42  * The issue became CVE-2021-29626.
45  * standalone program with -DSTANDALONE (and optionally -DDEBUG).
71 #include <atf-c.h>
80 #define	DEPTH	5  macro
96 	volatile bool exiting[DEPTH];
106  *     P0 -> P1 -> P2 => P3
115 	ss->exit = true;						\
120 	ss->exit = true;						\
126 static void child(struct shared_state *ss, int depth);
129 child_fork(struct shared_state *ss, int depth)  in child_fork()  argument
132 	if (pid == -1)  in child_fork()
135 		child(ss, depth);  in child_fork()
144 	for (i = 0; i < ss->len; i += ss->pagesize)  in child_fault()
145 		(void)((volatile char *)ss->p)[i];  in child_fault()
153 	for (i = 0; i < len; i += ss->pagesize)  in child_write()
154 		((int *)ss->p)[i / sizeof(int)] = val;  in child_write()
161 	while (!ss->p3_did_write) {  in child_wait_p3_write()
162 		if (ss->exit)  in child_wait_p3_write()
170 child_verify(struct shared_state *ss, int depth, int newval, int oldval)  in child_verify()  argument
175 	for (i = 0; i < ss->len; i += ss->pagesize) {  in child_verify()
176 		expectval = i < ss->modlen ? newval : oldval;  in child_verify()
177 		foundval = ((int *)ss->p)[i / sizeof(int)];  in child_verify()
181 		    depth, foundval, expectval, oldval);  in child_verify()
186 child(struct shared_state *ss, int depth)  in child()  argument
190 	if (depth < 1 || depth >= DEPTH)  in child()
191 		child_errx("Bad depth %d", depth);  in child()
193 	dprintf("P%d (pid %d) started\n", depth, mypid);  in child()
194 	switch (depth) {  in child()
197 		ss->p = mmap(NULL, ss->len, PROT_READ | PROT_WRITE,  in child()
198 		    MAP_SHARED | MAP_ANON, -1, 0);  in child()
199 		if (ss->p == MAP_FAILED)  in child()
203 		child_write(ss, mypid, ss->len);  in child()
204 		if (!ss->lazy_cow) {  in child()
205 			if (mlock(ss->p, ss->len) == -1)  in child()
207 			if (mprotect(ss->p, ss->len, PROT_READ) == -1)  in child()
210 		if (ss->block_xfer) {  in child()
223 		if (minherit(ss->p, ss->len, INHERIT_COPY) != 0)  in child()
226 		child_fork(ss, depth + 1);  in child()
229 		child_verify(ss, depth, mypid, mypid);  in child()
230 		if (!ss->collapse) {  in child()
232 			while (!ss->exit)  in child()
235 		/* Exit so the P2 -> P1/P4 shadow chain can collapse. */  in child()
242 		if (minherit(ss->p, ss->len, INHERIT_SHARE) != 0)  in child()
248 		 * (read-only) mappings were copied by fork(), but it doesn't  in child()
252 		oldval = atomic_load_acq_int(ss->p);  in child()
255 		pid = child_fork(ss, depth + 1);  in child()
256 		if (ss->collapse) {  in child()
258 			while (!ss->exiting[1] ||  in child()
259 			    (ss->block_xfer && !ss->exiting[4]))  in child()
269 		child_verify(ss, depth, pid, oldval);  in child()
270 		ss->okay = true;  in child()
271 		ss->exit = true;  in child()
279 		if (!ss->lazy_cow) {  in child()
280 			if (mlock(ss->p, ss->len) == -1)  in child()
282 			if (mprotect(ss->p, ss->len, PROT_READ | PROT_WRITE) ==  in child()
283 			    -1)  in child()
293 		child_write(ss, mypid, ss->modlen);  in child()
294 		ss->p3_did_write = true;  in child()
299 		oldval = atomic_load_acq_int(ss->p);  in child()
301 		child_verify(ss, depth, oldval, oldval);  in child()
304 		child_errx("Bad depth %d", depth);  in child()
307 	dprintf("P%d (pid %d) exiting\n", depth, mypid);  in child()
308 	ss->exiting[depth] = true;  in child()
329 	    MAP_SHARED | MAP_ANON, -1, 0);  in do_one_shared_shadow_inval()
332 	ss->len = len;  in do_one_shared_shadow_inval()
333 	ss->modlen = (flags & FLAG_FULLMOD) ? ss->len : ss->len / 2;  in do_one_shared_shadow_inval()
334 	ss->pagesize = pagesize;  in do_one_shared_shadow_inval()
335 	ss->collapse = (flags & FLAG_COLLAPSE) != 0;  in do_one_shared_shadow_inval()
336 	ss->block_xfer = (flags & FLAG_BLOCK_XFER) != 0;  in do_one_shared_shadow_inval()
337 	ss->lazy_cow = lazy_cow;  in do_one_shared_shadow_inval()
340 	ATF_REQUIRE(pid != -1);  in do_one_shared_shadow_inval()
348 	} while (pid != -1 || errno != ECHILD);  in do_one_shared_shadow_inval()
351 	ATF_REQUIRE(ss->okay);  in do_one_shared_shadow_inval()
378 		    largepagesize - pagesize, i);  in do_shared_shadow_inval()