Re: [PATCH liburing] test/sqe-mixed-boundary: validate physical SQE index for 128-byte ops

[Jens Axboe <axboe@kernel.dk>]

On 3/9/26 11:20 PM, Tom Ryan wrote:
> +/*
> + * Negative test: NOP128 at the last physical SQE slot via sq_array remap
> + * must be rejected. Without the kernel fix, this triggers a 64-byte OOB
> + * read in io_uring_cmd_sqe_copy().
> + */
> +static int test_oob_boundary(void)
> +{
> +	struct io_uring ring;
> +	struct io_uring_cqe *cqe;
> +	struct io_uring_sqe *sqe;
> +	unsigned mask;
> +	int ret, i, found;
> +
> +	ret = io_uring_queue_init(NENTRIES, &ring, IORING_SETUP_SQE_MIXED);
> +	if (ret) {
> +		if (ret == -EINVAL)
> +			return T_EXIT_SKIP;
> +		fprintf(stderr, "ring init: %d\n", ret);
> +		return T_EXIT_FAIL;
> +	}

I don't think this will work, because this function requires the sqe
redirection array and liburing will wrap the above in SETUP_NO_SQARRAY.
Is this some llm written test case, or conversion of a raw use case? Did
you actually try and run the test case?

You can certainly make it work, you'd have to use
__io_uring_queue_init_params() to accomplish the setting up of the ring
without IORING_SETUP_NO_SQARRAY.

> +	found = 0;
> +	for (i = 0; i < 3; i++) {
> +		ret = io_uring_wait_cqe(&ring, &cqe);
> +		if (ret)
> +			break;
> +		if (cqe->user_data == 2) {
> +			if (cqe->res != -EINVAL) {
> +				fprintf(stderr,
> +					"NOP128 at last slot: expected -EINVAL, got %d\n",
> +					cqe->res);
> +				io_uring_cqe_seen(&ring, cqe);
> +				goto fail;
> +			}
> +			found = 1;
> +		}
> +		io_uring_cqe_seen(&ring, cqe);
> +	}

This one puzzles me too - you submit 2 SQEs, yet you wait for 3. This
will just sit forever until killed by the test suite timeout.

-- 
Jens Axboe