]> git.ozlabs.org Git - ccan/blobdiff - ccan/failtest/failtest.c
failtest: save and restore file state inside child (on-demand)
[ccan] / ccan / failtest / failtest.c
index 3c4cd62affae9ce9d5c2c7b437055bfbfa0d7830..3bc09aa229237d4a64c7d742eff7973e66e1f877 100644 (file)
 #include <sys/wait.h>
 #include <sys/stat.h>
 #include <sys/time.h>
+#include <sys/mman.h>
 #include <signal.h>
 #include <assert.h>
 #include <ccan/time/time.h>
 #include <ccan/read_write_all/read_write_all.h>
 #include <ccan/failtest/failtest_proto.h>
 #include <ccan/build_assert/build_assert.h>
+#include <ccan/hash/hash.h>
+#include <ccan/htable/htable_type.h>
 #include <ccan/str/str.h>
 
 enum failtest_result (*failtest_hook)(struct tlist_calls *);
@@ -46,28 +49,116 @@ struct lock_info {
        int type;
 };
 
+/* We hash the call location together with its backtrace. */
+static size_t hash_call(const struct failtest_call *call)
+{
+       return hash(call->file, strlen(call->file),
+                   hash(&call->line, 1,
+                        hash(call->backtrace, call->backtrace_num,
+                             call->type)));
+}
+
+static bool call_eq(const struct failtest_call *call1,
+                   const struct failtest_call *call2)
+{
+       unsigned int i;
+
+       if (strcmp(call1->file, call2->file) != 0
+           || call1->line != call2->line
+           || call1->type != call2->type
+           || call1->backtrace_num != call2->backtrace_num)
+               return false;
+
+       for (i = 0; i < call1->backtrace_num; i++)
+               if (call1->backtrace[i] != call2->backtrace[i])
+                       return false;
+
+       return true;
+}
+
+/* Defines struct failtable. */
+HTABLE_DEFINE_TYPE(struct failtest_call, (struct failtest_call *), hash_call,
+                  call_eq, failtable);
+
 bool (*failtest_exit_check)(struct tlist_calls *history);
 
+/* The entire history of all calls. */
 static struct tlist_calls history = TLIST_INIT(history);
+/* If we're a child, the fd two write control info to the parent. */
 static int control_fd = -1;
+/* If we're a child, this is the first call we did ourselves. */
+static struct failtest_call *our_history_start = NULL;
+/* For printing runtime with --tracepath. */
 static struct timeval start;
+/* Set when failtest_hook returns FAIL_PROBE */
 static bool probing = false;
+/* Table to track duplicates. */
+static struct failtable failtable;
 
+/* Array of writes which our child did.  We report them on failure. */
 static struct write_call *child_writes = NULL;
 static unsigned int child_writes_num = 0;
 
+/* fcntl locking info. */
 static pid_t lock_owner;
 static struct lock_info *locks = NULL;
 static unsigned int lock_num = 0;
 
+/* Our original pid, which we return to anyone who asks. */
 static pid_t orig_pid;
 
-static const char info_to_arg[] = "mceoxprwf";
+/* Mapping from failtest_type to char. */
+static const char info_to_arg[] = "mceoxprwfal";
 
 /* Dummy call used for failtest_undo wrappers. */
 static struct failtest_call unrecorded_call;
 
+struct contents_saved {
+       size_t count;
+       off_t off;
+       off_t old_len;
+       char contents[1];
+};
+
+/* File contents, saved in this child only. */
+struct saved_mmapped_file {
+       struct saved_mmapped_file *next;
+       struct failtest_call *opener;
+       struct contents_saved *s;
+};
+
+static struct saved_mmapped_file *saved_mmapped_files;
+
+#if HAVE_BACKTRACE
+#include <execinfo.h>
+
+static void **get_backtrace(unsigned int *num)
+{
+       static unsigned int max_back = 100;
+       void **ret;
+
+again:
+       ret = malloc(max_back * sizeof(void *));
+       *num = backtrace(ret, max_back);
+       if (*num == max_back) {
+               free(ret);
+               max_back *= 2;
+               goto again;
+       }
+       return ret;
+}
+#else
+/* This will test slightly less, since will consider all of the same
+ * calls as identical.  But, it's slightly faster! */
+static void **get_backtrace(unsigned int *num)
+{
+       *num = 0;
+       return NULL;
+}
+#endif /* HAVE_BACKTRACE */
+
 static struct failtest_call *add_history_(enum failtest_call_type type,
+                                         bool can_leak,
                                          const char *file,
                                          unsigned int line,
                                          const void *elem,
@@ -81,21 +172,22 @@ static struct failtest_call *add_history_(enum failtest_call_type type,
 
        call = malloc(sizeof *call);
        call->type = type;
+       call->can_leak = can_leak;
        call->file = file;
        call->line = line;
        call->cleanup = NULL;
+       call->backtrace = get_backtrace(&call->backtrace_num);
        memcpy(&call->u, elem, elem_size);
        tlist_add_tail(&history, call, list);
        return call;
 }
 
-#define add_history(type, file, line, elem) \
-       add_history_((type), (file), (line), (elem), sizeof(*(elem)))
+#define add_history(type, can_leak, file, line, elem)          \
+       add_history_((type), (can_leak), (file), (line), (elem), sizeof(*(elem)))
 
 /* We do a fake call inside a sizeof(), to check types. */
 #define set_cleanup(call, clean, type)                 \
-       (call)->cleanup = (void *)((void)sizeof(clean((type *)NULL),1), (clean))
-
+       (call)->cleanup = (void *)((void)sizeof(clean((type *)NULL, false),1), (clean))
 
 /* Dup the fd to a high value (out of the way I hope!), and close the old fd. */
 static int move_fd_to_high(int fd)
@@ -289,91 +381,145 @@ static void get_locks(void)
        lock_owner = getpid();
 }
 
-struct saved_file {
-       struct saved_file *next;
-       int fd;
-       void *contents;
-       off_t off, len;
-};
 
-static struct saved_file *save_file(struct saved_file *next, int fd)
+static struct contents_saved *save_contents(int fd, size_t count, off_t off)
 {
-       struct saved_file *s = malloc(sizeof(*s));
-
-       s->next = next;
-       s->fd = fd;
-       s->off = lseek(fd, 0, SEEK_CUR);
-       /* Special file?  Erk... */
-       assert(s->off != -1);
-       s->len = lseek(fd, 0, SEEK_END);
-       lseek(fd, 0, SEEK_SET);
-       s->contents = malloc(s->len);
-       if (read(fd, s->contents, s->len) != s->len)
-               err(1, "Failed to save %zu bytes", (size_t)s->len);
-       lseek(fd, s->off, SEEK_SET);
+       struct contents_saved *s = malloc(sizeof(*s) + count);
+       ssize_t ret;
+
+       s->off = off;
+
+       ret = pread(fd, s->contents, count, off);
+       if (ret < 0) {
+               fwarn("failtest_write: failed to save old contents!");
+               s->count = 0;
+       } else
+               s->count = ret;
+
+       /* Use lseek to get the size of file, but we have to restore
+        * file offset */
+       off = lseek(fd, 0, SEEK_CUR);
+       s->old_len = lseek(fd, 0, SEEK_END);
+       lseek(fd, off, SEEK_SET);
        return s;
 }
-       
-/* We have little choice but to save and restore open files: mmap means we
- * can really intercept changes in the child.
- *
- * We could do non-mmap'ed files on demand, however. */
-static struct saved_file *save_files(void)
+
+static void restore_contents(struct failtest_call *opener,
+                            struct contents_saved *s,
+                            bool restore_offset,
+                            const char *caller)
+{
+       int fd;
+
+       /* The top parent doesn't need to restore. */
+       if (control_fd == -1)
+               return;
+
+       /* Has the fd been closed? */
+       if (opener->u.open.closed) {
+               /* Reopen, replace fd, close silently as we clean up. */
+               fd = open(opener->u.open.pathname, O_RDWR);
+               if (fd < 0) {
+                       fwarn("failtest: could not reopen %s to clean up %s!",
+                             opener->u.open.pathname, caller);
+                       return;
+               }
+               /* Make it clearly distinguisable from a "normal" fd. */
+               opener->u.open.ret = move_fd_to_high(fd);
+               opener->u.open.closed = false;
+       }
+       fd = opener->u.open.ret;
+
+       if (pwrite(fd, s->contents, s->count, s->off) != s->count) {
+               fwarn("failtest: write failed cleaning up %s for %s!",
+                     opener->u.open.pathname, caller);
+       }
+
+       if (ftruncate(fd, s->old_len) != 0) {
+               fwarn("failtest_write: truncate failed cleaning up %s for %s!",
+                     opener->u.open.pathname, caller);
+       }
+
+       if (restore_offset)
+               lseek(fd, s->off, SEEK_SET);
+}
+
+/* We save/restore most things on demand, but always do mmaped files. */
+static void save_mmapped_files(void)
 {
-       struct saved_file *files = NULL;
        struct failtest_call *i;
 
-       /* Figure out the set of live fds. */
        tlist_for_each_rev(&history, i, list) {
-               if (i->type == FAILTEST_OPEN) {
-                       int fd = i->u.open.ret;
-                       /* Only do successful, writable fds. */
-                       if (fd < 0)
-                               continue;
+               struct mmap_call *m = &i->u.mmap;
+               struct saved_mmapped_file *s;
 
-                       /* If it was closed, cleanup == NULL. */
-                       if (!i->cleanup)
-                               continue;
+               if (i->type != FAILTEST_MMAP)
+                       continue;
 
-                       if ((i->u.open.flags & O_RDWR) == O_RDWR) {
-                               files = save_file(files, fd);
-                       } else if ((i->u.open.flags & O_WRONLY)
-                                  == O_WRONLY) {
-                               /* FIXME: Handle O_WRONLY.  Open with O_RDWR? */
-                               abort();
-                       }
-               }
-       }
+               /* FIXME: We only handle mmapped files where fd is still open. */
+               if (m->opener->u.open.closed)
+                       continue;
 
-       return files;
+               s = malloc(sizeof *s);
+               s->s = save_contents(m->fd, m->length, m->offset);
+               s->opener = m->opener;
+               s->next = saved_mmapped_files;
+               saved_mmapped_files = s;
+       }
 }
 
-static void restore_files(struct saved_file *s)
+static void free_mmapped_files(bool restore)
 {
-       while (s) {
-               struct saved_file *next = s->next;
-
-               lseek(s->fd, 0, SEEK_SET);
-               if (write(s->fd, s->contents, s->len) != s->len)
-                       err(1, "Failed to restore %zu bytes", (size_t)s->len);
-               if (ftruncate(s->fd, s->len) != 0)
-                       err(1, "Failed to trim file to length %zu",
-                           (size_t)s->len);
-               free(s->contents);
-               lseek(s->fd, s->off, SEEK_SET);
-               free(s);
-               s = next;
+       while (saved_mmapped_files) {
+               struct saved_mmapped_file *next = saved_mmapped_files->next;
+               if (restore)
+                       restore_contents(saved_mmapped_files->opener,
+                                        saved_mmapped_files->s, false,
+                                        "saved mmap");
+               free(saved_mmapped_files->s);
+               free(saved_mmapped_files);
+               saved_mmapped_files = next;
        }
 }
 
-static void free_files(struct saved_file *s)
+/* Returns a FAILTEST_OPEN, FAILTEST_PIPE or NULL. */
+static struct failtest_call *opener_of(int fd)
 {
-       while (s) {
-               struct saved_file *next = s->next;
-               free(s->contents);
-               free(s);
-               s = next;
+       struct failtest_call *i;
+
+       /* Don't get confused and match genuinely failed opens. */
+       if (fd < 0)
+               return NULL;
+
+       /* Figure out the set of live fds. */
+       tlist_for_each_rev(&history, i, list) {
+               if (i->fail)
+                       continue;
+               switch (i->type) {
+               case FAILTEST_CLOSE:
+                       if (i->u.close.fd == fd) {
+                               return NULL;
+                       }
+                       break;
+               case FAILTEST_OPEN:
+                       if (i->u.open.ret == fd) {
+                               if (i->u.open.closed)
+                                       return NULL;
+                               return i;
+                       }
+                       break;
+               case FAILTEST_PIPE:
+                       if (i->u.pipe.fds[0] == fd || i->u.pipe.fds[1] == fd) {
+                               return i;
+                       }
+                       break;
+               default:
+                       break;
+               }
        }
+
+       /* FIXME: socket, dup, etc are untracked! */
+       return NULL;
 }
 
 static void free_call(struct failtest_call *call)
@@ -381,6 +527,7 @@ static void free_call(struct failtest_call *call)
        /* We don't do this in cleanup: needed even for failed opens. */
        if (call->type == FAILTEST_OPEN)
                free((char *)call->u.open.pathname);
+       free(call->backtrace);
        tlist_del_from(&history, call, list);
        free(call);
 }
@@ -392,39 +539,81 @@ static void free_everything(void)
 
        while ((i = tlist_top(&history, struct failtest_call, list)) != NULL)
                free_call(i);
+
+       failtable_clear(&failtable);
 }
 
 static NORETURN void failtest_cleanup(bool forced_cleanup, int status)
 {
        struct failtest_call *i;
+       bool restore = true;
 
        /* For children, we don't care if they "failed" the testing. */
        if (control_fd != -1)
                status = 0;
-
-       if (forced_cleanup) {
-               /* We didn't actually do final operation: remove it. */
-               i = tlist_tail(&history, struct failtest_call, list);
-               free_call(i);
-       }
+       else
+               /* We don't restore contents for original parent. */
+               restore = false;
 
        /* Cleanup everything, in reverse order. */
        tlist_for_each_rev(&history, i, list) {
-               if (!i->cleanup)
+               /* Don't restore things our parent did. */
+               if (i == our_history_start)
+                       restore = false;
+
+               if (i->fail)
                        continue;
-               if (!forced_cleanup) {
+
+               if (i->cleanup)
+                       i->cleanup(&i->u, restore);
+
+               /* But their program shouldn't leak, even on failure. */
+               if (!forced_cleanup && i->can_leak) {
                        printf("Leak at %s:%u: --failpath=%s\n",
                               i->file, i->line, failpath_string());
                        status = 1;
                }
-               i->cleanup(&i->u);
        }
 
+       /* Put back mmaped files the way our parent (if any) expects. */
+       free_mmapped_files(true);
+
        free_everything();
-       tell_parent(SUCCESS);
+       if (status == 0)
+               tell_parent(SUCCESS);
+       else
+               tell_parent(FAILURE);
        exit(status);
 }
 
+static bool following_path(void)
+{
+       if (!failpath)
+               return false;
+       /* + means continue after end, like normal. */
+       if (*failpath == '+') {
+               failpath = NULL;
+               return false;
+       }
+       return true;
+}
+
+static bool follow_path(struct failtest_call *call)
+{
+       if (*failpath == '\0') {
+               /* Continue, but don't inject errors. */
+               return call->fail = false;
+       }
+
+       if (tolower((unsigned char)*failpath) != info_to_arg[call->type])
+               errx(1, "Failpath expected '%s' got '%c'\n",
+                    failpath, info_to_arg[call->type]);
+       call->fail = cisupper(*(failpath++));
+                       if (call->fail)
+                               call->can_leak = false;
+       return call->fail;
+}
+
 static bool should_fail(struct failtest_call *call)
 {
        int status;
@@ -432,31 +621,22 @@ static bool should_fail(struct failtest_call *call)
        enum info_type type = UNEXPECTED;
        char *out = NULL;
        size_t outlen = 0;
-       struct saved_file *files;
+       struct failtest_call *dup;
 
        if (call == &unrecorded_call)
                return false;
 
-       if (failpath) {
-               /* + means continue after end, like normal. */
-               if (*failpath == '+')
-                       failpath = NULL;
-               else if (*failpath == '\0') {
-                       /* Continue, but don't inject errors. */
-                       return call->fail = false;
-               } else {
-                       if (tolower((unsigned char)*failpath)
-                           != info_to_arg[call->type])
-                               errx(1, "Failpath expected '%c' got '%c'\n",
-                                    info_to_arg[call->type], *failpath);
-                       call->fail = cisupper(*(failpath++));
-                       return call->fail;
-               }
-       }
+       if (following_path())
+               return follow_path(call);
 
        /* Attach debugger if they asked for it. */
        if (debugpath) {
-               char *path = failpath_string();
+               char *path;
+
+               /* Pretend this last call matches whatever path wanted:
+                * keeps valgrind happy. */
+               call->fail = cisupper(debugpath[strlen(debugpath)-1]);
+               path = failpath_string();
 
                if (streq(path, debugpath)) {
                        char str[80];
@@ -467,9 +647,14 @@ static bool should_fail(struct failtest_call *call)
                                getpid(), getpid());
                        if (system(str) == 0)
                                sleep(5);
-               } else if (!strstarts(path, debugpath)) {
-                       fprintf(stderr, "--debugpath not followed: %s\n", path);
-                       debugpath = NULL;
+               } else {
+                       /* Ignore last character: could be upper or lower. */
+                       path[strlen(path)-1] = '\0';
+                       if (!strstarts(debugpath, path)) {
+                               fprintf(stderr,
+                                       "--debugpath not followed: %s\n", path);
+                               debugpath = NULL;
+                       }
                }
                free(path);
        }
@@ -478,6 +663,11 @@ static bool should_fail(struct failtest_call *call)
        if (probing)
                return call->fail = false;
 
+       /* Don't more than once in the same place. */
+       dup = failtable_get(&failtable, call);
+       if (dup)
+               return call->fail = false;
+
        if (failtest_hook) {
                switch (failtest_hook(&history)) {
                case FAIL_OK:
@@ -493,13 +683,20 @@ static bool should_fail(struct failtest_call *call)
                }
        }
 
-       files = save_files();
+       /* Add it to our table of calls. */
+       failtable_add(&failtable, call);
 
        /* We're going to fail in the child. */
        call->fail = true;
        if (pipe(control) != 0 || pipe(output) != 0)
                err(1, "opening pipe");
 
+       /* Move out the way, to high fds. */
+       control[0] = move_fd_to_high(control[0]);
+       control[1] = move_fd_to_high(control[1]);
+       output[0] = move_fd_to_high(output[0]);
+       output[1] = move_fd_to_high(output[1]);
+
        /* Prevent double-printing (in child and parent) */
        fflush(stdout);
        child = fork();
@@ -527,6 +724,9 @@ static bool should_fail(struct failtest_call *call)
                                trace("%s", c->file);
                        trace(":%u)\n", c->line);
                }
+               /* From here on, we have to clean up! */
+               our_history_start = tlist_tail(&history, struct failtest_call,
+                                              list);
                close(control[0]);
                close(output[0]);
                dup2(output[1], STDOUT_FILENO);
@@ -534,8 +734,16 @@ static bool should_fail(struct failtest_call *call)
                if (output[1] != STDOUT_FILENO && output[1] != STDERR_FILENO)
                        close(output[1]);
                control_fd = move_fd_to_high(control[1]);
-               /* Valgrind spots the leak if we don't free these. */
-               free_files(files);
+
+               /* Forget any of our parent's saved files. */
+               free_mmapped_files(false);
+
+               /* Now, save any files we need to. */
+               save_mmapped_files();
+
+               /* Failed calls can't leak. */
+               call->can_leak = false;
+
                return true;
        }
 
@@ -612,8 +820,6 @@ static bool should_fail(struct failtest_call *call)
        free(out);
        signal(SIGUSR1, SIG_DFL);
 
-       restore_files(files);
-
        /* Only child does probe. */
        probing = false;
 
@@ -622,7 +828,7 @@ static bool should_fail(struct failtest_call *call)
        return false;
 }
 
-static void cleanup_calloc(struct calloc_call *call)
+static void cleanup_calloc(struct calloc_call *call, bool restore)
 {
        free(call->ret);
 }
@@ -634,7 +840,7 @@ void *failtest_calloc(size_t nmemb, size_t size,
        struct calloc_call call;
        call.nmemb = nmemb;
        call.size = size;
-       p = add_history(FAILTEST_CALLOC, file, line, &call);
+       p = add_history(FAILTEST_CALLOC, true, file, line, &call);
 
        if (should_fail(p)) {
                p->u.calloc.ret = NULL;
@@ -647,7 +853,7 @@ void *failtest_calloc(size_t nmemb, size_t size,
        return p->u.calloc.ret;
 }
 
-static void cleanup_malloc(struct malloc_call *call)
+static void cleanup_malloc(struct malloc_call *call, bool restore)
 {
        free(call->ret);
 }
@@ -658,7 +864,7 @@ void *failtest_malloc(size_t size, const char *file, unsigned line)
        struct malloc_call call;
        call.size = size;
 
-       p = add_history(FAILTEST_MALLOC, file, line, &call);
+       p = add_history(FAILTEST_MALLOC, true, file, line, &call);
        if (should_fail(p)) {
                p->u.malloc.ret = NULL;
                p->error = ENOMEM;
@@ -670,7 +876,7 @@ void *failtest_malloc(size_t size, const char *file, unsigned line)
        return p->u.malloc.ret;
 }
 
-static void cleanup_realloc(struct realloc_call *call)
+static void cleanup_realloc(struct realloc_call *call, bool restore)
 {
        free(call->ret);
 }
@@ -686,18 +892,21 @@ static void fixup_ptr_history(void *ptr)
                case FAILTEST_REALLOC:
                        if (i->u.realloc.ret == ptr) {
                                i->cleanup = NULL;
+                               i->can_leak = false;
                                return;
                        }
                        break;
                case FAILTEST_MALLOC:
                        if (i->u.malloc.ret == ptr) {
                                i->cleanup = NULL;
+                               i->can_leak = false;
                                return;
                        }
                        break;
                case FAILTEST_CALLOC:
                        if (i->u.calloc.ret == ptr) {
                                i->cleanup = NULL;
+                               i->can_leak = false;
                                return;
                        }
                        break;
@@ -712,7 +921,7 @@ void *failtest_realloc(void *ptr, size_t size, const char *file, unsigned line)
        struct failtest_call *p;
        struct realloc_call call;
        call.size = size;
-       p = add_history(FAILTEST_REALLOC, file, line, &call);
+       p = add_history(FAILTEST_REALLOC, true, file, line, &call);
 
        /* FIXME: Try one child moving allocation, one not. */
        if (should_fail(p)) {
@@ -729,15 +938,60 @@ void *failtest_realloc(void *ptr, size_t size, const char *file, unsigned line)
        return p->u.realloc.ret;
 }
 
+/* FIXME: Record free, so we can terminate fixup_ptr_history correctly.
+ * If there's an alloc we don't see, it could get confusing if it matches
+ * a previous allocation we did see. */
 void failtest_free(void *ptr)
 {
        fixup_ptr_history(ptr);
        free(ptr);
 }
 
-static void cleanup_open(struct open_call *call)
+
+static struct contents_saved *save_file(const char *pathname)
 {
-       close(call->ret);
+       int fd;
+       struct contents_saved *s;
+
+       fd = open(pathname, O_RDONLY);
+       if (fd < 0)
+               return NULL;
+
+       s = save_contents(fd, lseek(fd, 0, SEEK_END), 0);
+       close(fd);
+       return s;
+}
+
+/* Optimization: don't create a child for an open which *we know*
+ * would fail anyway. */
+static bool open_would_fail(const char *pathname, int flags)
+{
+       if ((flags & O_ACCMODE) == O_RDONLY)
+               return access(pathname, R_OK) != 0;
+       if (!(flags & O_CREAT)) {
+               if ((flags & O_ACCMODE) == O_WRONLY)
+                       return access(pathname, W_OK) != 0;
+               if ((flags & O_ACCMODE) == O_RDWR)
+                       return access(pathname, W_OK) != 0
+                               || access(pathname, R_OK) != 0;
+       }
+       /* FIXME: We could check if it exists, for O_CREAT|O_EXCL */
+       return false;
+}
+
+static void cleanup_open(struct open_call *call, bool restore)
+{
+       if (restore && call->saved)
+               restore_contents(container_of(call, struct failtest_call,
+                                             u.open),
+                                call->saved, false, "open with O_TRUNC");
+       if (!call->closed) {
+               trace("Cleaning up open %s by closing fd %i\n",
+                     call->pathname, call->ret);
+               close(call->ret);
+               call->closed = true;
+       }
+       free(call->saved);
 }
 
 int failtest_open(const char *pathname,
@@ -750,32 +1004,91 @@ int failtest_open(const char *pathname,
        call.pathname = strdup(pathname);
        va_start(ap, line);
        call.flags = va_arg(ap, int);
+       call.always_save = false;
+       call.closed = false;
        if (call.flags & O_CREAT) {
                call.mode = va_arg(ap, int);
                va_end(ap);
        }
-       p = add_history(FAILTEST_OPEN, file, line, &call);
+       p = add_history(FAILTEST_OPEN, true, file, line, &call);
        /* Avoid memory leak! */
        if (p == &unrecorded_call)
                free((char *)call.pathname);
-       p->u.open.ret = open(pathname, call.flags, call.mode);
 
-       if (p->u.open.ret == -1) {
-               p->fail = false;
-               p->error = errno;
-       } else if (should_fail(p)) {
-               close(p->u.open.ret);
+       if (should_fail(p)) {
+               /* Don't bother inserting failures that would happen anyway. */
+               if (open_would_fail(pathname, call.flags))
+                       failtest_cleanup(true, 0);
                p->u.open.ret = -1;
                /* FIXME: Play with error codes? */
                p->error = EACCES;
        } else {
-               set_cleanup(p, cleanup_open, struct open_call);
+               /* Save the old version if they're truncating it. */
+               if (call.flags & O_TRUNC)
+                       p->u.open.saved = save_file(pathname);
+               else
+                       p->u.open.saved = NULL;
+               p->u.open.ret = open(pathname, call.flags, call.mode);
+               if (p->u.open.ret == -1) {
+                       p->u.open.closed = true;
+                       p->can_leak = false;
+               } else {
+                       set_cleanup(p, cleanup_open, struct open_call);
+               }
        }
        errno = p->error;
        return p->u.open.ret;
 }
 
-static void cleanup_pipe(struct pipe_call *call)
+static void cleanup_mmap(struct mmap_call *mmap, bool restore)
+{
+       if (restore)
+               restore_contents(mmap->opener, mmap->saved, false, "mmap");
+       free(mmap->saved);
+}
+
+void *failtest_mmap(void *addr, size_t length, int prot, int flags,
+                   int fd, off_t offset, const char *file, unsigned line)
+{
+       struct failtest_call *p;
+       struct mmap_call call;
+
+       call.addr = addr;
+       call.length = length;
+       call.prot = prot;
+       call.flags = flags;
+       call.offset = offset;
+       call.fd = fd;
+       call.opener = opener_of(fd);
+
+       /* If we don't know what file it was, don't fail. */
+       if (!call.opener) {
+               if (fd != -1) {
+                       fwarnx("failtest_mmap: couldn't figure out source for"
+                              " fd %i at %s:%u", fd, file, line);
+               }
+               return mmap(addr, length, prot, flags, fd, offset);
+       }
+
+       p = add_history(FAILTEST_MMAP, false, file, line, &call);
+       if (should_fail(p)) {
+               p->u.mmap.ret = MAP_FAILED;
+               p->error = ENOMEM;
+       } else {
+               p->u.mmap.ret = mmap(addr, length, prot, flags, fd, offset);
+               /* Save contents if we're writing to a normal file */
+               if (p->u.mmap.ret != MAP_FAILED
+                   && (prot & PROT_WRITE)
+                   && call.opener->type == FAILTEST_OPEN) {
+                       p->u.mmap.saved = save_contents(fd, length, offset);
+                       set_cleanup(p, cleanup_mmap, struct mmap_call);
+               }
+       }
+       errno = p->error;
+       return p->u.mmap.ret;
+}
+
+static void cleanup_pipe(struct pipe_call *call, bool restore)
 {
        if (!call->closed[0])
                close(call->fds[0]);
@@ -788,7 +1101,7 @@ int failtest_pipe(int pipefd[2], const char *file, unsigned line)
        struct failtest_call *p;
        struct pipe_call call;
 
-       p = add_history(FAILTEST_PIPE, file, line, &call);
+       p = add_history(FAILTEST_PIPE, true, file, line, &call);
        if (should_fail(p)) {
                p->u.open.ret = -1;
                /* FIXME: Play with error codes? */
@@ -804,8 +1117,18 @@ int failtest_pipe(int pipefd[2], const char *file, unsigned line)
        return p->u.pipe.ret;
 }
 
-ssize_t failtest_pread(int fd, void *buf, size_t count, off_t off,
-                      const char *file, unsigned line)
+static void cleanup_read(struct read_call *call, bool restore)
+{
+       if (restore) {
+               /* Read (not readv!) moves file offset! */
+               if (lseek(call->fd, call->off, SEEK_SET) != call->off) {
+                       fwarn("Restoring lseek pointer failed (read)");
+               }
+       }
+}
+
+static ssize_t failtest_add_read(int fd, void *buf, size_t count, off_t off,
+                                bool is_pread, const char *file, unsigned line)
 {
        struct failtest_call *p;
        struct read_call call;
@@ -813,21 +1136,37 @@ ssize_t failtest_pread(int fd, void *buf, size_t count, off_t off,
        call.buf = buf;
        call.count = count;
        call.off = off;
-       p = add_history(FAILTEST_READ, file, line, &call);
+       p = add_history(FAILTEST_READ, false, file, line, &call);
 
        /* FIXME: Try partial read returns. */
        if (should_fail(p)) {
                p->u.read.ret = -1;
                p->error = EIO;
        } else {
-               p->u.read.ret = pread(fd, buf, count, off);
+               if (is_pread)
+                       p->u.read.ret = pread(fd, buf, count, off);
+               else {
+                       p->u.read.ret = read(fd, buf, count);
+                       if (p->u.read.ret != -1)
+                               set_cleanup(p, cleanup_read, struct read_call);
+               }
        }
        errno = p->error;
        return p->u.read.ret;
 }
 
-ssize_t failtest_pwrite(int fd, const void *buf, size_t count, off_t off,
-                       const char *file, unsigned line)
+static void cleanup_write(struct write_call *write, bool restore)
+{
+       if (restore)
+               restore_contents(write->opener, write->saved, !write->is_pwrite,
+                                "write");
+       free(write->saved);
+}
+
+static ssize_t failtest_add_write(int fd, const void *buf,
+                                 size_t count, off_t off,
+                                 bool is_pwrite,
+                                 const char *file, unsigned line)
 {
        struct failtest_call *p;
        struct write_call call;
@@ -836,7 +1175,9 @@ ssize_t failtest_pwrite(int fd, const void *buf, size_t count, off_t off,
        call.buf = buf;
        call.count = count;
        call.off = off;
-       p = add_history(FAILTEST_WRITE, file, line, &call);
+       call.is_pwrite = is_pwrite;
+       call.opener = opener_of(fd);
+       p = add_history(FAILTEST_WRITE, false, file, line, &call);
 
        /* If we're a child, we need to make sure we write the same thing
         * to non-files as the parent does, so tell it. */
@@ -853,8 +1194,19 @@ ssize_t failtest_pwrite(int fd, const void *buf, size_t count, off_t off,
                p->u.write.ret = -1;
                p->error = EIO;
        } else {
+               bool is_file;
+               assert(call.opener == p->u.write.opener);
+
+               if (p->u.write.opener) {
+                       is_file = (p->u.write.opener->type == FAILTEST_OPEN);
+               } else {
+                       /* We can't unwind it, so at least check same
+                        * in parent and child. */
+                       is_file = false;
+               }
+
                /* FIXME: We assume same write order in parent and child */
-               if (off == (off_t)-1 && child_writes_num != 0) {
+               if (!is_file && child_writes_num != 0) {
                        if (child_writes[0].fd != fd)
                                errx(1, "Child wrote to fd %u, not %u?",
                                     child_writes[0].fd, fd);
@@ -875,32 +1227,52 @@ ssize_t failtest_pwrite(int fd, const void *buf, size_t count, off_t off,
                        memmove(&child_writes[0], &child_writes[1],
                                sizeof(child_writes[0]) * child_writes_num);
 
-                       /* Is this is a socket or pipe, child wrote it
-                          already. */
-                       if (p->u.write.off == (off_t)-1) {
-                               p->u.write.ret = count;
-                               errno = p->error;
-                               return p->u.write.ret;
-                       }
+                       /* Child wrote it already. */
+                       p->u.write.ret = count;
+                       errno = p->error;
+                       return p->u.write.ret;
                }
-               p->u.write.ret = pwrite(fd, buf, count, off);
+
+               if (is_file) {
+                       p->u.write.saved = save_contents(fd, count, off);
+                       set_cleanup(p, cleanup_write, struct write_call);
+               }
+
+               /* Though off is current seek ptr for write case, we need to
+                * move it.  write() does that for us. */
+               if (p->u.write.is_pwrite)
+                       p->u.write.ret = pwrite(fd, buf, count, off);
+               else
+                       p->u.write.ret = write(fd, buf, count);
        }
        errno = p->error;
        return p->u.write.ret;
 }
 
-ssize_t failtest_read(int fd, void *buf, size_t count,
-                     const char *file, unsigned line)
+ssize_t failtest_pwrite(int fd, const void *buf, size_t count, off_t offset,
+                       const char *file, unsigned line)
 {
-       return failtest_pread(fd, buf, count, lseek(fd, 0, SEEK_CUR),
-                             file, line);
+       return failtest_add_write(fd, buf, count, offset, true, file, line);
 }
 
 ssize_t failtest_write(int fd, const void *buf, size_t count,
                       const char *file, unsigned line)
 {
-       return failtest_pwrite(fd, buf, count, lseek(fd, 0, SEEK_CUR),
-                              file, line);
+       return failtest_add_write(fd, buf, count, lseek(fd, 0, SEEK_CUR), false,
+                                 file, line);
+}
+
+ssize_t failtest_pread(int fd, void *buf, size_t count, off_t off,
+                      const char *file, unsigned line)
+{
+       return failtest_add_read(fd, buf, count, off, true, file, line);
+}
+
+ssize_t failtest_read(int fd, void *buf, size_t count,
+                     const char *file, unsigned line)
+{
+       return failtest_add_read(fd, buf, count, lseek(fd, 0, SEEK_CUR), false,
+                                file, line);
 }
 
 static struct lock_info *WARN_UNUSED_RESULT
@@ -969,56 +1341,80 @@ add_lock(struct lock_info *locks, int fd, off_t start, off_t end, int type)
 /* We trap this so we can record it: we don't fail it. */
 int failtest_close(int fd, const char *file, unsigned line)
 {
-       struct failtest_call *i;
        struct close_call call;
-       struct failtest_call *p;
+       struct failtest_call *p, *opener;
+
+       /* Do this before we add ourselves to history! */
+       opener = opener_of(fd);
 
        call.fd = fd;
-       p = add_history(FAILTEST_CLOSE, file, line, &call);
+       p = add_history(FAILTEST_CLOSE, false, file, line, &call);
        p->fail = false;
 
-       /* Consume close from failpath. */
-       if (failpath)
-               if (should_fail(p))
+       /* Consume close from failpath (shouldn't tell us to fail). */
+       if (following_path()) {
+               if (follow_path(p))
                        abort();
+       }
 
        if (fd < 0)
                return close(fd);
 
-       /* Trace history to find source of fd. */
-       tlist_for_each_rev(&history, i, list) {
-               switch (i->type) {
-               case FAILTEST_PIPE:
+       /* Mark opener as not leaking, remove its cleanup function. */
+       if (opener) {
+               if (opener->type == FAILTEST_PIPE) {
                        /* From a pipe? */
-                       if (i->u.pipe.fds[0] == fd) {
-                               assert(!i->u.pipe.closed[0]);
-                               i->u.pipe.closed[0] = true;
-                               if (i->u.pipe.closed[1])
-                                       i->cleanup = NULL;
-                               goto out;
-                       }
-                       if (i->u.pipe.fds[1] == fd) {
-                               assert(!i->u.pipe.closed[1]);
-                               i->u.pipe.closed[1] = true;
-                               if (i->u.pipe.closed[0])
-                                       i->cleanup = NULL;
-                               goto out;
-                       }
-                       break;
-               case FAILTEST_OPEN:
-                       if (i->u.open.ret == fd) {
-                               assert((void *)i->cleanup
-                                      == (void *)cleanup_open);
+                       if (opener->u.pipe.fds[0] == fd) {
+                               assert(!opener->u.pipe.closed[0]);
+                               opener->u.pipe.closed[0] = true;
+                       } else if (opener->u.pipe.fds[1] == fd) {
+                               assert(!opener->u.pipe.closed[1]);
+                               opener->u.pipe.closed[1] = true;
+                       } else
+                               abort();
+                       opener->can_leak = (!opener->u.pipe.closed[0]
+                                           || !opener->u.pipe.closed[1]);
+               } else if (opener->type == FAILTEST_OPEN) {
+                       opener->u.open.closed = true;
+                       opener->can_leak = false;
+               } else
+                       abort();
+       }
+
+       /* Restore offset now, in case parent shared (can't do after close!). */
+       if (control_fd != -1) {
+               struct failtest_call *i;
+
+               tlist_for_each_rev(&history, i, list) {
+                       if (i == our_history_start)
+                               break;
+                       if (i == opener)
+                               break;
+                       if (i->type == FAILTEST_LSEEK && i->u.lseek.fd == fd) {
+                               /* This seeks back. */
+                               i->cleanup(&i->u, true);
                                i->cleanup = NULL;
-                               goto out;
+                       } else if (i->type == FAILTEST_WRITE
+                                  && i->u.write.fd == fd
+                                  && !i->u.write.is_pwrite) {
+                               /* Write (not pwrite!) moves file offset! */
+                               if (lseek(fd, i->u.write.off, SEEK_SET)
+                                   != i->u.write.off) {
+                                       fwarn("Restoring lseek pointer failed (write)");
+                               }
+                       } else if (i->type == FAILTEST_READ
+                                  && i->u.read.fd == fd) {
+                               /* preads don't *have* cleanups */
+                               if (i->cleanup) {
+                                       /* This seeks back. */
+                                       i->cleanup(&i->u, true);
+                                       i->cleanup = NULL;
+                               }
                        }
-                       break;
-               default:
-                       break;
                }
        }
 
-out:
+       /* Close unlocks everything. */
        locks = add_lock(locks, fd, 0, off_max(), F_UNLCK);
        return close(fd);
 }
@@ -1069,7 +1465,7 @@ int failtest_fcntl(int fd, const char *file, unsigned line, int cmd, ...)
                err(1, "failtest: unknown fcntl %u", cmd);
        }
 
-       p = add_history(FAILTEST_FCNTL, file, line, &call);
+       p = add_history(FAILTEST_FCNTL, false, file, line, &call);
 
        if (should_fail(p)) {
                p->u.fcntl.ret = -1;
@@ -1098,6 +1494,41 @@ int failtest_fcntl(int fd, const char *file, unsigned line, int cmd, ...)
        return p->u.fcntl.ret;
 }
 
+static void cleanup_lseek(struct lseek_call *call, bool restore)
+{
+       if (restore) {
+               if (lseek(call->fd, call->old_off, SEEK_SET) != call->old_off)
+                       fwarn("Restoring lseek pointer failed");
+       }
+}
+
+/* We trap this so we can undo it: we don't fail it. */
+off_t failtest_lseek(int fd, off_t offset, int whence, const char *file,
+                    unsigned int line)
+{
+       struct failtest_call *p;
+       struct lseek_call call;
+       call.fd = fd;
+       call.offset = offset;
+       call.whence = whence;
+       call.old_off = lseek(fd, 0, SEEK_CUR);
+
+       p = add_history(FAILTEST_LSEEK, false, file, line, &call);
+       p->fail = false;
+
+       /* Consume lseek from failpath. */
+       if (failpath)
+               if (should_fail(p))
+                       abort();
+
+       p->u.lseek.ret = lseek(fd, offset, whence);
+
+       if (p->u.lseek.ret != (off_t)-1)
+               set_cleanup(p, cleanup_lseek, struct lseek_call);
+       return p->u.lseek.ret;
+}
+
+
 pid_t failtest_getpid(const char *file, unsigned line)
 {
        /* You must call failtest_init first! */
@@ -1123,6 +1554,7 @@ void failtest_init(int argc, char *argv[])
                        debugpath = argv[i] + strlen("--debugpath=");
                }
        }
+       failtable_init(&failtable);
        start = time_now();
 }