diff options
| author | Ammar Faizi <ammarfaizi2@gnuweeb.org> | 2022-01-07 20:02:18 +0700 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2022-01-09 09:47:16 -0700 |
| commit | 3f10277e6412d56cb52424d07f685128112498fa (patch) | |
| tree | 8247ff05a584bd13ca19f9497766356f992f840e | |
| parent | e5bb9f3e65f0e18132b27ba0322e2419d87f4f92 (diff) | |
| download | liburing-3f10277e6412d56cb52424d07f685128112498fa.tar.gz liburing-3f10277e6412d56cb52424d07f685128112498fa.tar.bz2 | |
test/socket-rw-offset: Fix UB, accessing dead object
Dereference to a local variable that has been out of its scope is
undefined behavior, it may contain garbage or the compiler may
reuse it for other local variables.
Fix this by moving the struct iov variable declarations so their
lifetime is extended.
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Hrvoje Zeba <zeba.hrvoje@gmail.com>
Fixes: 03be3e4fbddd491ef0426b6f9c9085a168acc1c4 ("Add test case for socket read with offset == -1")
Signed-off-by: Ammar Faizi <ammarfaizi2@gnuweeb.org>
Link: https://lore.kernel.org/r/20220107130218.1238910-4-ammarfaizi2@gnuweeb.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | test/socket-rw-offset.c | 17 |
1 files changed, 7 insertions, 10 deletions
diff --git a/test/socket-rw-offset.c b/test/socket-rw-offset.c index fe6ace3..987b6c9 100644 --- a/test/socket-rw-offset.c +++ b/test/socket-rw-offset.c @@ -27,6 +27,7 @@ int main(int argc, char *argv[]) int32_t recv_s0; int32_t val = 1; struct sockaddr_in addr; + struct iovec iov_r[1], iov_w[1]; if (argc > 1) return 0; @@ -108,27 +109,23 @@ int main(int argc, char *argv[]) char send_buff[128]; { - struct iovec iov[1]; - - iov[0].iov_base = recv_buff; - iov[0].iov_len = sizeof(recv_buff); + iov_r[0].iov_base = recv_buff; + iov_r[0].iov_len = sizeof(recv_buff); struct io_uring_sqe* sqe = io_uring_get_sqe(&m_io_uring); assert(sqe != NULL); - io_uring_prep_readv(sqe, p_fd[0], iov, 1, -1); + io_uring_prep_readv(sqe, p_fd[0], iov_r, 1, -1); } { - struct iovec iov[1]; - - iov[0].iov_base = send_buff; - iov[0].iov_len = sizeof(send_buff); + iov_w[0].iov_base = send_buff; + iov_w[0].iov_len = sizeof(send_buff); struct io_uring_sqe* sqe = io_uring_get_sqe(&m_io_uring); assert(sqe != NULL); - io_uring_prep_writev(sqe, p_fd[1], iov, 1, 0); + io_uring_prep_writev(sqe, p_fd[1], iov_w, 1, 0); } ret = io_uring_submit_and_wait(&m_io_uring, 2); |