[PATCH liburing v1 0/2] 2 fixes for recv-msgall.c

[PATCH liburing v1 0/2] 2 fixes for recv-msgall.c

[Ammar Faizi]

Hi Jens,

This is the follow up patchset for the recent issue found in
recv-msgall.c. There are two patches in this series.

1. Fix undefined behavior in `recv_prep()`.
The lifetime of `struct msghdr msg;` must be long enough until the CQE
is generated because the recvmsg operation will write to that storage. I
found this test segfault when compiling with -O0 optimization. This is
undefined behavior and may behave randomly. Fix this by making the
lifetime of `struct msghdr msg;` long enough.

2. Fix invalid mutex usage.
Calling pthread_mutex_lock() twice with the same mutex in the same
thread without unlocking it first is invalid. The intention behind this
pattern was to wait for the recv_fn() thread to be ready. Use the
pthread barrier instead. It is more straightforward and correct.

Please apply!

Signed-off-by: Ammar Faizi <ammarfaizi2@gnuweeb.org>
--- 

Ammar Faizi (2):
  recv-msgall: Fix undefined behavior in `recv_prep()`
  recv-msgall: Fix invalid mutex usage

 test/recv-msgall.c | 44 +++++++++++++++++++++-----------------------
 1 file changed, 21 insertions(+), 23 deletions(-)


base-commit: 4961ac480052089a94978e9f771d513551aff61b
-- 
Ammar Faizi

[PATCH liburing v1 1/2] recv-msgall: Fix undefined behavior in `recv_prep()`

[Ammar Faizi]

The lifetime of `struct msghdr msg;` must be long enough until the CQE
is generated because the recvmsg operation will write to that storage. I
found this test segfault when compiling with -O0 optimization. This is
undefined behavior and may behave randomly.

Fix this by making the lifetime of `struct msghdr msg;` long enough.

Fixes: https://github.com/axboe/liburing/issues/855
Signed-off-by: Ammar Faizi <ammarfaizi2@gnuweeb.org>
---
 test/recv-msgall.c | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/test/recv-msgall.c b/test/recv-msgall.c
index ae123e4c381b2b1a..f809834b2e427fc5 100644
--- a/test/recv-msgall.c
+++ b/test/recv-msgall.c
@@ -18,14 +18,18 @@
 #define MAX_MSG	128
 #define HOST	"127.0.0.1"
 static __be16 bind_port;
+struct recv_data {
+	pthread_mutex_t mutex;
+	int use_recvmsg;
+	struct msghdr msg;
+};
 
 static int recv_prep(struct io_uring *ring, struct iovec *iov, int *sock,
-		     int use_recvmsg)
+		     struct recv_data *rd)
 {
 	struct sockaddr_in saddr;
 	struct io_uring_sqe *sqe;
 	int sockfd, ret, val;
-	struct msghdr msg = { };
 
 	memset(&saddr, 0, sizeof(saddr));
 	saddr.sin_family = AF_INET;
@@ -47,14 +51,17 @@ static int recv_prep(struct io_uring *ring, struct iovec *iov, int *sock,
 	bind_port = saddr.sin_port;
 
 	sqe = io_uring_get_sqe(ring);
-	if (!use_recvmsg) {
+	if (!rd->use_recvmsg) {
 		io_uring_prep_recv(sqe, sockfd, iov->iov_base, iov->iov_len,
 					MSG_WAITALL);
 	} else {
-		msg.msg_namelen = sizeof(struct sockaddr_in);
-		msg.msg_iov = iov;
-		msg.msg_iovlen = 1;
-		io_uring_prep_recvmsg(sqe, sockfd, &msg, MSG_WAITALL);
+		struct msghdr *msg = &rd->msg;
+
+		memset(msg, 0, sizeof(*msg));
+		msg->msg_namelen = sizeof(struct sockaddr_in);
+		msg->msg_iov = iov;
+		msg->msg_iovlen = 1;
+		io_uring_prep_recvmsg(sqe, sockfd, msg, MSG_WAITALL);
 	}
 
 	sqe->user_data = 2;
@@ -101,11 +108,6 @@ err:
 	return 1;
 }
 
-struct recv_data {
-	pthread_mutex_t mutex;
-	int use_recvmsg;
-};
-
 static void *recv_fn(void *data)
 {
 	struct recv_data *rd = data;
@@ -128,7 +130,7 @@ static void *recv_fn(void *data)
 		goto err;
 	}
 
-	ret = recv_prep(&ring, &iov, &sock, rd->use_recvmsg);
+	ret = recv_prep(&ring, &iov, &sock, rd);
 	if (ret) {
 		fprintf(stderr, "recv_prep failed: %d\n", ret);
 		goto err;
-- 
Ammar Faizi

[PATCH liburing v1 2/2] recv-msgall: Fix invalid mutex usage

[Ammar Faizi]

Calling pthread_mutex_lock() twice with the same mutex in the same
thread without unlocking it first is invalid. The intention behind this
pattern was to wait for the recv_fn() thread to be ready.

Use the pthread barrier instead. It is more straightforward and correct.

Fixes: https://github.com/axboe/liburing/issues/855
Reported-by: Barnabás Pőcze <pobrn@protonmail.com>
Signed-off-by: Ammar Faizi <ammarfaizi2@gnuweeb.org>
---
 test/recv-msgall.c | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/test/recv-msgall.c b/test/recv-msgall.c
index f809834b2e427fc5..d1fcdb0d510423e7 100644
--- a/test/recv-msgall.c
+++ b/test/recv-msgall.c
@@ -19,7 +19,7 @@
 #define HOST	"127.0.0.1"
 static __be16 bind_port;
 struct recv_data {
-	pthread_mutex_t mutex;
+	pthread_barrier_t barrier;
 	int use_recvmsg;
 	struct msghdr msg;
 };
@@ -122,11 +122,11 @@ static void *recv_fn(void *data)
 
 	ret = t_create_ring_params(1, &ring, &p);
 	if (ret == T_SETUP_SKIP) {
-		pthread_mutex_unlock(&rd->mutex);
+		pthread_barrier_wait(&rd->barrier);
 		ret = 0;
 		goto err;
 	} else if (ret < 0) {
-		pthread_mutex_unlock(&rd->mutex);
+		pthread_barrier_wait(&rd->barrier);
 		goto err;
 	}
 
@@ -135,7 +135,7 @@ static void *recv_fn(void *data)
 		fprintf(stderr, "recv_prep failed: %d\n", ret);
 		goto err;
 	}
-	pthread_mutex_unlock(&rd->mutex);
+	pthread_barrier_wait(&rd->barrier);
 	ret = do_recv(&ring);
 	close(sock);
 	io_uring_queue_exit(&ring);
@@ -219,28 +219,24 @@ err:
 
 static int test(int use_recvmsg)
 {
-	pthread_mutexattr_t attr;
 	pthread_t recv_thread;
 	struct recv_data rd;
 	int ret;
 	void *retval;
 
-	pthread_mutexattr_init(&attr);
-	pthread_mutexattr_setpshared(&attr, 1);
-	pthread_mutex_init(&rd.mutex, &attr);
-	pthread_mutex_lock(&rd.mutex);
+	pthread_barrier_init(&rd.barrier, NULL, 2);
 	rd.use_recvmsg = use_recvmsg;
 
 	ret = pthread_create(&recv_thread, NULL, recv_fn, &rd);
 	if (ret) {
 		fprintf(stderr, "Thread create failed: %d\n", ret);
-		pthread_mutex_unlock(&rd.mutex);
 		return 1;
 	}
 
-	pthread_mutex_lock(&rd.mutex);
+	pthread_barrier_wait(&rd.barrier);
 	do_send();
 	pthread_join(recv_thread, &retval);
+	pthread_barrier_destroy(&rd.barrier);
 	return (intptr_t)retval;
 }
 
-- 
Ammar Faizi

Re: [PATCH liburing v1 0/2] 2 fixes for recv-msgall.c

[Jens Axboe]

On Wed, 10 May 2023 21:39:25 +0700, Ammar Faizi wrote:
> This is the follow up patchset for the recent issue found in
> recv-msgall.c. There are two patches in this series.
> 
> 1. Fix undefined behavior in `recv_prep()`.
> The lifetime of `struct msghdr msg;` must be long enough until the CQE
> is generated because the recvmsg operation will write to that storage. I
> found this test segfault when compiling with -O0 optimization. This is
> undefined behavior and may behave randomly. Fix this by making the
> lifetime of `struct msghdr msg;` long enough.
> 
> [...]

Applied, thanks!

[1/2] recv-msgall: Fix undefined behavior in `recv_prep()`
      commit: 05c6317367cab6fd4b8cf38c68cea1563bf31c5f
[2/2] recv-msgall: Fix invalid mutex usage
      commit: 09c3661278bebb8431fbc10ed213e42181e7cac7

Best regards,
-- 
Jens Axboe