All of lore.kernel.org
 help / color / mirror / Atom feed
From: Gabriel Krisman Bertazi <krisman@suse.de>
To: axboe@kernel.dk
Cc: io-uring@vger.kernel.org, Gabriel Krisman Bertazi <krisman@suse.de>
Subject: [PATCH liburing 2/2] test/recv-msgall-stream: Preserve msghdr until op_recvmsg completes
Date: Wed, 22 Jul 2026 14:17:10 -0400	[thread overview]
Message-ID: <20260722181710.79099-3-krisman@suse.de> (raw)
In-Reply-To: <20260722181710.79099-1-krisman@suse.de>

msghdr is allocated on the stack at recv_prep, which means it may go out
of scope before the kernel has a chance to complete the operation.  This
results in spurious test failures when we reach far enough into recv_fn
to reuse the stack space before op_recvmsg executes.  I found it easily
reproducible when compiling with '-O0 -g3' to avoid gcc from optimizing
further local variables out of the stack.

Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
---
 test/recv-msgall-stream.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/test/recv-msgall-stream.c b/test/recv-msgall-stream.c
index ff9fd2a2..a056a6e8 100644
--- a/test/recv-msgall-stream.c
+++ b/test/recv-msgall-stream.c
@@ -74,10 +74,9 @@ err:
 }
 
 static int recv_prep(struct io_uring *ring, struct iovec *iov, int *sock,
-		     struct recv_data *rd)
+		     struct recv_data *rd, struct msghdr *msg)
 {
 	struct io_uring_sqe *sqe;
-	struct msghdr msg = { };
 	int sockfd, sockout = -1, ret;
 
 	sockfd = get_conn_sock(rd, &sockout);
@@ -89,10 +88,10 @@ static int recv_prep(struct io_uring *ring, struct iovec *iov, int *sock,
 		io_uring_prep_recv(sqe, sockfd, iov->iov_base, iov->iov_len,
 					MSG_WAITALL);
 	} else {
-		msg.msg_namelen = sizeof(struct sockaddr_in);
-		msg.msg_iov = iov;
-		msg.msg_iovlen = 1;
-		io_uring_prep_recvmsg(sqe, sockfd, &msg, MSG_WAITALL);
+		msg->msg_namelen = sizeof(struct sockaddr_in);
+		msg->msg_iov = iov;
+		msg->msg_iovlen = 1;
+		io_uring_prep_recvmsg(sqe, sockfd, msg, MSG_WAITALL);
 	}
 
 	sqe->user_data = 2;
@@ -198,6 +197,7 @@ static int recv_uring(struct recv_data *rd)
 		.iov_base = buf,
 		.iov_len = sizeof(buf),
 	};
+	struct msghdr msg;
 	struct io_uring_params p = { };
 	struct io_uring ring;
 	int ret, sock = -1, sockout = -1;
@@ -212,7 +212,7 @@ static int recv_uring(struct recv_data *rd)
 		goto err;
 	}
 
-	sock = recv_prep(&ring, &iov, &sockout, rd);
+	sock = recv_prep(&ring, &iov, &sockout, rd, &msg);
 	if (ret) {
 		fprintf(stderr, "recv_prep failed: %d\n", ret);
 		goto err;
-- 
2.54.0


      parent reply	other threads:[~2026-07-22 18:17 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-22 18:17 [PATCH liburing 0/2] Fix op_recv stack corruption Gabriel Krisman Bertazi
2026-07-22 18:17 ` [PATCH liburing 1/2] test/send_recvmsg: Preserve msghdr until op_recvmsg completes Gabriel Krisman Bertazi
2026-07-22 18:24   ` Gabriel Krisman Bertazi
2026-07-22 19:21   ` Jens Axboe
2026-07-22 20:00     ` Gabriel Krisman Bertazi
2026-07-22 20:33       ` Gabriel Krisman Bertazi
2026-07-22 18:17 ` Gabriel Krisman Bertazi [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260722181710.79099-3-krisman@suse.de \
    --to=krisman@suse.de \
    --cc=axboe@kernel.dk \
    --cc=io-uring@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.