From af229f46a1496f39b012b4e2b244c32bb7d0667c Mon Sep 17 00:00:00 2001
From: Rahat Mahmood <rahat@google.com>
Date: Thu, 20 May 2021 15:07:17 -0700
Subject: Fix cgroupfs mount racing with unmount.

Previously, mount could discover a hierarchy being destroyed
concurrently, which resulted in mount attempting to take a ref on an
already destroyed cgroupfs.

Reported-by: syzbot+062c0a67798a200f23ee@syzkaller.appspotmail.com
PiperOrigin-RevId: 374959054
---
 test/syscalls/linux/cgroup.cc | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

(limited to 'test')

diff --git a/test/syscalls/linux/cgroup.cc b/test/syscalls/linux/cgroup.cc
index a009ade7e..f29891571 100644
--- a/test/syscalls/linux/cgroup.cc
+++ b/test/syscalls/linux/cgroup.cc
@@ -227,6 +227,41 @@ TEST(Cgroup, MountRace) {
   EXPECT_NO_ERRNO(c.ContainsCallingProcess());
 }
 
+TEST(Cgroup, MountUnmountRace) {
+  SKIP_IF(!CgroupsAvailable());
+
+  TempPath mountpoint = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateDir());
+
+  const DisableSave ds;  // Too many syscalls.
+
+  auto mount_thread = [&mountpoint]() {
+    for (int i = 0; i < 100; ++i) {
+      mount("none", mountpoint.path().c_str(), "cgroup", 0, 0);
+    }
+  };
+  auto unmount_thread = [&mountpoint]() {
+    for (int i = 0; i < 100; ++i) {
+      umount(mountpoint.path().c_str());
+    }
+  };
+  std::list<ScopedThread> threads;
+  for (int i = 0; i < 10; ++i) {
+    threads.emplace_back(mount_thread);
+  }
+  for (int i = 0; i < 10; ++i) {
+    threads.emplace_back(unmount_thread);
+  }
+  for (auto& t : threads) {
+    t.Join();
+  }
+
+  // We don't know how many mount refs are remaining, since the count depends on
+  // the ordering of mount and umount calls. Keep calling unmount until it
+  // returns an error.
+  while (umount(mountpoint.path().c_str()) == 0) {
+  }
+}
+
 TEST(Cgroup, UnmountRepeated) {
   SKIP_IF(!CgroupsAvailable());
 
-- 
cgit v1.2.3