1*4882a593SmuzhiyunTesting for regressions in Media Controller API register, ioctl, syscall, 2*4882a593Smuzhiyunand unregister paths. There have a few problems that result in user-after 3*4882a593Smuzhiyunfree on media_device, media_devnode, and cdev pointers when the driver is 4*4882a593Smuzhiyununbound while ioctl is in progress. 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunTest Procedure: 7*4882a593Smuzhiyun 8*4882a593SmuzhiyunRun bin/unbind loop while ioctls are in progress. 9*4882a593SmuzhiyunRun rmmod and modprobe. 10*4882a593SmuzhiyunDisconnect the device. 11*4882a593Smuzhiyun 12*4882a593SmuzhiyunSetup: 13*4882a593Smuzhiyun 14*4882a593SmuzhiyunBuild media_device_test 15*4882a593Smuzhiyuncd tools/testing/selftests/media_tests 16*4882a593Smuzhiyunmake 17*4882a593Smuzhiyun 18*4882a593SmuzhiyunRegressions test for cdev user-after free error on /dev/mediaX when driver 19*4882a593Smuzhiyunis unbound: 20*4882a593Smuzhiyun 21*4882a593SmuzhiyunStart media_device_test to regression test media devnode dynamic alloc 22*4882a593Smuzhiyunand cdev user-after-free fixes. This opens media dev files and sits in 23*4882a593Smuzhiyuna loop running media ioctl MEDIA_IOC_DEVICE_INFO command once every 10 24*4882a593Smuzhiyunseconds. The idea is when device file goes away, media devnode and cdev 25*4882a593Smuzhiyunshould stick around until this test exits. 26*4882a593Smuzhiyun 27*4882a593SmuzhiyunThe test for a random number of iterations or until user kills it with a 28*4882a593Smuzhiyunsleep 10 in between the ioctl calls. 29*4882a593Smuzhiyun 30*4882a593Smuzhiyunsudo ./media_device_test -d /dev/mediaX 31*4882a593Smuzhiyun 32*4882a593SmuzhiyunRegression test for media_devnode unregister race with ioctl_syscall: 33*4882a593Smuzhiyun 34*4882a593SmuzhiyunStart 6 open_loop_test.sh tests with different /dev/mediaX files. When 35*4882a593Smuzhiyundevice file goes away after unbind, device file name changes. Start the 36*4882a593Smuzhiyuntest with possible device names. If we start with /dev/media0 for example, 37*4882a593Smuzhiyunafter unbind, /dev/media1 or /dev/media2 could get created. The idea is 38*4882a593Smuzhiyunkeep ioctls going while bind/unbind runs. 39*4882a593Smuzhiyun 40*4882a593SmuzhiyunCopy bind_unbind_sample.txt and make changes to specify the driver name 41*4882a593Smuzhiyunand number to run bind and unbind. Start the bind_unbind.sh 42*4882a593Smuzhiyun 43*4882a593SmuzhiyunRun dmesg looking for any user-after free errors or mutex lock errors. 44