summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAmmar Faizi <ammarfaizi2@gnuweeb.org>2022-01-07 20:02:17 +0700
committerJens Axboe <axboe@kernel.dk>2022-01-09 09:47:16 -0700
commite5bb9f3e65f0e18132b27ba0322e2419d87f4f92 (patch)
tree1e8ae3a3a746d146983edec31185f75b0aea6213
parent5ee4feeac88d42c8c4cadee1f242279ff5fc0277 (diff)
downloadliburing-e5bb9f3e65f0e18132b27ba0322e2419d87f4f92.tar.gz
liburing-e5bb9f3e65f0e18132b27ba0322e2419d87f4f92.tar.bz2
test/socket-rw: Fix UB, accessing dead object
Dereference to a local variable that has been out of its scope is undefined behavior, it may contain garbage or the compiler may reuse it for other local variables. Fix this by moving the struct iov variable declarations so their lifetime is extended. Cc: Jens Axboe <axboe@kernel.dk> Cc: Hrvoje Zeba <zeba.hrvoje@gmail.com> Fixes: 79ba71a4881fb1cd300520553d7285b3c5ee1293 ("Add deadlock socket read/write test case") Signed-off-by: Ammar Faizi <ammarfaizi2@gnuweeb.org> Link: https://lore.kernel.org/r/20220107130218.1238910-3-ammarfaizi2@gnuweeb.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
-rw-r--r--test/socket-rw.c17
1 files changed, 7 insertions, 10 deletions
diff --git a/test/socket-rw.c b/test/socket-rw.c
index 5afd14d..4fbf032 100644
--- a/test/socket-rw.c
+++ b/test/socket-rw.c
@@ -27,6 +27,7 @@ int main(int argc, char *argv[])
int32_t recv_s0;
int32_t val = 1;
struct sockaddr_in addr;
+ struct iovec iov_r[1], iov_w[1];
if (argc > 1)
return 0;
@@ -103,27 +104,23 @@ int main(int argc, char *argv[])
char send_buff[128];
{
- struct iovec iov[1];
-
- iov[0].iov_base = recv_buff;
- iov[0].iov_len = sizeof(recv_buff);
+ iov_r[0].iov_base = recv_buff;
+ iov_r[0].iov_len = sizeof(recv_buff);
struct io_uring_sqe* sqe = io_uring_get_sqe(&m_io_uring);
assert(sqe != NULL);
- io_uring_prep_readv(sqe, p_fd[0], iov, 1, 0);
+ io_uring_prep_readv(sqe, p_fd[0], iov_r, 1, 0);
}
{
- struct iovec iov[1];
-
- iov[0].iov_base = send_buff;
- iov[0].iov_len = sizeof(send_buff);
+ iov_w[0].iov_base = send_buff;
+ iov_w[0].iov_len = sizeof(send_buff);
struct io_uring_sqe* sqe = io_uring_get_sqe(&m_io_uring);
assert(sqe != NULL);
- io_uring_prep_writev(sqe, p_fd[1], iov, 1, 0);
+ io_uring_prep_writev(sqe, p_fd[1], iov_w, 1, 0);
}
ret = io_uring_submit_and_wait(&m_io_uring, 2);