (kevent(kq, kev, 1, NULL, 0, NULL) == -1)
                                err(1, "kevent");
                } else {
                        EV_SET(&kev[0], kq, EVFILT_READ, EV_ADD, 0, 0, NULL);
                        if (kevent(prev, kev, 1, NULL, 0, NULL) == -1)
                                err(1, "kevent");
                }
        }
}

/*
 * Regression test for kernel stack exhaustion.
 */
static int
do_regress4(void)
{
        static const int nkqueues = 500;
        struct kevent kev[1];
        struct rlimit rlim;
        struct timespec ts;
        int fds[2], i, kq = -1, prev;

        if (getrlimit(RLIMIT_NOFILE, &rlim) == -1)
                err(1, "getrlimit");
        if (rlim.rlim_cur < nkqueues + 8) {
                rlim.rlim_cur = nkqueues + 8;
                if (setrlimit(RLIMIT_NOFILE, &rlim) == -1) {
                        printf("RLIMIT_NOFILE is too low and can't raise it\n");
                        printf("SKIPPED\n");
                        exit(0);
                }
        }

        if (pipe(fds) == -1)
                err(1, "pipe");

        /* Build a chain of kqueus. The first kqueue refers to the pipe. */
        for (i = 0, prev = fds[0]; i < nkqueues; i++, prev = kq) {
                kq = kqueue();
                if (kq == -1)
                        err(1, "kqueue");

                EV_SET(&kev[0], prev, EVFILT_READ, EV_ADD, 0, 0, NULL);
                if (kevent(kq, kev, 1, NULL, 0, NULL) == -1)
                        err(1, "kevent");
        }

        /*
         * Trigger a cascading event through the chain.
         * If the chain is long enough, a broken kernel can run out
         * of kernel stack space.
         */
        write(fds[1], "x", 1);

        /*
         * Check that the event gets propagated.
         * The propagation is not instantaneous, so allow a brief pause.
         */
        ts.tv_sec = 5;
        ts.tv_nsec = 0;
        assert(kevent(kq, NULL, 0, kev, 1, NULL) == 1);

        return 0;
}

/*
 * Regression test for select and poll with kqueue.
 */
static int
do_regress5(void)
{
        fd_set fdset;
        struct kevent kev[1];
        struct pollfd pfd[1];
        struct timeval tv;
        int fds[2], kq, ret;

        if (pipe(fds) == -1)
                err(1, "pipe");

        kq = kqueue();
        if (kq == -1)
                err(1, "kqueue");
        EV_SET(&kev[0], fds[0], EVFILT_READ, EV_ADD, 0, 0, NULL);
        if (kevent(kq, kev, 1, NULL, 0, NULL) == -1)
                err(1, "kevent");

        /* Check that no event is reported. */

        FD_ZERO(&fdset);
        FD_SET(kq, &fdset);
        tv.tv_sec = 0;
        tv.tv_usec = 0;
        ret = select(kq + 1, &fdset, NULL, NULL, &tv);
        if (ret == -1)
                err(1, "select");
        assert(ret == 0);

        pfd[0].fd = kq;
        pfd[0].events = POLLIN;
        pfd[0].revents = 0;
        ret = poll(pfd, 1, 0);
        if (ret == -1)
                err(1, "poll");
        assert(ret == 0);

        /* Trigger an event. */
        write(fds[1], "x", 1);

        /* Check that the event gets reported. */

        FD_ZERO(&fdset);
        FD_SET(kq, &fdset);
        tv.tv_sec = 5;
        tv.tv_usec = 0;
        ret = select(kq + 1, &fdset, NULL, NULL, &tv);
        if (ret == -1)
                err(1, "select");
        assert(ret == 1);
        assert(FD_ISSET(kq, &fdset));

        pfd[0].fd = kq;
        pfd[0].events = POLLIN;
        pfd[0].revents = 0;
        ret = poll(pfd, 1, 5000);
        if (ret == -1)
                err(1, "poll");
        assert(ret == 1);
        assert(pfd[0].revents & POLLIN);

        return 0;
}

int
test_regress6(int kq, size_t len)
{
        const struct timespec nap_time = { 0, 1 };
        int i, kstatus, wstatus;
        struct kevent event;
        pid_t child, pid;
        void *addr;

        child = fork();
        switch (child) {
        case -1:
                warn("fork");
                return -1;
        case 0:
                /* fork a bunch of zombies to keep the reaper busy, then exit */
                signal(SIGCHLD, SIG_IGN);
                for (i = 0; i < 1000; i++) {
                        if (fork() == 0) {
                                /* Dirty some memory so uvm_exit has work. */
                                addr = mmap(NULL, len, PROT_READ|PROT_WRITE,
                                    MAP_ANON, -1, 0);
                                if (addr == MAP_FAILED)
                                        err(1, "mmap");
                                memset(addr, 'A', len);
                                nanosleep(&nap_time, NULL);
                                _exit(2);
                        }
                }
                nanosleep(&nap_time, NULL);
                _exit(1);
        default:
                /* parent */
                break;
        }

        /* Register NOTE_EXIT and wait for child. */
        EV_SET(&event, child, EVFILT_PROC, EV_ADD|EV_ONESHOT, NOTE_EXIT, 0,
            NULL);
        if (kevent(kq, &event, 1, &event, 1, NULL) != 1)
                err(1, "kevent");
        if (event.flags & EV_ERROR)
                errx(1, "kevent: %s", strerror(event.data));
        if (event.ident != child)
                errx(1, "expected child %d, got %lu", child, event.ident);
        kstatus = event.data;
        if (!WIFEXITED(kstatus))
                errx(1, "child did not exit?");

        pid = waitpid(child, &wstatus, WNOHANG);
        switch (pid) {
        case -1:
                err(1, "waitpid %d", child);
        case 0:
                printf("kevent: child %d exited %d\n", child,
                    WEXITSTATUS(kstatus));
                printf("waitpid: child %d not ready\n", child);
                break;
        default:
                if (wstatus != kstatus) {
                        /* macOS has a bug where kstatus is 0 */
                        warnx("kevent status 0x%x != waitpid status 0x%x",
                            kstatus, wstatus);
                }
                break;
        }

        return pid;
}

/*
 * Regression test for NOTE_EXIT waitability.
 */
static int
do_regress6(void)
{
        int i, kq, page_size, rc;
        struct rlimit rlim;

        /* Bump process limits since we fork a lot. */
        if (getrlimit(RLIMIT_NPROC, &rlim) == -1)
                err(1, "getrlimit(RLIMIT_NPROC)");
        rlim.rlim_cur = rlim.rlim_max;
        if (setrlimit(RLIMIT_NPROC, &rlim) == -1)
                err(1, "setrlimit(RLIMIT_NPROC)");

        kq = kqueue();
        if (kq == -1)
                err(1, "kqueue");

        page_size = getpagesize();

        /* This test is inherently racey but fails within a few iterations. */
        for (i = 0; i < 25; i++) {
                rc = test_regress6(kq, page_size);
                switch (rc) {
                case -1:
                        goto done;
                case 0:
                        printf("child not ready when NOTE_EXIT received");
                        if (i != 0)
                                printf(" (%d iterations)", i + 1);
                        putchar('\n');
                        goto done;
                default:
                        /* keep trying */
                        continue;
                }
        }
        printf("child exited as expected when NOTE_EXIT received\n");

done:
        close(kq);
        return rc <= 0;
}