diff options
| author | Ammar Faizi <ammarfaizi2@gnuweeb.org> | 2022-01-07 20:02:16 +0700 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2022-01-09 09:47:16 -0700 |
| commit | 5ee4feeac88d42c8c4cadee1f242279ff5fc0277 (patch) | |
| tree | a3c814f99b09934395713465dba5be73654e1f88 | |
| parent | 918d8061ffdfdf253806a1e8e141c71644e678bd (diff) | |
| download | liburing-5ee4feeac88d42c8c4cadee1f242279ff5fc0277.tar.gz liburing-5ee4feeac88d42c8c4cadee1f242279ff5fc0277.tar.bz2 | |
test/socket-rw-eagain: Fix UB, accessing dead object
Dereference to a local variable that has been out of its scope is
undefined behavior, it may contain garbage or the compiler may
reuse it for other local variables.
Fix this by moving the struct iov variable declarations so their
lifetime is extended.
Cc: Jens Axboe <axboe@kernel.dk>
Fixes: 76e3b7921fee98a5627cd270628b6a5160d3857d ("Add nonblock empty socket read test")
Signed-off-by: Ammar Faizi <ammarfaizi2@gnuweeb.org>
Link: https://lore.kernel.org/r/20220107130218.1238910-2-ammarfaizi2@gnuweeb.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | test/socket-rw-eagain.c | 17 |
1 files changed, 7 insertions, 10 deletions
diff --git a/test/socket-rw-eagain.c b/test/socket-rw-eagain.c index 9854e00..2d6a817 100644 --- a/test/socket-rw-eagain.c +++ b/test/socket-rw-eagain.c @@ -25,6 +25,7 @@ int main(int argc, char *argv[]) int32_t recv_s0; int32_t val = 1; struct sockaddr_in addr; + struct iovec iov_r[1], iov_w[1]; if (argc > 1) return 0; @@ -105,28 +106,24 @@ int main(int argc, char *argv[]) char send_buff[128]; { - struct iovec iov[1]; - - iov[0].iov_base = recv_buff; - iov[0].iov_len = sizeof(recv_buff); + iov_r[0].iov_base = recv_buff; + iov_r[0].iov_len = sizeof(recv_buff); struct io_uring_sqe* sqe = io_uring_get_sqe(&m_io_uring); assert(sqe != NULL); - io_uring_prep_readv(sqe, p_fd[0], iov, 1, 0); + io_uring_prep_readv(sqe, p_fd[0], iov_r, 1, 0); sqe->user_data = 1; } { - struct iovec iov[1]; - - iov[0].iov_base = send_buff; - iov[0].iov_len = sizeof(send_buff); + iov_w[0].iov_base = send_buff; + iov_w[0].iov_len = sizeof(send_buff); struct io_uring_sqe* sqe = io_uring_get_sqe(&m_io_uring); assert(sqe != NULL); - io_uring_prep_writev(sqe, p_fd[1], iov, 1, 0); + io_uring_prep_writev(sqe, p_fd[1], iov_w, 1, 0); sqe->user_data = 2; } |