From patchwork Wed May 10 14:39:26 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ammar Faizi X-Patchwork-Id: 13236977 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF1FFC77B7D for ; Wed, 10 May 2023 14:40:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237484AbjEJOkX (ORCPT ); Wed, 10 May 2023 10:40:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43940 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237479AbjEJOkT (ORCPT ); Wed, 10 May 2023 10:40:19 -0400 Received: from gnuweeb.org (gnuweeb.org [51.81.211.47]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8F97A86B9; Wed, 10 May 2023 07:40:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gnuweeb.org; s=default; t=1683729613; bh=koxG1YCExChvSpEVnSP+x7jAE+o8CIdHy2OpuhUjaJg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=X+qHB8fvNCw86u2Cujt2PHfki8wfPRHo4zgUTEq//5z1JDq17dYGK3uB7vP5e0S0R Bge8beofZdAA74v47nAg84hxdELO/93OMfR3OG5PNoqppBsiIcijmNimfN3jysxa87 lu5FLpbOjJhh3kXyehlDc1p8aEZHux8VbSj4ijeu7UFCqIJOHnw5NdE0C/20R+puGn 6Jr8KlS/oesyVLJlzV4fcHynNp1il8G3FbBwHNj9Duq1ErXXYIAOLLBtdCPPmvvhP8 zHsG0wDAKtJfXuc9IB2hx+czdDR+gOk5Zk/jT2aaSLVXjRR2Is2ZcANP0e6FcT/4dI fkScEkT1F/XHQ== Received: from integral2.. (unknown [101.128.114.135]) by gnuweeb.org (Postfix) with ESMTPSA id C6E48245CF5; Wed, 10 May 2023 21:40:10 +0700 (WIB) From: Ammar Faizi To: Jens Axboe Cc: Ammar Faizi , =?utf-8?q?Barnab=C3=A1s_P=C5=91cz?= =?utf-8?q?e?= , Michael William Jonathan , Linux Kernel Mailing List , io-uring Mailing List , GNU/Weeb Mailing List Subject: [PATCH liburing v1 1/2] recv-msgall: Fix undefined behavior in `recv_prep()` Date: Wed, 10 May 2023 21:39:26 +0700 Message-Id: <20230510143927.123170-2-ammarfaizi2@gnuweeb.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230510143927.123170-1-ammarfaizi2@gnuweeb.org> References: <20230510143927.123170-1-ammarfaizi2@gnuweeb.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: io-uring@vger.kernel.org The lifetime of `struct msghdr msg;` must be long enough until the CQE is generated because the recvmsg operation will write to that storage. I found this test segfault when compiling with -O0 optimization. This is undefined behavior and may behave randomly. Fix this by making the lifetime of `struct msghdr msg;` long enough. Fixes: https://github.com/axboe/liburing/issues/855 Signed-off-by: Ammar Faizi --- test/recv-msgall.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/test/recv-msgall.c b/test/recv-msgall.c index ae123e4c381b2b1a..f809834b2e427fc5 100644 --- a/test/recv-msgall.c +++ b/test/recv-msgall.c @@ -18,14 +18,18 @@ #define MAX_MSG 128 #define HOST "127.0.0.1" static __be16 bind_port; +struct recv_data { + pthread_mutex_t mutex; + int use_recvmsg; + struct msghdr msg; +}; static int recv_prep(struct io_uring *ring, struct iovec *iov, int *sock, - int use_recvmsg) + struct recv_data *rd) { struct sockaddr_in saddr; struct io_uring_sqe *sqe; int sockfd, ret, val; - struct msghdr msg = { }; memset(&saddr, 0, sizeof(saddr)); saddr.sin_family = AF_INET; @@ -47,14 +51,17 @@ static int recv_prep(struct io_uring *ring, struct iovec *iov, int *sock, bind_port = saddr.sin_port; sqe = io_uring_get_sqe(ring); - if (!use_recvmsg) { + if (!rd->use_recvmsg) { io_uring_prep_recv(sqe, sockfd, iov->iov_base, iov->iov_len, MSG_WAITALL); } else { - msg.msg_namelen = sizeof(struct sockaddr_in); - msg.msg_iov = iov; - msg.msg_iovlen = 1; - io_uring_prep_recvmsg(sqe, sockfd, &msg, MSG_WAITALL); + struct msghdr *msg = &rd->msg; + + memset(msg, 0, sizeof(*msg)); + msg->msg_namelen = sizeof(struct sockaddr_in); + msg->msg_iov = iov; + msg->msg_iovlen = 1; + io_uring_prep_recvmsg(sqe, sockfd, msg, MSG_WAITALL); } sqe->user_data = 2; @@ -101,11 +108,6 @@ err: return 1; } -struct recv_data { - pthread_mutex_t mutex; - int use_recvmsg; -}; - static void *recv_fn(void *data) { struct recv_data *rd = data; @@ -128,7 +130,7 @@ static void *recv_fn(void *data) goto err; } - ret = recv_prep(&ring, &iov, &sock, rd->use_recvmsg); + ret = recv_prep(&ring, &iov, &sock, rd); if (ret) { fprintf(stderr, "recv_prep failed: %d\n", ret); goto err; From patchwork Wed May 10 14:39:27 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Ammar Faizi X-Patchwork-Id: 13236978 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0679DC77B7C for ; Wed, 10 May 2023 14:40:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237518AbjEJOk1 (ORCPT ); Wed, 10 May 2023 10:40:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43926 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237111AbjEJOkW (ORCPT ); Wed, 10 May 2023 10:40:22 -0400 Received: from gnuweeb.org (gnuweeb.org [51.81.211.47]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 552A86EB5; Wed, 10 May 2023 07:40:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gnuweeb.org; s=default; t=1683729615; bh=SKIms/x8UkuCSr7MMpMwCUwu5UFRx/RZRLA+rEglAko=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=jZseRr+FoEyBwmEDpOSOuV1XqLGTpFkp1YdWeGNopmPeGlzWr+noMhhYkVGLQNh3t 4UsvxDcUNQ5HXZZ7Sy/uoPqRg0fLJuIHMmL0UU/3CAYhAwyohY6O/b/5qNVLaOsuZY wjhMsT8NASw5rWXUj6PPGo9iS0Va3Vi2NusYDoOEFIGi1J0RXwxDFO6SH5Cqr6llv2 yRXVxl59iYbuDsvrxKCnqAKB81J6o0cmRUQo0fKBaVN8xTZeXQZF5Yj2Co+tkCFI7M +ifDSBzTkmRGiRBL6QdyHiSWyfjL29BjyFJw+ypvllEQv/nsEjshIN0PZGK3g30KEx kGzk4Cd/aI+DA== Received: from integral2.. (unknown [101.128.114.135]) by gnuweeb.org (Postfix) with ESMTPSA id B13FE245CF1; Wed, 10 May 2023 21:40:13 +0700 (WIB) From: Ammar Faizi To: Jens Axboe Cc: Ammar Faizi , =?utf-8?q?Barnab=C3=A1s_P=C5=91cz?= =?utf-8?q?e?= , Michael William Jonathan , Linux Kernel Mailing List , io-uring Mailing List , GNU/Weeb Mailing List Subject: [PATCH liburing v1 2/2] recv-msgall: Fix invalid mutex usage Date: Wed, 10 May 2023 21:39:27 +0700 Message-Id: <20230510143927.123170-3-ammarfaizi2@gnuweeb.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230510143927.123170-1-ammarfaizi2@gnuweeb.org> References: <20230510143927.123170-1-ammarfaizi2@gnuweeb.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: io-uring@vger.kernel.org Calling pthread_mutex_lock() twice with the same mutex in the same thread without unlocking it first is invalid. The intention behind this pattern was to wait for the recv_fn() thread to be ready. Use the pthread barrier instead. It is more straightforward and correct. Fixes: https://github.com/axboe/liburing/issues/855 Reported-by: Barnabás Pőcze Signed-off-by: Ammar Faizi --- test/recv-msgall.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/test/recv-msgall.c b/test/recv-msgall.c index f809834b2e427fc5..d1fcdb0d510423e7 100644 --- a/test/recv-msgall.c +++ b/test/recv-msgall.c @@ -19,7 +19,7 @@ #define HOST "127.0.0.1" static __be16 bind_port; struct recv_data { - pthread_mutex_t mutex; + pthread_barrier_t barrier; int use_recvmsg; struct msghdr msg; }; @@ -122,11 +122,11 @@ static void *recv_fn(void *data) ret = t_create_ring_params(1, &ring, &p); if (ret == T_SETUP_SKIP) { - pthread_mutex_unlock(&rd->mutex); + pthread_barrier_wait(&rd->barrier); ret = 0; goto err; } else if (ret < 0) { - pthread_mutex_unlock(&rd->mutex); + pthread_barrier_wait(&rd->barrier); goto err; } @@ -135,7 +135,7 @@ static void *recv_fn(void *data) fprintf(stderr, "recv_prep failed: %d\n", ret); goto err; } - pthread_mutex_unlock(&rd->mutex); + pthread_barrier_wait(&rd->barrier); ret = do_recv(&ring); close(sock); io_uring_queue_exit(&ring); @@ -219,28 +219,24 @@ err: static int test(int use_recvmsg) { - pthread_mutexattr_t attr; pthread_t recv_thread; struct recv_data rd; int ret; void *retval; - pthread_mutexattr_init(&attr); - pthread_mutexattr_setpshared(&attr, 1); - pthread_mutex_init(&rd.mutex, &attr); - pthread_mutex_lock(&rd.mutex); + pthread_barrier_init(&rd.barrier, NULL, 2); rd.use_recvmsg = use_recvmsg; ret = pthread_create(&recv_thread, NULL, recv_fn, &rd); if (ret) { fprintf(stderr, "Thread create failed: %d\n", ret); - pthread_mutex_unlock(&rd.mutex); return 1; } - pthread_mutex_lock(&rd.mutex); + pthread_barrier_wait(&rd.barrier); do_send(); pthread_join(recv_thread, &retval); + pthread_barrier_destroy(&rd.barrier); return (intptr_t)retval; }