public inbox for [email protected]
 help / color / mirror / Atom feed
From: Ammar Faizi <[email protected]>
To: Jens Axboe <[email protected]>,
	Pavel Begunkov <[email protected]>,
	io-uring Mailing List <[email protected]>
Cc: Bedirhan KURT <[email protected]>,
	Louvian Lyndal <[email protected]>,
	Ammar Faizi <[email protected]>
Subject: [PATCH liburing 1/4] test/thread-exit: Fix use after free bug
Date: Thu,  7 Oct 2021 22:02:07 +0700	[thread overview]
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>

When I added support for nolibc x86-64, I found this test failed.

Long story short, we provide our own `free()` that always unmaps the VM
with `munmap()`. It makes the CQE return -EFAULT because the kernel
reads unmapped user memory from the pending `write()` SQE.

I believe this test can run properly with libc build because `free()`
from libc doesn't always unmap the memory, instead it uses free list on
the userspace and the freed heap may still be userspace addressable.

Fix this by deferring the free.

Cc: Jens Axboe <[email protected]>
Fixes: 2edfa3f84bcc44612b7a04caf1f048f5406fcc7a ("Add test case for thread exiting with pending IO")
Signed-off-by: Ammar Faizi <[email protected]>
---
 test/thread-exit.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/test/thread-exit.c b/test/thread-exit.c
index 7f66028..05509fb 100644
--- a/test/thread-exit.c
+++ b/test/thread-exit.c
@@ -26,8 +26,18 @@ struct d {
 	unsigned long off;
 	int pipe_fd;
 	int err;
+	int i;
 };
 
+char *g_buf[NR_IOS] = {NULL};
+
+static void free_g_buf(void)
+{
+	int i;
+	for (i = 0; i < NR_IOS; i++)
+		free(g_buf[i]);
+}
+
 static void *do_io(void *data)
 {
 	struct d *d = data;
@@ -36,6 +46,7 @@ static void *do_io(void *data)
 	int ret;
 
 	buffer = t_malloc(WSIZE);
+	g_buf[d->i] = buffer;
 	memset(buffer, 0x5a, WSIZE);
 	sqe = io_uring_get_sqe(d->ring);
 	if (!sqe) {
@@ -55,8 +66,6 @@ static void *do_io(void *data)
 	ret = io_uring_submit(d->ring);
 	if (ret != 2)
 		d->err++;
-
-	free(buffer);
 	return NULL;
 }
 
@@ -103,6 +112,7 @@ int main(int argc, char *argv[])
 	d.pipe_fd = fds[0];
 	d.err = 0;
 	for (i = 0; i < NR_IOS; i++) {
+		d.i = i;
 		memset(&thread, 0, sizeof(thread));
 		pthread_create(&thread, NULL, do_io, &d);
 		pthread_join(thread, NULL);
@@ -125,7 +135,9 @@ int main(int argc, char *argv[])
 		io_uring_cqe_seen(&ring, cqe);
 	}
 
+	free_g_buf();
 	return d.err;
 err:
+	free_g_buf();
 	return 1;
 }
-- 
2.30.2


  reply	other threads:[~2021-10-07 15:03 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-10-06 14:49 [PATCHSET v1 RFC liburing 0/6] Add no libc support for x86-64 arch Ammar Faizi
2021-10-06 14:49 ` [PATCH v1 RFC liburing 1/6] configure: Add LIBURING_NOLIBC variable Ammar Faizi
2021-10-06 14:49 ` [PATCH v1 RFC liburing 2/6] Add no libc support Ammar Faizi
2021-10-06 14:49 ` [PATCH v1 RFC liburing 3/6] Add x86-64 no libc build support Ammar Faizi
2021-10-06 14:49 ` [PATCH v1 RFC liburing 4/6] test/cq-size: Don't use `errno` to check liburing's functions Ammar Faizi
2021-10-06 14:49 ` [PATCH v1 RFC liburing 5/6] test/{iopoll,read-write}: Use `io_uring_free_probe()` instead of `free()` Ammar Faizi
2021-10-06 14:49 ` [PATCH v1 RFC liburing 6/6] src/{queue,register,setup}: Clean up unused includes Ammar Faizi
2021-10-06 18:47 ` [PATCHSET v1 RFC liburing 0/6] Add no libc support for x86-64 arch Jens Axboe
2021-10-06 22:20   ` Ammar Faizi
2021-10-06 22:23     ` Jens Axboe
2021-10-07  6:31       ` [PATCHSET v2 RFC liburing 0/5] " Ammar Faizi
2021-10-07  6:31         ` [PATCH v2 RFC liburing 1/5] test/{iopoll,read-write}: Use `io_uring_free_probe()` instead of `free()` Ammar Faizi
2021-10-07 12:25           ` Jens Axboe
2021-10-07  6:31         ` [PATCH v2 RFC liburing 2/5] test/cq-size: Don't use `errno` to check liburing's functions Ammar Faizi
2021-10-07 12:25           ` Jens Axboe
2021-10-07  6:31         ` [PATCH v2 RFC liburing 3/5] Add arch dependent directory and files Ammar Faizi
2021-10-07  6:31         ` [PATCH v2 RFC liburing 4/5] Add no libc build support Ammar Faizi
2021-10-07 12:27           ` Jens Axboe
2021-10-07 13:01             ` Ammar Faizi
2021-10-07  6:31         ` [PATCH v2 RFC liburing 5/5] Add LIBURING_NOLIBC variable and edit src/Makefile Ammar Faizi
2021-10-07 15:02         ` [PATCHSET liburing 0/4] Add no libc support for x86-64 arch Ammar Faizi
2021-10-07 15:02           ` Ammar Faizi [this message]
2021-10-07 15:02           ` [PATCH liburing 2/4] Add arch dependent directory and files Ammar Faizi
2021-10-07 15:02           ` [PATCH liburing 3/4] Add no libc build support Ammar Faizi
2021-10-07 15:02           ` [PATCH liburing 4/4] Add LIBURING_NOLIBC variable and edit src/Makefile Ammar Faizi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211007150210.1390189-2-ammar.faizi@students.amikom.ac.id \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    [email protected] \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox