* [PATCH liburing v1 1/2] recv-msgall: Fix undefined behavior in `recv_prep()`
2023-05-10 14:39 [PATCH liburing v1 0/2] 2 fixes for recv-msgall.c Ammar Faizi
@ 2023-05-10 14:39 ` Ammar Faizi
2023-05-10 14:39 ` [PATCH liburing v1 2/2] recv-msgall: Fix invalid mutex usage Ammar Faizi
2023-05-10 15:17 ` [PATCH liburing v1 0/2] 2 fixes for recv-msgall.c Jens Axboe
2 siblings, 0 replies; 4+ messages in thread
From: Ammar Faizi @ 2023-05-10 14:39 UTC (permalink / raw)
To: Jens Axboe
Cc: Ammar Faizi, Barnabás Pőcze, Michael William Jonathan,
Linux Kernel Mailing List, io-uring Mailing List,
GNU/Weeb Mailing List
The lifetime of `struct msghdr msg;` must be long enough until the CQE
is generated because the recvmsg operation will write to that storage. I
found this test segfault when compiling with -O0 optimization. This is
undefined behavior and may behave randomly.
Fix this by making the lifetime of `struct msghdr msg;` long enough.
Fixes: https://github.com/axboe/liburing/issues/855
Signed-off-by: Ammar Faizi <[email protected]>
---
test/recv-msgall.c | 28 +++++++++++++++-------------
1 file changed, 15 insertions(+), 13 deletions(-)
diff --git a/test/recv-msgall.c b/test/recv-msgall.c
index ae123e4c381b2b1a..f809834b2e427fc5 100644
--- a/test/recv-msgall.c
+++ b/test/recv-msgall.c
@@ -18,14 +18,18 @@
#define MAX_MSG 128
#define HOST "127.0.0.1"
static __be16 bind_port;
+struct recv_data {
+ pthread_mutex_t mutex;
+ int use_recvmsg;
+ struct msghdr msg;
+};
static int recv_prep(struct io_uring *ring, struct iovec *iov, int *sock,
- int use_recvmsg)
+ struct recv_data *rd)
{
struct sockaddr_in saddr;
struct io_uring_sqe *sqe;
int sockfd, ret, val;
- struct msghdr msg = { };
memset(&saddr, 0, sizeof(saddr));
saddr.sin_family = AF_INET;
@@ -47,14 +51,17 @@ static int recv_prep(struct io_uring *ring, struct iovec *iov, int *sock,
bind_port = saddr.sin_port;
sqe = io_uring_get_sqe(ring);
- if (!use_recvmsg) {
+ if (!rd->use_recvmsg) {
io_uring_prep_recv(sqe, sockfd, iov->iov_base, iov->iov_len,
MSG_WAITALL);
} else {
- msg.msg_namelen = sizeof(struct sockaddr_in);
- msg.msg_iov = iov;
- msg.msg_iovlen = 1;
- io_uring_prep_recvmsg(sqe, sockfd, &msg, MSG_WAITALL);
+ struct msghdr *msg = &rd->msg;
+
+ memset(msg, 0, sizeof(*msg));
+ msg->msg_namelen = sizeof(struct sockaddr_in);
+ msg->msg_iov = iov;
+ msg->msg_iovlen = 1;
+ io_uring_prep_recvmsg(sqe, sockfd, msg, MSG_WAITALL);
}
sqe->user_data = 2;
@@ -101,11 +108,6 @@ err:
return 1;
}
-struct recv_data {
- pthread_mutex_t mutex;
- int use_recvmsg;
-};
-
static void *recv_fn(void *data)
{
struct recv_data *rd = data;
@@ -128,7 +130,7 @@ static void *recv_fn(void *data)
goto err;
}
- ret = recv_prep(&ring, &iov, &sock, rd->use_recvmsg);
+ ret = recv_prep(&ring, &iov, &sock, rd);
if (ret) {
fprintf(stderr, "recv_prep failed: %d\n", ret);
goto err;
--
Ammar Faizi
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH liburing v1 2/2] recv-msgall: Fix invalid mutex usage
2023-05-10 14:39 [PATCH liburing v1 0/2] 2 fixes for recv-msgall.c Ammar Faizi
2023-05-10 14:39 ` [PATCH liburing v1 1/2] recv-msgall: Fix undefined behavior in `recv_prep()` Ammar Faizi
@ 2023-05-10 14:39 ` Ammar Faizi
2023-05-10 15:17 ` [PATCH liburing v1 0/2] 2 fixes for recv-msgall.c Jens Axboe
2 siblings, 0 replies; 4+ messages in thread
From: Ammar Faizi @ 2023-05-10 14:39 UTC (permalink / raw)
To: Jens Axboe
Cc: Ammar Faizi, Barnabás Pőcze, Michael William Jonathan,
Linux Kernel Mailing List, io-uring Mailing List,
GNU/Weeb Mailing List
Calling pthread_mutex_lock() twice with the same mutex in the same
thread without unlocking it first is invalid. The intention behind this
pattern was to wait for the recv_fn() thread to be ready.
Use the pthread barrier instead. It is more straightforward and correct.
Fixes: https://github.com/axboe/liburing/issues/855
Reported-by: Barnabás Pőcze <[email protected]>
Signed-off-by: Ammar Faizi <[email protected]>
---
test/recv-msgall.c | 18 +++++++-----------
1 file changed, 7 insertions(+), 11 deletions(-)
diff --git a/test/recv-msgall.c b/test/recv-msgall.c
index f809834b2e427fc5..d1fcdb0d510423e7 100644
--- a/test/recv-msgall.c
+++ b/test/recv-msgall.c
@@ -19,7 +19,7 @@
#define HOST "127.0.0.1"
static __be16 bind_port;
struct recv_data {
- pthread_mutex_t mutex;
+ pthread_barrier_t barrier;
int use_recvmsg;
struct msghdr msg;
};
@@ -122,11 +122,11 @@ static void *recv_fn(void *data)
ret = t_create_ring_params(1, &ring, &p);
if (ret == T_SETUP_SKIP) {
- pthread_mutex_unlock(&rd->mutex);
+ pthread_barrier_wait(&rd->barrier);
ret = 0;
goto err;
} else if (ret < 0) {
- pthread_mutex_unlock(&rd->mutex);
+ pthread_barrier_wait(&rd->barrier);
goto err;
}
@@ -135,7 +135,7 @@ static void *recv_fn(void *data)
fprintf(stderr, "recv_prep failed: %d\n", ret);
goto err;
}
- pthread_mutex_unlock(&rd->mutex);
+ pthread_barrier_wait(&rd->barrier);
ret = do_recv(&ring);
close(sock);
io_uring_queue_exit(&ring);
@@ -219,28 +219,24 @@ err:
static int test(int use_recvmsg)
{
- pthread_mutexattr_t attr;
pthread_t recv_thread;
struct recv_data rd;
int ret;
void *retval;
- pthread_mutexattr_init(&attr);
- pthread_mutexattr_setpshared(&attr, 1);
- pthread_mutex_init(&rd.mutex, &attr);
- pthread_mutex_lock(&rd.mutex);
+ pthread_barrier_init(&rd.barrier, NULL, 2);
rd.use_recvmsg = use_recvmsg;
ret = pthread_create(&recv_thread, NULL, recv_fn, &rd);
if (ret) {
fprintf(stderr, "Thread create failed: %d\n", ret);
- pthread_mutex_unlock(&rd.mutex);
return 1;
}
- pthread_mutex_lock(&rd.mutex);
+ pthread_barrier_wait(&rd.barrier);
do_send();
pthread_join(recv_thread, &retval);
+ pthread_barrier_destroy(&rd.barrier);
return (intptr_t)retval;
}
--
Ammar Faizi
^ permalink raw reply related [flat|nested] 4+ messages in thread