selftests/pidfd: third test for multi-threaded exec polling

Ensure that during a multi-threaded exec and premature thread-group
leader exit no exit notification is generated.

Link: https://lore.kernel.org/r/20250320-work-pidfs-thread_group-v4-4-da678ce805bf@kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>

diff --git a/tools/testing/selftests/pidfd/pidfd_info_test.c b/tools/testing/selftests/pidfd/pidfd_info_test.c
index 4169780c9e55bbf563291c4575c35e329ff3c927..1758a1b0457be36294ef38570fb2821b3cd371c0 100644 (file)
--- a/tools/testing/selftests/pidfd/pidfd_info_test.c
+++ b/tools/testing/selftests/pidfd/pidfd_info_test.c
@@ -542,4 +542,151 @@ TEST_F(pidfd_info, thread_group_exec)
        EXPECT_EQ(close(pidfd_thread), 0);
 }
 
+static void *pidfd_info_thread_exec_sane(void *arg)
+{
+       pid_t pid_thread = gettid();
+       int ipc_socket = *(int *)arg;
+
+       /* Inform the grand-parent what the tid of this thread is. */
+       if (write_nointr(ipc_socket, &pid_thread, sizeof(pid_thread)) != sizeof(pid_thread))
+               return NULL;
+
+       if (read_nointr(ipc_socket, &pid_thread, sizeof(pid_thread)) != sizeof(pid_thread))
+               return NULL;
+
+       close(ipc_socket);
+
+       sys_execveat(AT_FDCWD, "pidfd_exec_helper", NULL, NULL, 0);
+       return NULL;
+}
+
+TEST_F(pidfd_info, thread_group_exec_thread)
+{
+       pid_t pid_leader, pid_poller, pid_thread;
+       pthread_t thread;
+       int nevents, pidfd_leader, pidfd_leader_thread, pidfd_thread, ret;
+       int ipc_sockets[2];
+       struct pollfd fds = {};
+       struct pidfd_info info = {
+               .mask = PIDFD_INFO_CGROUPID | PIDFD_INFO_EXIT,
+       };
+
+       ret = socketpair(AF_LOCAL, SOCK_STREAM | SOCK_CLOEXEC, 0, ipc_sockets);
+       EXPECT_EQ(ret, 0);
+
+       pid_leader = create_child(&pidfd_leader, 0);
+       EXPECT_GE(pid_leader, 0);
+
+       if (pid_leader == 0) {
+               close(ipc_sockets[0]);
+
+               /* The thread will outlive the thread-group leader. */
+               if (pthread_create(&thread, NULL, pidfd_info_thread_exec_sane, &ipc_sockets[1]))
+                       syscall(__NR_exit, EXIT_FAILURE);
+
+               /*
+                * Pause the thread-group leader. It will be killed once
+                * the subthread execs.
+                */
+               pause();
+               syscall(__NR_exit, EXIT_SUCCESS);
+       }
+
+       /* Retrieve the tid of the thread. */
+       EXPECT_EQ(close(ipc_sockets[1]), 0);
+       ASSERT_EQ(read_nointr(ipc_sockets[0], &pid_thread, sizeof(pid_thread)), sizeof(pid_thread));
+
+       /* Opening a thread as a PIDFD_THREAD must succeed. */
+       pidfd_thread = sys_pidfd_open(pid_thread, PIDFD_THREAD);
+       ASSERT_GE(pidfd_thread, 0);
+
+       /* Open a thread-specific pidfd for the thread-group leader. */
+       pidfd_leader_thread = sys_pidfd_open(pid_leader, PIDFD_THREAD);
+       ASSERT_GE(pidfd_leader_thread, 0);
+
+       pid_poller = fork();
+       ASSERT_GE(pid_poller, 0);
+       if (pid_poller == 0) {
+               /*
+                * The subthread will now exec. The struct pid of the old
+                * thread-group leader will be assumed by the subthread which
+                * becomes the new thread-group leader. So no exit notification
+                * must be generated. Wait for 5 seconds and call it a success
+                * if no notification has been received.
+                */
+               fds.events = POLLIN;
+               fds.fd = pidfd_leader_thread;
+               nevents = poll(&fds, 1, 10000 /* wait 5 seconds */);
+               if (nevents != 0)
+                       _exit(EXIT_FAILURE);
+               if (fds.revents & POLLIN)
+                       _exit(EXIT_FAILURE);
+               if (fds.revents & POLLHUP)
+                       _exit(EXIT_FAILURE);
+               _exit(EXIT_SUCCESS);
+       }
+
+       /* Now that we've opened a thread-specific pidfd the thread can exec. */
+       ASSERT_EQ(write_nointr(ipc_sockets[0], &pid_thread, sizeof(pid_thread)), sizeof(pid_thread));
+       EXPECT_EQ(close(ipc_sockets[0]), 0);
+       ASSERT_EQ(wait_for_pid(pid_poller), 0);
+
+       /* Wait until the kernel has SIGKILLed the thread. */
+       fds.events = POLLHUP;
+       fds.fd = pidfd_thread;
+       nevents = poll(&fds, 1, -1);
+       ASSERT_EQ(nevents, 1);
+       /* The thread has been reaped. */
+       ASSERT_TRUE(!!(fds.revents & POLLHUP));
+
+       /* Retrieve thread-specific exit info from pidfd. */
+       ASSERT_EQ(ioctl(pidfd_thread, PIDFD_GET_INFO, &info), 0);
+       ASSERT_FALSE(!!(info.mask & PIDFD_INFO_CREDS));
+       ASSERT_TRUE(!!(info.mask & PIDFD_INFO_EXIT));
+       /*
+        * While the kernel will have SIGKILLed the whole thread-group
+        * during exec it will cause the individual threads to exit
+        * cleanly.
+        */
+       ASSERT_TRUE(WIFEXITED(info.exit_code));
+       ASSERT_EQ(WEXITSTATUS(info.exit_code), 0);
+
+       /*
+        * The thread-group leader is still alive, the thread has taken
+        * over its struct pid and thus its pid number.
+        */
+       info.mask = PIDFD_INFO_CGROUPID | PIDFD_INFO_EXIT;
+       ASSERT_EQ(ioctl(pidfd_leader, PIDFD_GET_INFO, &info), 0);
+       ASSERT_TRUE(!!(info.mask & PIDFD_INFO_CREDS));
+       ASSERT_FALSE(!!(info.mask & PIDFD_INFO_EXIT));
+       ASSERT_EQ(info.pid, pid_leader);
+
+       /* Take down the thread-group leader. */
+       EXPECT_EQ(sys_pidfd_send_signal(pidfd_leader, SIGKILL, NULL, 0), 0);
+
+       /*
+        * Afte the exec we're dealing with an empty thread-group so now
+        * we must see an exit notification on the thread-specific pidfd
+        * for the thread-group leader as there's no subthread that can
+        * revive the struct pid.
+        */
+       fds.events = POLLIN;
+       fds.fd = pidfd_leader_thread;
+       nevents = poll(&fds, 1, -1);
+       ASSERT_EQ(nevents, 1);
+       ASSERT_TRUE(!!(fds.revents & POLLIN));
+       ASSERT_FALSE(!!(fds.revents & POLLHUP));
+
+       EXPECT_EQ(sys_waitid(P_PIDFD, pidfd_leader, NULL, WEXITED), 0);
+
+       /* Retrieve exit information for the thread-group leader. */
+       info.mask = PIDFD_INFO_CGROUPID | PIDFD_INFO_EXIT;
+       ASSERT_EQ(ioctl(pidfd_leader, PIDFD_GET_INFO, &info), 0);
+       ASSERT_FALSE(!!(info.mask & PIDFD_INFO_CREDS));
+       ASSERT_TRUE(!!(info.mask & PIDFD_INFO_EXIT));
+
+       EXPECT_EQ(close(pidfd_leader), 0);
+       EXPECT_EQ(close(pidfd_thread), 0);
+}
+
 TEST_HARNESS_MAIN