4 files changed, 721 insertions, 0 deletions
diff --git a/tools/test/stress2/misc/kevent17.sh b/tools/test/stress2/misc/kevent17.sh
new file mode 100755
index 000000000000..e7b8f1a0a00c
--- /dev/null
+++ b/tools/test/stress2/misc/kevent17.sh
@@ -0,0 +1,176 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+# A kqueuex(KQUEUE_CPONFORK) test scenario
+# Test scenario suggestion by: kib
+
+. ../default.cfg
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+dir=/tmp
+odir=`pwd`
+prog=$(basename "$0" .sh)
+cd $dir
+sed '1,/^EOF/d' < $odir/$0 > $dir/$prog.c
+mycc -o $prog -Wall -Wextra -O0 -g $prog.c || exit 1
+rm -f $prog.c
+cd $odir
+
+set -e
+mount | grep "on $mntpoint " | grep -q /dev/md && umount -f $mntpoint
+[ -c /dev/md$mdstart ] &&  mdconfig -d -u $mdstart
+mdconfig -a -t swap -s 2g -u $mdstart
+newfs $newfs_flags md$mdstart > /dev/null
+mount /dev/md$mdstart $mntpoint
+set +e
+
+(cd $odir/../testcases/swap; ./swap -t 5m -i 20 -h -l 100 > /dev/null) &
+cd $mntpoint
+$dir/$prog
+s=$?
+[ -f $prog.core -a $s -eq 0 ] &&
+    { ls -l $prog.core; mv $prog.core /tmp; s=1; }
+cd $odir
+while pkill -9 swap; do :; done
+wait
+
+for i in `jot 6`; do
+	mount | grep -q "on $mntpoint " || break
+	umount $mntpoint && break || sleep 10
+done
+[ $i -eq 6 ] && exit 1
+mdconfig -d -u $mdstart
+rm -rf $dir/$prog
+exit $s
+
+EOF
+#include <sys/param.h>
+#include <sys/event.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+#include <machine/atomic.h>
+
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+static volatile u_int *share;
+static int  loops;
+static char *file = "file";
+
+#define MAXLOOPS 100
+#define PARALLEL 1
+#define RUNTIME (2 * 60)
+#define SYNC 0
+
+static void
+test(void)
+{
+	pid_t pid;
+        struct kevent ev[2];
+        struct timespec ts;
+        int kq, fd, n;
+
+	if ((fd = open(file, O_RDONLY, 0)) == -1)
+		err(1, "open(%s). %s:%d", file, __func__, __LINE__);
+
+	atomic_add_int(&share[SYNC], 1);
+	while (share[SYNC] != PARALLEL)
+		usleep(10000);
+
+	if ((kq = kqueuex(KQUEUE_CPONFORK)) < 0)
+		err(1, "kqueuex");
+
+	ts.tv_sec  = 5;
+	ts.tv_nsec = 0;
+	n = 0;
+	EV_SET(&ev[n], fd, EVFILT_VNODE, EV_ADD | EV_ENABLE | EV_CLEAR,
+		NOTE_DELETE, 0, 0);
+	n++;
+
+	if (kevent(kq, ev, n, NULL, 0, NULL) < 0)
+		err(1, "kevent()");
+	if (loops >= MAXLOOPS) {	/* start using fork(2) */
+		if ((pid = fork()) == 0) {
+			n = kevent(kq, NULL, 0, ev, 1, &ts);
+			if (n == -1)
+				err(1, "kevent() in fork\n");
+			close(fd);
+			close(kq);
+			_exit(0);
+		}
+		if (waitpid(pid, NULL, 0) != pid)
+			err(1, "waitpid(%d)\n", pid);
+	}
+
+	n = kevent(kq, NULL, 0, ev, 1, &ts);
+	if (n == -1)
+		err(1, "kevent()");
+	close(fd);
+	close(kq);
+
+	_exit(0);
+}
+
+int
+main(void)
+{
+	pid_t pids[PARALLEL];
+	size_t len;
+	time_t start;
+	int e, fd, i, status;
+
+	e = 0;
+	len = PAGE_SIZE;
+	loops = 0;
+	if ((share = mmap(NULL, len, PROT_READ | PROT_WRITE,
+	    MAP_ANON | MAP_SHARED, -1, 0)) == MAP_FAILED)
+		err(1, "mmap");
+
+	start = time(NULL);
+	while ((time(NULL) - start) < RUNTIME && e == 0) {
+		loops++;
+		if ((fd = open(file, O_CREAT | O_TRUNC | O_RDWR, 0660)) ==
+		    -1)
+			err(1, "open(%s)", file);
+		close(fd);
+		share[SYNC] = 0;
+		for (i = 0; i < PARALLEL; i++) {
+
+			if ((pids[i] = fork()) == 0)
+				test();
+			if (pids[i] == -1)
+				err(1, "fork()");
+		}
+		while (share[SYNC] != PARALLEL)
+			usleep(10000);
+		if (unlink(file) == -1)
+			err(1, "unlink(%s). %s:%d\n", file,
+				    __FILE__, __LINE__);
+		for (i = 0; i < PARALLEL; i++) {
+			if (waitpid(pids[i], &status, 0) == -1)
+				err(1, "waitpid(%d)", pids[i]);
+			if (status != 0) {
+				if (WIFSIGNALED(status))
+					fprintf(stderr,
+					    "pid %d exit signal %d\n",
+					    pids[i], WTERMSIG(status));
+			}
+			e += status == 0 ? 0 : 1;
+		}
+	}
+
+	return (e);
+}
diff --git a/tools/test/stress2/misc/kevent18.sh b/tools/test/stress2/misc/kevent18.sh
new file mode 100755
index 000000000000..1492c49e2921
--- /dev/null
+++ b/tools/test/stress2/misc/kevent18.sh
@@ -0,0 +1,152 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+# A kqueuex(KQUEUE_CPONFORK) test scenario
+
+# Sleeping thread seen in WiP code:
+# https://people.freebsd.org/~pho/stress/log/log0615.txt
+
+. ../default.cfg
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+ulimit -k 5000 || { echo FAIL; exit 1; }
+
+odir=`pwd`
+prog=$(basename "$0" .sh)
+
+cd /tmp
+sed '1,/^EOF/d' < $odir/$0 > $prog.c
+mycc -o $prog -Wall -Wextra -O2 -g $prog.c -lpthread || exit 1
+rm -f $prog.c
+cd $odir
+
+mount | grep "on $mntpoint " | grep -q md$mdstart && umount -f $mntpoint
+mdconfig -l | grep -q $mdstart && mdconfig -d -u $mdstart
+
+mdconfig -a -t swap -s 2g -u $mdstart
+newfs $newfs_flags md$mdstart > /dev/null
+mount /dev/md$mdstart $mntpoint
+chmod 777 $mntpoint
+
+su $testuser -c "(cd $mntpoint; /tmp/$prog)" &
+for i in `jot 99`; do
+	sleep 1
+	kill -0 $! 2>/dev/null || break
+done
+pkill $prog
+wait
+umount -f $mntpoint
+
+while mount | grep -q $mntpoint; do
+	umount $mntpoint || sleep 1
+done
+mdconfig -d -u $mdstart
+rm -f /tmp/$prog
+
+exit 0
+EOF
+#include <sys/types.h>
+#include <sys/event.h>
+#include <sys/mman.h>
+#include <sys/wait.h>
+
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <sched.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define PARALLEL 64
+
+static int fd;
+static char path[80];
+
+static void *
+spin(void *arg __unused)
+{
+	int i;
+
+	for (i= 0;; i++) {
+		snprintf(path, sizeof(path), "file.%06d.%d", getpid(), i);
+		fd = open(path, O_CREAT | O_TRUNC | O_RDWR, 0622);
+		if (fd == -1 && errno == ENOTDIR)
+			break;
+		if (fd == -1)
+			err(1, "open(%s)", path);
+		close(fd);
+		fd = 0;
+		unlink(path);
+	}
+	fprintf(stderr, "spin loops: %d\n", i + 1);
+	return (NULL);
+}
+
+static void *
+test(void *arg __unused)
+{
+	struct kevent ev;
+	struct timespec ts;
+	pid_t pid;
+	int i, kq, n;
+
+	for (i = 0; i < 500000; i++) {
+		if ((kq = kqueuex(KQUEUE_CPONFORK)) < 0)
+			err(1, "kqueueex(KQUEUE_CPONFORK)");
+
+		n = 0;
+		memset(&ev, 0, sizeof(ev));
+		EV_SET(&ev, fd, EVFILT_VNODE, EV_ADD | EV_ENABLE | EV_CLEAR,
+			NOTE_DELETE|NOTE_RENAME|NOTE_EXTEND, 0, 0);
+		n++;
+
+		if ((pid = fork()) == 0) {
+			kevent(kq, &ev, n, NULL, 0, NULL);
+			_exit(0);
+		}
+		if (waitpid(pid, NULL, 0) != pid)
+			err(1, "waitpid(%d)", pid);
+
+		kevent(kq, &ev, n, NULL, 0, NULL);
+		memset(&ev, 0, sizeof(ev));
+		ts.tv_sec  = 0;
+		ts.tv_nsec = 1000000;
+		if ((n = kevent(kq, NULL, 0, &ev, 1, &ts)) == -1)
+			err(1, "kevent()");
+
+		close(kq);
+	}
+	return (NULL);
+}
+
+int
+main(void)
+{
+	pthread_t cp[PARALLEL], sp;
+	int e, i;
+
+	if ((e = pthread_create(&sp, NULL, spin, NULL)) != 0)
+		errc(1, e, "pthread_create");
+
+	for (i = 0; i < PARALLEL; i++) {
+		if ((e = pthread_create(&cp[i], NULL, test, NULL)) != 0)
+			errc(1, e, "pthread_create");
+	}
+
+	for (i = 0; i < PARALLEL; i++)
+		pthread_join(cp[i], NULL);
+	pthread_join(sp, NULL);
+
+	close(fd);
+
+	return (0);
+}
diff --git a/tools/test/stress2/misc/kevent19.sh b/tools/test/stress2/misc/kevent19.sh
new file mode 100755
index 000000000000..0170fe0d93c8
--- /dev/null
+++ b/tools/test/stress2/misc/kevent19.sh
@@ -0,0 +1,187 @@
+#!/bin/sh
+
+# A kqueuex(KQUEUE_CPONFORK) test scenario
+
+set -u
+prog=$(basename "$0" .sh)
+
+cat > /tmp/$prog.c <<EOF
+/* \$Id: kqfork.c,v 1.4 2025/08/19 19:42:16 kostik Exp kostik $ */
+
+#include <sys/param.h>
+#include <sys/event.h>
+#include <err.h>
+#include <signal.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#ifndef KQUEUE_CPONFORK
+#define	KQUEUE_CPONFORK	0x2
+#endif
+
+static pid_t pid_pipe_beat;
+static pid_t pid_controller;
+
+static void
+sighup_handler(int sig __unused)
+{
+	kill(pid_pipe_beat, SIGKILL);
+	_exit(1);
+}
+
+static void
+pipe_beat(int wp)
+{
+	static const char a[1] = { 'a' };
+	ssize_t s;
+
+	for (;;) {
+		sleep(1);
+		s = write(wp, a, 1);
+		if (s < 0)
+			err(1, "pipe write");
+		if (s == 0)
+			errx(1, "short pipe write");
+	}
+}
+
+static void
+worker(int kq, int rp)
+{
+	struct kevent ev[1];
+	char a[1];
+	ssize_t s;
+	int n;
+
+	for (;;) {
+		n = kevent(kq, NULL, 0, ev, nitems(ev), NULL);
+		if (n == -1) {
+			kill(pid_controller, SIGHUP);
+			err(1, "kqueue");
+		}
+		if (n == 0)
+			continue; // XXXKIB
+		switch (ev[0].filter) {
+		case EVFILT_TIMER:
+			printf("tick\n");
+			break;
+		case EVFILT_READ:
+			if (ev[0].ident != (uintptr_t)rp) {
+				kill(pid_controller, SIGHUP);
+				errx(1, "unknown read ident %d\n", (int)ev[0].ident);
+			}
+			s = read(rp, a, sizeof(a));
+			if (s == -1) {
+				kill(pid_controller, SIGHUP);
+				err(1, "read");
+			}
+			if (s == 0) {
+				kill(pid_controller, SIGHUP);
+				errx(1, "EOF");
+			}
+			printf("%c\n", a[0]);
+			break;
+		default:
+			kill(pid_controller, SIGHUP);
+			errx(1, "unknown fiter %d\n", ev[0].filter);
+			break;
+		}
+	}
+}
+
+static void
+usage(void)
+{
+	fprintf(stderr, "Usage: kqfork [fork]\n");
+	exit(2);
+}
+
+int
+main(int argc, char *argv[])
+{
+	struct kevent ev[2];
+	struct sigaction sa;
+	int kq, n, pp[2];
+	pid_t pid_worker;
+	bool do_fork;
+
+	do_fork = false;
+	if (argc != 1 && argc != 2)
+		usage();
+	if (argc == 2) {
+		if (strcmp(argv[1], "fork") != 0)
+			usage();
+		do_fork = true;
+	}
+
+	memset(&sa, 0, sizeof(sa));
+	sa.sa_handler = sighup_handler;
+	if (sigaction(SIGHUP, &sa, NULL) == -1)
+		err(1, "sigaction(SIGHUP)");
+
+	memset(&sa, 0, sizeof(sa));
+	sa.sa_flags = SA_NOCLDWAIT | SA_NOCLDSTOP;
+	sa.sa_handler = SIG_IGN;
+	if (sigaction(SIGCHLD, &sa, NULL) == -1)
+		err(1, "sigaction(SIGCHLD)");
+
+	if (pipe(pp) == -1)
+		err(1, "pipe");
+
+	pid_pipe_beat = fork();
+	if (pid_pipe_beat == -1)
+		err(1, "fork");
+	if (pid_pipe_beat == 0) {
+		close(pp[0]);
+		pipe_beat(pp[1]);
+	}
+
+	kq = kqueuex(do_fork ? KQUEUE_CPONFORK : 0);
+	if (kq == -1)
+		err(1, "kqueuex");
+
+	EV_SET(&ev[0], 1, EVFILT_TIMER, EV_ADD, NOTE_SECONDS, 1, NULL);
+	EV_SET(&ev[1], pp[0], EVFILT_READ, EV_ADD, 0, 0, NULL);
+	n = kevent(kq, ev, nitems(ev), NULL, 0, NULL);
+	if (n == -1) {
+		kill(pid_pipe_beat, SIGKILL);
+		err(1, "kevent reg");
+	}
+	if (n != 0) {
+		kill(pid_pipe_beat, SIGKILL);
+		errx(1, "kevent reg %d", n);
+	}
+
+	pid_controller = getpid();
+
+	if (do_fork) {
+		pid_worker = fork();
+		if (pid_worker == -1) {
+			kill(pid_pipe_beat, SIGKILL);
+			err(1, "fork");
+		}
+		if (pid_worker == 0) {
+			close(pp[1]);
+			worker(kq, pp[0]);
+		}
+
+		for (;;)
+			pause();
+	} else {
+		worker(kq, pp[0]);
+	}
+	exit(0); // unreachable
+}
+EOF
+cc -o /tmp/$prog -Wall -Wextra -O2 /tmp/$prog.c || exit 1
+
+echo "--> No fork"
+timeout 4s /tmp/$prog
+echo "--> fork"
+timeout 4s /tmp/$prog fork
+
+rm -f /tmp/$prog.c $prog
+exit 0
diff --git a/tools/test/stress2/misc/unionfs20.sh b/tools/test/stress2/misc/unionfs20.sh
new file mode 100755
index 000000000000..0c87bc0d80aa
--- /dev/null
+++ b/tools/test/stress2/misc/unionfs20.sh
@@ -0,0 +1,206 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+# Bug 289700 - unionfs: page fault in unionfs_find_node_status when closing a file within a socket's receive buffer
+
+# "Fatal trap 12: page fault while in kernel mode" seen:
+# https://people.freebsd.org/~pho/stress/log/log0618.txt
+
+. ../default.cfg
+
+prog=$(basename "$0" .sh)
+here=`pwd`
+log=/tmp/$prog.log
+md1=$mdstart
+md2=$((md1 + 1))
+mp1=/mnt$md1
+mp2=/mnt$md2
+
+set -eu
+mdconfig -l | grep -q md$md1 && mdconfig -d -u $md1
+mdconfig -l | grep -q md$md2 && mdconfig -d -u $md2
+
+mdconfig -s 2g -u $md1
+newfs $newfs_flags /dev/md$md1 > /dev/null
+mdconfig -s 2g -u $md2
+newfs $newfs_flags /dev/md$md2 > /dev/null
+
+mkdir -p $mp1 $mp2
+mount /dev/md$md1 $mp1
+mount /dev/md$md2 $mp2
+mount -t unionfs -o noatime $mp1 $mp2
+set +e
+
+cd /tmp
+sed '1,/^EOF/d' < $here/$0 > $prog.c
+mycc -o $prog -Wall -Wextra -O2 $prog.c
+rm -f $prog.c
+[ -d $RUNDIR ] || mkdir -p $RUNDIR
+cd $RUNDIR
+
+n=3
+for i in `jot $n`; do
+	mkdir $mp2/d$i
+done
+(cd $here/../testcases/swap; ./swap -t 3m -i 20 -l 100 -h > /dev/null) &
+sleep 2
+for i in `jot $n`; do
+	(cd $mp2/d$i; /tmp/$prog) &
+done
+while pgrep -q $prog; do sleep .5; done
+while pkill swap; do :; done
+wait
+
+cd $here
+umount $mp2 # The unionfs mount
+umount $mp2
+umount $mp1
+
+mdconfig -d -u $md1
+mdconfig -d -u $md2
+rm -f /tmp/$prog
+exit 0
+EOF
+#include <sys/param.h>
+#include <sys/mman.h>
+#include <sys/socket.h>
+#include <sys/uio.h>
+#include <sys/wait.h>
+
+#include <stdio.h>
+#include <errno.h>
+#include <err.h>
+#include <stdlib.h>
+#include <time.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <poll.h>
+#include <stdatomic.h>
+#include <string.h>
+
+#define PARALLEL 2
+#define SYNC 0
+
+static int debug;
+static _Atomic(int) *share;
+
+int
+send_fd(int socket, int fd_to_send)
+{
+	struct cmsghdr *cmsg;
+	struct msghdr msg = {0};
+	struct iovec iov;
+	char buf[1] = {0};  // dummy data
+	char cmsgbuf[CMSG_SPACE(sizeof(fd_to_send))];
+
+	memset(cmsgbuf, 0, sizeof(cmsgbuf));
+
+	iov.iov_base = buf;
+	iov.iov_len = sizeof(buf);
+	msg.msg_iov = &iov;
+	msg.msg_iovlen = 1;
+
+	msg.msg_control = cmsgbuf;
+	msg.msg_controllen = sizeof(cmsgbuf);
+
+	cmsg = CMSG_FIRSTHDR(&msg);
+	cmsg->cmsg_level = SOL_SOCKET;
+	cmsg->cmsg_type = SCM_RIGHTS;
+	cmsg->cmsg_len = CMSG_LEN(sizeof(fd_to_send));
+
+	memcpy(CMSG_DATA(cmsg), &fd_to_send, sizeof(fd_to_send));
+
+	return (sendmsg(socket, &msg, 0));
+}
+
+int
+recv_fd(int socket)
+{
+	struct cmsghdr *cmsg;
+	struct msghdr msg = {0};
+	struct iovec iov;
+	char buf[1];
+	int received_fd;
+	char cmsgbuf[CMSG_SPACE(sizeof(received_fd))];
+
+	memset(cmsgbuf, 0, sizeof(cmsgbuf));
+
+	iov.iov_base = buf;
+	iov.iov_len = sizeof(buf);
+	msg.msg_iov = &iov;
+	msg.msg_iovlen = 1;
+
+	msg.msg_control = cmsgbuf;
+	msg.msg_controllen = sizeof(cmsgbuf);
+
+	if (recvmsg(socket, &msg, 0) < 0)
+		err(1, "recvmsg()");
+
+	cmsg = CMSG_FIRSTHDR(&msg);
+	if (cmsg == NULL || cmsg->cmsg_len != CMSG_LEN(sizeof(received_fd))) {
+		fprintf(stderr, "No passed fd\n");
+		return (-1);
+	}
+
+	if (cmsg->cmsg_level != SOL_SOCKET || cmsg->cmsg_type != SCM_RIGHTS) {
+		fprintf(stderr, "Invalid cmsg_level or cmsg_type\n");
+		return (-1);
+	}
+
+	memcpy(&received_fd, CMSG_DATA(cmsg), sizeof(received_fd));
+	return (received_fd);
+}
+
+int
+main(void)
+{
+	pid_t pid;
+	time_t start;
+	size_t len;
+	int fd, pair[2], status;
+
+	fd  = -1;
+	len = PAGE_SIZE;
+	if ((share = mmap(NULL, len, PROT_READ | PROT_WRITE,
+	    MAP_ANON | MAP_SHARED, -1, 0)) == MAP_FAILED)
+		err(1, "mmap");
+
+	if (socketpair(AF_LOCAL, SOCK_DGRAM, 0, pair) == -1)
+		err(1, "socketpair");
+
+	start = time(NULL);
+	while (time(NULL) - start < 180) {
+		share[SYNC] = 0;
+		if ((pid = fork()) == -1)
+			err(1, "fork");
+		if (pid == 0) {
+			close(pair[0]);
+			atomic_fetch_add(&share[SYNC], 1);
+			while (share[SYNC] != PARALLEL)
+				usleep(1000);
+			// Not calling recv_fd() triggers the issue
+//			fd = recv_fd(pair[1]);
+			if (debug)
+				fprintf(stderr, "Received fd=%d\n", fd);
+			_exit(0);
+		}
+		fd = open("foo", O_RDWR|O_CREAT|O_TRUNC, 0666);
+		if (fd == -1)
+			err(1, "open");
+		if (debug)
+			fprintf(stderr, "Sending fd=%d\n", fd);
+		atomic_fetch_add(&share[SYNC], 1);
+		while (share[SYNC] != PARALLEL)
+			usleep(1000);
+		send_fd(pair[0], fd);
+		usleep(arc4random() % 1000);
+		wait(&status);
+		close(fd);
+		unlink("foo");
+	}
+}