iou 0.1

data/vendor/liburing/test/defer-tw-timeout.c

@@ -0,0 +1,173 @@
+/* SPDX-License-Identifier: MIT */
+/*
+ * Description: test waiting for more events than what will be posted with
+ *		a timeout with DEFER_TASKRUN. All kernels should time out,
+ *		but a non-buggy kernel will end up with one CQE available
+ *		for reaping. Buggy kernels will not have processed the
+ *		task_work and will have 0 events.
+ *
+ */
+#include <errno.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <pthread.h>
+
+#include "liburing.h"
+#include "helpers.h"
+
+struct d {
+	int fd;
+};
+
+static void *thread_fn(void *data)
+{
+	struct d *d = data;
+	int ret;
+
+	usleep(100000);
+	ret = write(d->fd, "Hello", 5);
+	if (ret < 0)
+		perror("write");
+	return NULL;
+}
+
+static int test_poll(struct io_uring *ring)
+{
+	struct io_uring_cqe *cqe;
+	struct io_uring_sqe *sqe;
+	struct __kernel_timespec ts;
+	int ret, fds[2], i;
+	pthread_t thread;
+	char buf[32];
+	struct d d;
+	void *tret;
+
+	if (pipe(fds) < 0) {
+		perror("pipe");
+		return 1;
+	}
+	d.fd = fds[1];
+
+	sqe = io_uring_get_sqe(ring);
+	io_uring_prep_read(sqe, fds[0], buf, sizeof(buf), 0);
+
+	pthread_create(&thread, NULL, thread_fn, &d);
+
+	ts.tv_sec = 1;
+	ts.tv_nsec = 0;
+
+	ret = io_uring_submit_and_wait_timeout(ring, &cqe, 2, &ts, NULL);
+	if (ret != 1) {
+		fprintf(stderr, "unexpected wait ret %d\n", ret);
+		return T_EXIT_FAIL;
+	}
+
+	for (i = 0; i < 2; i++) {
+		ret = io_uring_peek_cqe(ring, &cqe);
+		if (ret)
+			break;
+		io_uring_cqe_seen(ring, cqe);
+	}
+
+	if (i != 1) {
+		fprintf(stderr, "Got %d request, expected 1\n", i);
+		return T_EXIT_FAIL;
+	}
+
+	pthread_join(thread, &tret);
+	return T_EXIT_PASS;
+}
+
+static int test_file(struct io_uring *ring, char *__fname)
+{
+	struct io_uring_cqe *cqe;
+	struct io_uring_sqe *sqe;
+	struct __kernel_timespec ts;
+	char filename[64], *fname;
+	int fd, ret, i;
+	void *buf;
+
+	if (!__fname) {
+		fname = filename;
+		sprintf(fname, ".defer-tw-timeout.%d", getpid());
+		t_create_file(fname, 128*1024);
+	} else {
+		fname = __fname;
+	}
+
+	fd = open(fname, O_RDONLY | O_DIRECT);
+	if (fd < 0) {
+		if (errno == EINVAL) {
+			if (!__fname)
+				unlink(fname);
+			return T_EXIT_SKIP;
+		}
+		perror("open");
+		if (!__fname)
+			unlink(fname);
+		return T_EXIT_FAIL;
+	}
+
+	if (!__fname)
+		unlink(fname);
+
+	if (posix_memalign(&buf, 4096, 4096)) {
+		close(fd);
+		return T_EXIT_FAIL;
+	}
+
+	sqe = io_uring_get_sqe(ring);
+	io_uring_prep_read(sqe, fd, buf, 4096, 0);
+
+	ts.tv_sec = 1;
+	ts.tv_nsec = 0;
+
+	ret = io_uring_submit_and_wait_timeout(ring, &cqe, 2, &ts, NULL);
+	if (ret != 1) {
+		fprintf(stderr, "unexpected wait ret %d\n", ret);
+		close(fd);
+		return T_EXIT_FAIL;
+	}
+
+	for (i = 0; i < 2; i++) {
+		ret = io_uring_peek_cqe(ring, &cqe);
+		if (ret)
+			break;
+		io_uring_cqe_seen(ring, cqe);
+	}
+
+	if (i != 1) {
+		fprintf(stderr, "Got %d request, expected 1\n", i);
+		close(fd);
+		return T_EXIT_FAIL;
+	}
+
+	close(fd);
+	return T_EXIT_PASS;
+}
+
+int main(int argc, char *argv[])
+{
+	struct io_uring ring;
+	char *fname = NULL;
+	int ret;
+
+	ret = io_uring_queue_init(8, &ring, IORING_SETUP_SINGLE_ISSUER | IORING_SETUP_DEFER_TASKRUN);
+	if (ret == -EINVAL)
+		return T_EXIT_SKIP;
+
+	if (argc > 1)
+		fname = argv[1];
+
+	ret = test_file(&ring, fname);
+	if (ret != T_EXIT_PASS)
+		return ret;
+
+	ret = test_poll(&ring);
+	if (ret != T_EXIT_PASS)
+		return ret;
+
+	return T_EXIT_PASS;
+}

data/vendor/liburing/test/defer.c

@@ -0,0 +1,319 @@
+/* SPDX-License-Identifier: MIT */
+#include <errno.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <fcntl.h>
+#include <sys/uio.h>
+#include <stdbool.h>
+
+#include "helpers.h"
+#include "liburing.h"
+
+#define RING_SIZE 128
+enum {
+	OP_NOP,
+	OP_REMOVE_BUFFERS
+};
+
+struct test_context {
+	struct io_uring *ring;
+	struct io_uring_sqe **sqes;
+	struct io_uring_cqe *cqes;
+	int nr;
+};
+
+static void free_context(struct test_context *ctx)
+{
+	free(ctx->sqes);
+	free(ctx->cqes);
+	memset(ctx, 0, sizeof(*ctx));
+}
+
+static int init_context(struct test_context *ctx, struct io_uring *ring, int nr,
+			int op)
+{
+	struct io_uring_sqe *sqe;
+	int i;
+
+	memset(ctx, 0, sizeof(*ctx));
+	ctx->nr = nr;
+	ctx->ring = ring;
+	ctx->sqes = t_malloc(nr * sizeof(*ctx->sqes));
+	ctx->cqes = t_malloc(nr * sizeof(*ctx->cqes));
+
+	if (!ctx->sqes || !ctx->cqes)
+		goto err;
+
+	for (i = 0; i < nr; i++) {
+		sqe = io_uring_get_sqe(ring);
+		if (!sqe)
+			goto err;
+		switch (op) {
+		case OP_NOP:
+			io_uring_prep_nop(sqe);
+			break;
+		case OP_REMOVE_BUFFERS:
+			io_uring_prep_remove_buffers(sqe, 10, 1);
+			break;
+		}
+		sqe->user_data = i;
+		ctx->sqes[i] = sqe;
+	}
+
+	return 0;
+err:
+	free_context(ctx);
+	printf("init context failed\n");
+	return 1;
+}
+
+static int wait_cqes(struct test_context *ctx)
+{
+	int ret, i;
+	struct io_uring_cqe *cqe;
+
+	for (i = 0; i < ctx->nr; i++) {
+		ret = io_uring_wait_cqe(ctx->ring, &cqe);
+
+		if (ret < 0) {
+			printf("wait_cqes: wait completion %d\n", ret);
+			return 1;
+		}
+		memcpy(&ctx->cqes[i], cqe, sizeof(*cqe));
+		io_uring_cqe_seen(ctx->ring, cqe);
+	}
+
+	return 0;
+}
+
+static int test_canceled_userdata(struct io_uring *ring)
+{
+	struct test_context ctx;
+	int ret, i, nr = 100;
+
+	if (init_context(&ctx, ring, nr, OP_NOP))
+		return 1;
+
+	for (i = 0; i < nr; i++)
+		ctx.sqes[i]->flags |= IOSQE_IO_LINK;
+
+	ret = io_uring_submit(ring);
+	if (ret <= 0) {
+		printf("sqe submit failed: %d\n", ret);
+		goto err;
+	}
+
+	if (wait_cqes(&ctx))
+		goto err;
+
+	for (i = 0; i < nr; i++) {
+		if (i != ctx.cqes[i].user_data) {
+			printf("invalid user data\n");
+			goto err;
+		}
+	}
+
+	free_context(&ctx);
+	return 0;
+err:
+	free_context(&ctx);
+	return 1;
+}
+
+static int test_thread_link_cancel(struct io_uring *ring)
+{
+	struct test_context ctx;
+	int ret, i, nr = 100;
+
+	if (init_context(&ctx, ring, nr, OP_REMOVE_BUFFERS))
+		return 1;
+
+	for (i = 0; i < nr; i++)
+		ctx.sqes[i]->flags |= IOSQE_IO_LINK;
+
+	ret = io_uring_submit(ring);
+	if (ret <= 0) {
+		printf("sqe submit failed: %d\n", ret);
+		goto err;
+	}
+
+	if (wait_cqes(&ctx))
+		goto err;
+
+	for (i = 0; i < nr; i++) {
+		bool fail = false;
+
+		if (i == 0)
+			fail = (ctx.cqes[i].res != -ENOENT);
+		else
+			fail = (ctx.cqes[i].res != -ECANCELED);
+
+		if (fail) {
+			printf("invalid status %d\n", ctx.cqes[i].res);
+			goto err;
+		}
+	}
+
+	free_context(&ctx);
+	return 0;
+err:
+	free_context(&ctx);
+	return 1;
+}
+
+static int test_drain_with_linked_timeout(struct io_uring *ring)
+{
+	const int nr = 3;
+	struct __kernel_timespec ts = { .tv_sec = 1, .tv_nsec = 0, };
+	struct test_context ctx;
+	int ret, i;
+
+	if (init_context(&ctx, ring, nr * 2, OP_NOP))
+		return 1;
+
+	for (i = 0; i < nr; i++) {
+		io_uring_prep_timeout(ctx.sqes[2 * i], &ts, 0, 0);
+		ctx.sqes[2 * i]->flags |= IOSQE_IO_LINK | IOSQE_IO_DRAIN;
+		io_uring_prep_link_timeout(ctx.sqes[2 * i + 1], &ts, 0);
+	}
+
+	ret = io_uring_submit(ring);
+	if (ret <= 0) {
+		printf("sqe submit failed: %d\n", ret);
+		goto err;
+	}
+
+	if (wait_cqes(&ctx))
+		goto err;
+
+	free_context(&ctx);
+	return 0;
+err:
+	free_context(&ctx);
+	return 1;
+}
+
+static int run_drained(struct io_uring *ring, int nr)
+{
+	struct test_context ctx;
+	int ret, i;
+
+	if (init_context(&ctx, ring, nr, OP_NOP))
+		return 1;
+
+	for (i = 0; i < nr; i++)
+		ctx.sqes[i]->flags |= IOSQE_IO_DRAIN;
+
+	ret = io_uring_submit(ring);
+	if (ret <= 0) {
+		printf("sqe submit failed: %d\n", ret);
+		goto err;
+	}
+
+	if (wait_cqes(&ctx))
+		goto err;
+
+	free_context(&ctx);
+	return 0;
+err:
+	free_context(&ctx);
+	return 1;
+}
+
+static int test_overflow_hung(struct io_uring *ring)
+{
+	struct io_uring_sqe *sqe;
+	int ret, nr = 10;
+
+	while (*ring->cq.koverflow != 1000) {
+		sqe = io_uring_get_sqe(ring);
+		if (!sqe) {
+			printf("get sqe failed\n");
+			return 1;
+		}
+
+		io_uring_prep_nop(sqe);
+		ret = io_uring_submit(ring);
+		if (ret <= 0) {
+			printf("sqe submit failed: %d\n", ret);
+			return 1;
+		}
+	}
+
+	return run_drained(ring, nr);
+}
+
+static int test_dropped_hung(struct io_uring *ring)
+{
+	int nr = 10;
+
+	*ring->sq.kdropped = 1000;
+	return run_drained(ring, nr);
+}
+
+int main(int argc, char *argv[])
+{
+	struct io_uring ring, poll_ring, sqthread_ring;
+	struct io_uring_params p;
+	int ret;
+
+	if (argc > 1)
+		return T_EXIT_SKIP;
+
+	memset(&p, 0, sizeof(p));
+	ret = io_uring_queue_init_params(RING_SIZE, &ring, &p);
+	if (ret) {
+		printf("ring setup failed %i\n", ret);
+		return T_EXIT_FAIL;
+	}
+
+	ret = io_uring_queue_init(RING_SIZE, &poll_ring, IORING_SETUP_IOPOLL);
+	if (ret) {
+		printf("poll_ring setup failed\n");
+		return T_EXIT_FAIL;
+	}
+
+
+	ret = test_canceled_userdata(&poll_ring);
+	if (ret) {
+		printf("test_canceled_userdata failed\n");
+		return ret;
+	}
+
+	if (!(p.features & IORING_FEAT_NODROP)) {
+		ret = test_overflow_hung(&ring);
+		if (ret) {
+			printf("test_overflow_hung failed\n");
+			return ret;
+		}
+	}
+
+	ret = test_dropped_hung(&ring);
+	if (ret) {
+		printf("test_dropped_hung failed\n");
+		return ret;
+	}
+
+	ret = test_drain_with_linked_timeout(&ring);
+	if (ret) {
+		printf("test_drain_with_linked_timeout failed\n");
+		return ret;
+	}
+
+	ret = t_create_ring(RING_SIZE, &sqthread_ring,
+				IORING_SETUP_SQPOLL | IORING_SETUP_IOPOLL);
+	if (ret == T_SETUP_SKIP)
+		return T_EXIT_SKIP;
+	else if (ret < 0)
+		return T_EXIT_FAIL;
+
+	ret = test_thread_link_cancel(&sqthread_ring);
+	if (ret) {
+		printf("test_thread_link_cancel failed\n");
+		return ret;
+	}
+
+	return T_EXIT_PASS;
+}

data/vendor/liburing/test/double-poll-crash.c

@@ -0,0 +1,195 @@
+/* SPDX-License-Identifier: MIT */
+// https://syzkaller.appspot.com/bug?id=5c9918d20f771265ad0ffae3c8f3859d24850692
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+
+#include <endian.h>
+#include <fcntl.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <unistd.h>
+
+#include "liburing.h"
+#include "helpers.h"
+#include "../src/syscall.h"
+
+#define SIZEOF_IO_URING_SQE 64
+#define SIZEOF_IO_URING_CQE 16
+#define SQ_HEAD_OFFSET 0
+#define SQ_TAIL_OFFSET 64
+#define SQ_RING_MASK_OFFSET 256
+#define SQ_RING_ENTRIES_OFFSET 264
+#define SQ_FLAGS_OFFSET 276
+#define SQ_DROPPED_OFFSET 272
+#define CQ_HEAD_OFFSET 128
+#define CQ_TAIL_OFFSET 192
+#define CQ_RING_MASK_OFFSET 260
+#define CQ_RING_ENTRIES_OFFSET 268
+#define CQ_RING_OVERFLOW_OFFSET 284
+#define CQ_FLAGS_OFFSET 280
+#define CQ_CQES_OFFSET 320
+
+static long syz_io_uring_setup(volatile long a0, volatile long a1,
+                               volatile long a2, volatile long a3,
+                               volatile long a4, volatile long a5)
+{
+  uint32_t entries = (uint32_t)a0;
+  struct io_uring_params* setup_params = (struct io_uring_params*)a1;
+  void* vma1 = (void*)a2;
+  void* vma2 = (void*)a3;
+  void** ring_ptr_out = (void**)a4;
+  void** sqes_ptr_out = (void**)a5;
+  uint32_t fd_io_uring = __sys_io_uring_setup(entries, setup_params);
+  uint32_t sq_ring_sz =
+      setup_params->sq_off.array + setup_params->sq_entries * sizeof(uint32_t);
+  uint32_t cq_ring_sz = setup_params->cq_off.cqes +
+                        setup_params->cq_entries * SIZEOF_IO_URING_CQE;
+  uint32_t ring_sz = sq_ring_sz > cq_ring_sz ? sq_ring_sz : cq_ring_sz;
+  *ring_ptr_out = mmap(vma1, ring_sz, PROT_READ | PROT_WRITE,
+                       MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring,
+                       IORING_OFF_SQ_RING);
+  if (*ring_ptr_out == MAP_FAILED)
+    exit(0);
+  uint32_t sqes_sz = setup_params->sq_entries * SIZEOF_IO_URING_SQE;
+  *sqes_ptr_out =
+      mmap(vma2, sqes_sz, PROT_READ | PROT_WRITE,
+           MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQES);
+  if (*sqes_ptr_out == MAP_FAILED)
+    exit(0);
+  return fd_io_uring;
+}
+
+static long syz_io_uring_submit(volatile long a0, volatile long a1,
+                                volatile long a2, volatile long a3)
+{
+  char* ring_ptr = (char*)a0;
+  char* sqes_ptr = (char*)a1;
+  char* sqe = (char*)a2;
+  uint32_t sqes_index = (uint32_t)a3;
+  uint32_t sq_ring_entries = *(uint32_t*)(ring_ptr + SQ_RING_ENTRIES_OFFSET);
+  uint32_t cq_ring_entries = *(uint32_t*)(ring_ptr + CQ_RING_ENTRIES_OFFSET);
+  uint32_t sq_array_off =
+      (CQ_CQES_OFFSET + cq_ring_entries * SIZEOF_IO_URING_CQE + 63) & ~63;
+  if (sq_ring_entries)
+    sqes_index %= sq_ring_entries;
+  char* sqe_dest = sqes_ptr + sqes_index * SIZEOF_IO_URING_SQE;
+  memcpy(sqe_dest, sqe, SIZEOF_IO_URING_SQE);
+  uint32_t sq_ring_mask = *(uint32_t*)(ring_ptr + SQ_RING_MASK_OFFSET);
+  uint32_t* sq_tail_ptr = (uint32_t*)(ring_ptr + SQ_TAIL_OFFSET);
+  uint32_t sq_tail = *sq_tail_ptr & sq_ring_mask;
+  uint32_t sq_tail_next = *sq_tail_ptr + 1;
+  uint32_t* sq_array = (uint32_t*)(ring_ptr + sq_array_off);
+  *(sq_array + sq_tail) = sqes_index;
+  __atomic_store_n(sq_tail_ptr, sq_tail_next, __ATOMIC_RELEASE);
+  return 0;
+}
+
+static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
+{
+  if (a0 == 0xc || a0 == 0xb) {
+    char buf[128];
+    sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
+            (uint8_t)a2);
+    return open(buf, O_RDWR, 0);
+  } else {
+    char buf[1024];
+    char* hash;
+    strncpy(buf, (char*)a0, sizeof(buf) - 1);
+    buf[sizeof(buf) - 1] = 0;
+    while ((hash = strchr(buf, '#'))) {
+      *hash = '0' + (char)(a1 % 10);
+      a1 /= 10;
+    }
+    return open(buf, a2, 0);
+  }
+}
+
+static uint64_t r[4] = {0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff};
+
+int main(int argc, char *argv[])
+{
+  void *mmap_ret;
+#if !defined(__i386) && !defined(__x86_64__)
+  return T_EXIT_SKIP;
+#endif
+
+  if (argc > 1)
+    return T_EXIT_SKIP;
+
+  mmap_ret = mmap((void *)0x20000000ul, 0x1000000ul, 7ul, MAP_ANON|MAP_PRIVATE, -1, 0ul);
+  if (mmap_ret == MAP_FAILED)
+    return T_EXIT_SKIP;
+  mmap_ret = mmap((void *)0x21000000ul, 0x1000ul, 0ul, MAP_ANON|MAP_PRIVATE, -1, 0ul);
+  if (mmap_ret == MAP_FAILED)
+    return T_EXIT_SKIP;
+  intptr_t res = 0;
+  *(uint32_t*)0x20000484 = 0;
+  *(uint32_t*)0x20000488 = 0;
+  *(uint32_t*)0x2000048c = 0;
+  *(uint32_t*)0x20000490 = 0;
+  *(uint32_t*)0x20000498 = -1;
+  *(uint32_t*)0x2000049c = 0;
+  *(uint32_t*)0x200004a0 = 0;
+  *(uint32_t*)0x200004a4 = 0;
+  res = -1;
+  res = syz_io_uring_setup(0x6ad4, 0x20000480, 0x20ee7000, 0x20ffb000,
+                           0x20000180, 0x20000040);
+  if (res != -1) {
+    r[0] = res;
+    r[1] = *(uint64_t*)0x20000180;
+    r[2] = *(uint64_t*)0x20000040;
+  }
+  res = -1;
+  res = syz_open_dev(0xc, 4, 0x15);
+  if (res != -1)
+    r[3] = res;
+  *(uint8_t*)0x20000000 = 6;
+  *(uint8_t*)0x20000001 = 0;
+  *(uint16_t*)0x20000002 = 0;
+  *(uint32_t*)0x20000004 = r[3];
+  *(uint64_t*)0x20000008 = 0;
+  *(uint64_t*)0x20000010 = 0;
+  *(uint32_t*)0x20000018 = 0;
+  *(uint16_t*)0x2000001c = 0;
+  *(uint16_t*)0x2000001e = 0;
+  *(uint64_t*)0x20000020 = 0;
+  *(uint16_t*)0x20000028 = 0;
+  *(uint16_t*)0x2000002a = 0;
+  *(uint8_t*)0x2000002c = 0;
+  *(uint8_t*)0x2000002d = 0;
+  *(uint8_t*)0x2000002e = 0;
+  *(uint8_t*)0x2000002f = 0;
+  *(uint8_t*)0x20000030 = 0;
+  *(uint8_t*)0x20000031 = 0;
+  *(uint8_t*)0x20000032 = 0;
+  *(uint8_t*)0x20000033 = 0;
+  *(uint8_t*)0x20000034 = 0;
+  *(uint8_t*)0x20000035 = 0;
+  *(uint8_t*)0x20000036 = 0;
+  *(uint8_t*)0x20000037 = 0;
+  *(uint8_t*)0x20000038 = 0;
+  *(uint8_t*)0x20000039 = 0;
+  *(uint8_t*)0x2000003a = 0;
+  *(uint8_t*)0x2000003b = 0;
+  *(uint8_t*)0x2000003c = 0;
+  *(uint8_t*)0x2000003d = 0;
+  *(uint8_t*)0x2000003e = 0;
+  *(uint8_t*)0x2000003f = 0;
+  syz_io_uring_submit(r[1], r[2], 0x20000000, 0);
+  __sys_io_uring_enter(r[0], 0x20450c, 0, 0ul, 0ul);
+  *(uint32_t*)0x20000080 = 0x7ff;
+  *(uint32_t*)0x20000084 = 0x8b7;
+  *(uint32_t*)0x20000088 = 3;
+  *(uint32_t*)0x2000008c = 0x101;
+  *(uint8_t*)0x20000090 = 9;
+  memcpy((void*)0x20000091, "\xaf\x09\x01\xbc\xf9\xc6\xe4\x92\x86\x51\x7d\x7f"
+                            "\xbd\x43\x7d\x16\x69\x3e\x05",
+         19);
+  ioctl(r[3], 0x5404, 0x20000080ul);
+  return T_EXIT_PASS;
+}