Re: [PATCH for-next] tests: test async_data double-free with sendzc

[Pavel Begunkov <asml.silence@gmail.com>]

s/for-next/liburing/ in the subject

On 9/26/22 14:33, Pavel Begunkov wrote:
> Similar to send_recv.c:test_invalid().
> 
> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
> ---
>   test/send-zerocopy.c | 59 ++++++++++++++++++++++++++++++++++++++++++--
>   1 file changed, 57 insertions(+), 2 deletions(-)
> 
> diff --git a/test/send-zerocopy.c b/test/send-zerocopy.c
> index 80723de..1c4e5f2 100644
> --- a/test/send-zerocopy.c
> +++ b/test/send-zerocopy.c
> @@ -533,6 +533,55 @@ static bool io_check_zc_sendmsg(struct io_uring *ring)
>   	return p->ops_len > IORING_OP_SENDMSG_ZC;
>   }
>   
> +/* see also send_recv.c:test_invalid */
> +static int test_invalid_zc(void)
> +{
> +	struct io_uring ring;
> +	int ret, fds[2];
> +	struct io_uring_cqe *cqe;
> +	struct io_uring_sqe *sqe;
> +	bool notif = false;
> +
> +	if (!has_sendmsg)
> +		return 0;
> +
> +	ret = t_create_ring(8, &ring, 0);
> +	if (ret)
> +		return ret;
> +	ret = t_create_socket_pair(fds, true);
> +	if (ret)
> +		return ret;
> +
> +	sqe = io_uring_get_sqe(&ring);
> +	io_uring_prep_sendmsg(sqe, fds[0], NULL, MSG_WAITALL);
> +	sqe->opcode = IORING_OP_SENDMSG_ZC;
> +	sqe->flags |= IOSQE_ASYNC;
> +
> +	ret = io_uring_submit(&ring);
> +	if (ret != 1) {
> +		fprintf(stderr, "submit failed %i\n", ret);
> +		return ret;
> +	}
> +	ret = io_uring_wait_cqe(&ring, &cqe);
> +	if (ret)
> +		return 1;
> +	if (cqe->flags & IORING_CQE_F_MORE)
> +		notif = true;
> +	io_uring_cqe_seen(&ring, cqe);
> +
> +	if (notif) {
> +		ret = io_uring_wait_cqe(&ring, &cqe);
> +		if (ret)
> +			return 1;
> +		io_uring_cqe_seen(&ring, cqe);
> +	}
> +
> +	io_uring_queue_exit(&ring);
> +	close(fds[0]);
> +	close(fds[1]);
> +	return 0;
> +}
> +
>   int main(int argc, char *argv[])
>   {
>   	struct io_uring ring;
> @@ -602,7 +651,7 @@ int main(int argc, char *argv[])
>   	ret = test_async_addr(&ring);
>   	if (ret) {
>   		fprintf(stderr, "test_async_addr() failed\n");
> -		return ret;
> +		return T_EXIT_FAIL;
>   	}
>   
>   	ret = t_register_buffers(&ring, buffers_iov, ARRAY_SIZE(buffers_iov));
> @@ -617,7 +666,13 @@ int main(int argc, char *argv[])
>   	ret = test_inet_send(&ring);
>   	if (ret) {
>   		fprintf(stderr, "test_inet_send() failed\n");
> -		return ret;
> +		return T_EXIT_FAIL;
> +	}
> +
> +	ret = test_invalid_zc();
> +	if (ret) {
> +		fprintf(stderr, "test_invalid_zc() failed\n");
> +		return T_EXIT_FAIL;
>   	}
>   out:
>   	io_uring_queue_exit(&ring);

-- 
Pavel Begunkov