polyphony 0.85 → 0.86

data/vendor/liburing/test/defer.c

@@ -0,0 +1,307 @@
+/* SPDX-License-Identifier: MIT */
+#include <errno.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <fcntl.h>
+#include <sys/uio.h>
+#include <stdbool.h>
+
+#include "helpers.h"
+#include "liburing.h"
+
+#define RING_SIZE 128
+
+struct test_context {
+	struct io_uring *ring;
+	struct io_uring_sqe **sqes;
+	struct io_uring_cqe *cqes;
+	int nr;
+};
+
+static void free_context(struct test_context *ctx)
+{
+	free(ctx->sqes);
+	free(ctx->cqes);
+	memset(ctx, 0, sizeof(*ctx));
+}
+
+static int init_context(struct test_context *ctx, struct io_uring *ring, int nr)
+{
+	struct io_uring_sqe *sqe;
+	int i;
+
+	memset(ctx, 0, sizeof(*ctx));
+	ctx->nr = nr;
+	ctx->ring = ring;
+	ctx->sqes = t_malloc(nr * sizeof(*ctx->sqes));
+	ctx->cqes = t_malloc(nr * sizeof(*ctx->cqes));
+
+	if (!ctx->sqes || !ctx->cqes)
+		goto err;
+
+	for (i = 0; i < nr; i++) {
+		sqe = io_uring_get_sqe(ring);
+		if (!sqe)
+			goto err;
+		io_uring_prep_nop(sqe);
+		sqe->user_data = i;
+		ctx->sqes[i] = sqe;
+	}
+
+	return 0;
+err:
+	free_context(ctx);
+	printf("init context failed\n");
+	return 1;
+}
+
+static int wait_cqes(struct test_context *ctx)
+{
+	int ret, i;
+	struct io_uring_cqe *cqe;
+
+	for (i = 0; i < ctx->nr; i++) {
+		ret = io_uring_wait_cqe(ctx->ring, &cqe);
+
+		if (ret < 0) {
+			printf("wait_cqes: wait completion %d\n", ret);
+			return 1;
+		}
+		memcpy(&ctx->cqes[i], cqe, sizeof(*cqe));
+		io_uring_cqe_seen(ctx->ring, cqe);
+	}
+
+	return 0;
+}
+
+static int test_cancelled_userdata(struct io_uring *ring)
+{
+	struct test_context ctx;
+	int ret, i, nr = 100;
+
+	if (init_context(&ctx, ring, nr))
+		return 1;
+
+	for (i = 0; i < nr; i++)
+		ctx.sqes[i]->flags |= IOSQE_IO_LINK;
+
+	ret = io_uring_submit(ring);
+	if (ret <= 0) {
+		printf("sqe submit failed: %d\n", ret);
+		goto err;
+	}
+
+	if (wait_cqes(&ctx))
+		goto err;
+
+	for (i = 0; i < nr; i++) {
+		if (i != ctx.cqes[i].user_data) {
+			printf("invalid user data\n");
+			goto err;
+		}
+	}
+
+	free_context(&ctx);
+	return 0;
+err:
+	free_context(&ctx);
+	return 1;
+}
+
+static int test_thread_link_cancel(struct io_uring *ring)
+{
+	struct test_context ctx;
+	int ret, i, nr = 100;
+
+	if (init_context(&ctx, ring, nr))
+		return 1;
+
+	for (i = 0; i < nr; i++)
+		ctx.sqes[i]->flags |= IOSQE_IO_LINK;
+
+	ret = io_uring_submit(ring);
+	if (ret <= 0) {
+		printf("sqe submit failed: %d\n", ret);
+		goto err;
+	}
+
+	if (wait_cqes(&ctx))
+		goto err;
+
+	for (i = 0; i < nr; i++) {
+		bool fail = false;
+
+		if (i == 0)
+			fail = (ctx.cqes[i].res != -EINVAL);
+		else
+			fail = (ctx.cqes[i].res != -ECANCELED);
+
+		if (fail) {
+			printf("invalid status\n");
+			goto err;
+		}
+	}
+
+	free_context(&ctx);
+	return 0;
+err:
+	free_context(&ctx);
+	return 1;
+}
+
+static int test_drain_with_linked_timeout(struct io_uring *ring)
+{
+	const int nr = 3;
+	struct __kernel_timespec ts = { .tv_sec = 1, .tv_nsec = 0, };
+	struct test_context ctx;
+	int ret, i;
+
+	if (init_context(&ctx, ring, nr * 2))
+		return 1;
+
+	for (i = 0; i < nr; i++) {
+		io_uring_prep_timeout(ctx.sqes[2 * i], &ts, 0, 0);
+		ctx.sqes[2 * i]->flags |= IOSQE_IO_LINK | IOSQE_IO_DRAIN;
+		io_uring_prep_link_timeout(ctx.sqes[2 * i + 1], &ts, 0);
+	}
+
+	ret = io_uring_submit(ring);
+	if (ret <= 0) {
+		printf("sqe submit failed: %d\n", ret);
+		goto err;
+	}
+
+	if (wait_cqes(&ctx))
+		goto err;
+
+	free_context(&ctx);
+	return 0;
+err:
+	free_context(&ctx);
+	return 1;
+}
+
+static int run_drained(struct io_uring *ring, int nr)
+{
+	struct test_context ctx;
+	int ret, i;
+
+	if (init_context(&ctx, ring, nr))
+		return 1;
+
+	for (i = 0; i < nr; i++)
+		ctx.sqes[i]->flags |= IOSQE_IO_DRAIN;
+
+	ret = io_uring_submit(ring);
+	if (ret <= 0) {
+		printf("sqe submit failed: %d\n", ret);
+		goto err;
+	}
+
+	if (wait_cqes(&ctx))
+		goto err;
+
+	free_context(&ctx);
+	return 0;
+err:
+	free_context(&ctx);
+	return 1;
+}
+
+static int test_overflow_hung(struct io_uring *ring)
+{
+	struct io_uring_sqe *sqe;
+	int ret, nr = 10;
+
+	while (*ring->cq.koverflow != 1000) {
+		sqe = io_uring_get_sqe(ring);
+		if (!sqe) {
+			printf("get sqe failed\n");
+			return 1;
+		}
+
+		io_uring_prep_nop(sqe);
+		ret = io_uring_submit(ring);
+		if (ret <= 0) {
+			printf("sqe submit failed: %d\n", ret);
+			return 1;
+		}
+	}
+
+	return run_drained(ring, nr);
+}
+
+static int test_dropped_hung(struct io_uring *ring)
+{
+	int nr = 10;
+
+	*ring->sq.kdropped = 1000;
+	return run_drained(ring, nr);
+}
+
+int main(int argc, char *argv[])
+{
+	struct io_uring ring, poll_ring, sqthread_ring;
+	struct io_uring_params p;
+	int ret;
+
+	if (argc > 1)
+		return 0;
+
+	memset(&p, 0, sizeof(p));
+	ret = io_uring_queue_init_params(RING_SIZE, &ring, &p);
+	if (ret) {
+		printf("ring setup failed %i\n", ret);
+		return 1;
+	}
+
+	ret = io_uring_queue_init(RING_SIZE, &poll_ring, IORING_SETUP_IOPOLL);
+	if (ret) {
+		printf("poll_ring setup failed\n");
+		return 1;
+	}
+
+
+	ret = test_cancelled_userdata(&poll_ring);
+	if (ret) {
+		printf("test_cancelled_userdata failed\n");
+		return ret;
+	}
+
+	if (!(p.features & IORING_FEAT_NODROP)) {
+		ret = test_overflow_hung(&ring);
+		if (ret) {
+			printf("test_overflow_hung failed\n");
+			return ret;
+		}
+	}
+
+	ret = test_dropped_hung(&ring);
+	if (ret) {
+		printf("test_dropped_hung failed\n");
+		return ret;
+	}
+
+	ret = test_drain_with_linked_timeout(&ring);
+	if (ret) {
+		printf("test_drain_with_linked_timeout failed\n");
+		return ret;
+	}
+
+	ret = t_create_ring(RING_SIZE, &sqthread_ring,
+				IORING_SETUP_SQPOLL | IORING_SETUP_IOPOLL);
+	if (ret == T_SETUP_SKIP)
+		return 0;
+	else if (ret < 0)
+		return 1;
+
+	ret = test_thread_link_cancel(&sqthread_ring);
+	if (ret) {
+		printf("test_thread_link_cancel failed\n");
+		return ret;
+	}
+
+	return 0;
+}

data/vendor/liburing/test/double-poll-crash.c

@@ -0,0 +1,185 @@
+/* SPDX-License-Identifier: MIT */
+// https://syzkaller.appspot.com/bug?id=5c9918d20f771265ad0ffae3c8f3859d24850692
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+
+#include <endian.h>
+#include <fcntl.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <unistd.h>
+
+#include "liburing.h"
+#include "../src/syscall.h"
+
+#define SIZEOF_IO_URING_SQE 64
+#define SIZEOF_IO_URING_CQE 16
+#define SQ_HEAD_OFFSET 0
+#define SQ_TAIL_OFFSET 64
+#define SQ_RING_MASK_OFFSET 256
+#define SQ_RING_ENTRIES_OFFSET 264
+#define SQ_FLAGS_OFFSET 276
+#define SQ_DROPPED_OFFSET 272
+#define CQ_HEAD_OFFSET 128
+#define CQ_TAIL_OFFSET 192
+#define CQ_RING_MASK_OFFSET 260
+#define CQ_RING_ENTRIES_OFFSET 268
+#define CQ_RING_OVERFLOW_OFFSET 284
+#define CQ_FLAGS_OFFSET 280
+#define CQ_CQES_OFFSET 320
+
+static long syz_io_uring_setup(volatile long a0, volatile long a1,
+                               volatile long a2, volatile long a3,
+                               volatile long a4, volatile long a5)
+{
+  uint32_t entries = (uint32_t)a0;
+  struct io_uring_params* setup_params = (struct io_uring_params*)a1;
+  void* vma1 = (void*)a2;
+  void* vma2 = (void*)a3;
+  void** ring_ptr_out = (void**)a4;
+  void** sqes_ptr_out = (void**)a5;
+  uint32_t fd_io_uring = __sys_io_uring_setup(entries, setup_params);
+  uint32_t sq_ring_sz =
+      setup_params->sq_off.array + setup_params->sq_entries * sizeof(uint32_t);
+  uint32_t cq_ring_sz = setup_params->cq_off.cqes +
+                        setup_params->cq_entries * SIZEOF_IO_URING_CQE;
+  uint32_t ring_sz = sq_ring_sz > cq_ring_sz ? sq_ring_sz : cq_ring_sz;
+  *ring_ptr_out = mmap(vma1, ring_sz, PROT_READ | PROT_WRITE,
+                       MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring,
+                       IORING_OFF_SQ_RING);
+  uint32_t sqes_sz = setup_params->sq_entries * SIZEOF_IO_URING_SQE;
+  *sqes_ptr_out =
+      mmap(vma2, sqes_sz, PROT_READ | PROT_WRITE,
+           MAP_SHARED | MAP_POPULATE | MAP_FIXED, fd_io_uring, IORING_OFF_SQES);
+  return fd_io_uring;
+}
+
+static long syz_io_uring_submit(volatile long a0, volatile long a1,
+                                volatile long a2, volatile long a3)
+{
+  char* ring_ptr = (char*)a0;
+  char* sqes_ptr = (char*)a1;
+  char* sqe = (char*)a2;
+  uint32_t sqes_index = (uint32_t)a3;
+  uint32_t sq_ring_entries = *(uint32_t*)(ring_ptr + SQ_RING_ENTRIES_OFFSET);
+  uint32_t cq_ring_entries = *(uint32_t*)(ring_ptr + CQ_RING_ENTRIES_OFFSET);
+  uint32_t sq_array_off =
+      (CQ_CQES_OFFSET + cq_ring_entries * SIZEOF_IO_URING_CQE + 63) & ~63;
+  if (sq_ring_entries)
+    sqes_index %= sq_ring_entries;
+  char* sqe_dest = sqes_ptr + sqes_index * SIZEOF_IO_URING_SQE;
+  memcpy(sqe_dest, sqe, SIZEOF_IO_URING_SQE);
+  uint32_t sq_ring_mask = *(uint32_t*)(ring_ptr + SQ_RING_MASK_OFFSET);
+  uint32_t* sq_tail_ptr = (uint32_t*)(ring_ptr + SQ_TAIL_OFFSET);
+  uint32_t sq_tail = *sq_tail_ptr & sq_ring_mask;
+  uint32_t sq_tail_next = *sq_tail_ptr + 1;
+  uint32_t* sq_array = (uint32_t*)(ring_ptr + sq_array_off);
+  *(sq_array + sq_tail) = sqes_index;
+  __atomic_store_n(sq_tail_ptr, sq_tail_next, __ATOMIC_RELEASE);
+  return 0;
+}
+
+static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
+{
+  if (a0 == 0xc || a0 == 0xb) {
+    char buf[128];
+    sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1,
+            (uint8_t)a2);
+    return open(buf, O_RDWR, 0);
+  } else {
+    char buf[1024];
+    char* hash;
+    strncpy(buf, (char*)a0, sizeof(buf) - 1);
+    buf[sizeof(buf) - 1] = 0;
+    while ((hash = strchr(buf, '#'))) {
+      *hash = '0' + (char)(a1 % 10);
+      a1 /= 10;
+    }
+    return open(buf, a2, 0);
+  }
+}
+
+uint64_t r[4] = {0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff};
+
+int main(int argc, char *argv[])
+{
+#if !defined(__i386) && !defined(__x86_64__)
+  return 0;
+#endif
+
+  if (argc > 1)
+    return 0;
+
+  mmap((void *)0x20000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
+  mmap((void *)0x21000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
+  intptr_t res = 0;
+  *(uint32_t*)0x20000484 = 0;
+  *(uint32_t*)0x20000488 = 0;
+  *(uint32_t*)0x2000048c = 0;
+  *(uint32_t*)0x20000490 = 0;
+  *(uint32_t*)0x20000498 = -1;
+  *(uint32_t*)0x2000049c = 0;
+  *(uint32_t*)0x200004a0 = 0;
+  *(uint32_t*)0x200004a4 = 0;
+  res = -1;
+  res = syz_io_uring_setup(0x6ad4, 0x20000480, 0x20ee7000, 0x20ffb000,
+                           0x20000180, 0x20000040);
+  if (res != -1) {
+    r[0] = res;
+    r[1] = *(uint64_t*)0x20000180;
+    r[2] = *(uint64_t*)0x20000040;
+  }
+  res = -1;
+  res = syz_open_dev(0xc, 4, 0x15);
+  if (res != -1)
+    r[3] = res;
+  *(uint8_t*)0x20000000 = 6;
+  *(uint8_t*)0x20000001 = 0;
+  *(uint16_t*)0x20000002 = 0;
+  *(uint32_t*)0x20000004 = r[3];
+  *(uint64_t*)0x20000008 = 0;
+  *(uint64_t*)0x20000010 = 0;
+  *(uint32_t*)0x20000018 = 0;
+  *(uint16_t*)0x2000001c = 0;
+  *(uint16_t*)0x2000001e = 0;
+  *(uint64_t*)0x20000020 = 0;
+  *(uint16_t*)0x20000028 = 0;
+  *(uint16_t*)0x2000002a = 0;
+  *(uint8_t*)0x2000002c = 0;
+  *(uint8_t*)0x2000002d = 0;
+  *(uint8_t*)0x2000002e = 0;
+  *(uint8_t*)0x2000002f = 0;
+  *(uint8_t*)0x20000030 = 0;
+  *(uint8_t*)0x20000031 = 0;
+  *(uint8_t*)0x20000032 = 0;
+  *(uint8_t*)0x20000033 = 0;
+  *(uint8_t*)0x20000034 = 0;
+  *(uint8_t*)0x20000035 = 0;
+  *(uint8_t*)0x20000036 = 0;
+  *(uint8_t*)0x20000037 = 0;
+  *(uint8_t*)0x20000038 = 0;
+  *(uint8_t*)0x20000039 = 0;
+  *(uint8_t*)0x2000003a = 0;
+  *(uint8_t*)0x2000003b = 0;
+  *(uint8_t*)0x2000003c = 0;
+  *(uint8_t*)0x2000003d = 0;
+  *(uint8_t*)0x2000003e = 0;
+  *(uint8_t*)0x2000003f = 0;
+  syz_io_uring_submit(r[1], r[2], 0x20000000, 0);
+  __sys_io_uring_enter(r[0], 0x20450c, 0, 0ul, 0ul);
+  *(uint32_t*)0x20000080 = 0x7ff;
+  *(uint32_t*)0x20000084 = 0x8b7;
+  *(uint32_t*)0x20000088 = 3;
+  *(uint32_t*)0x2000008c = 0x101;
+  *(uint8_t*)0x20000090 = 9;
+  memcpy((void*)0x20000091, "\xaf\x09\x01\xbc\xf9\xc6\xe4\x92\x86\x51\x7d\x7f"
+                            "\xbd\x43\x7d\x16\x69\x3e\x05",
+         19);
+  ioctl(r[3], 0x5404, 0x20000080ul);
+  return 0;
+}

data/vendor/liburing/test/drop-submit.c

@@ -0,0 +1,92 @@
+/* SPDX-License-Identifier: MIT */
+/*
+ * Description: test IORING_SETUP_SUBMIT_ALL
+ *
+ */
+#include <errno.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+
+#include "liburing.h"
+
+static int test(struct io_uring *ring, int expect_drops)
+{
+	struct io_uring_sqe *sqe;
+	char buf[32];
+	int ret, i;
+
+	for (i = 0; i < 4; i++) {
+		sqe = io_uring_get_sqe(ring);
+		if (!sqe) {
+			fprintf(stderr, "get sqe failed\n");
+			goto err;
+		}
+
+		io_uring_prep_nop(sqe);
+	}
+
+	/* prep two invalid reads, these will fail */
+	for (i = 0; i < 2; i++) {
+		sqe = io_uring_get_sqe(ring);
+		if (!sqe) {
+			fprintf(stderr, "get sqe failed\n");
+			goto err;
+		}
+
+		io_uring_prep_read(sqe, 128, buf, sizeof(buf), 0);
+	}
+
+
+	ret = io_uring_submit(ring);
+	if (expect_drops) {
+		if (ret != 5) {
+			fprintf(stderr, "drops submit failed: %d\n", ret);
+			goto err;
+		}
+	} else {
+		if (ret != 6) {
+			fprintf(stderr, "no drops submit failed: %d\n", ret);
+			goto err;
+		}
+	}
+
+	return 0;
+err:
+	return 1;
+}
+
+int main(int argc, char *argv[])
+{
+	struct io_uring ring;
+	int ret;
+
+	if (argc > 1)
+		return 0;
+
+	ret = io_uring_queue_init(8, &ring, IORING_SETUP_SUBMIT_ALL);
+	if (ret)
+		return 0;
+
+	ret = test(&ring, 0);
+	if (ret) {
+		fprintf(stderr, "test no drops failed\n");
+		return ret;
+	}
+
+	io_uring_queue_exit(&ring);
+
+	ret = io_uring_queue_init(8, &ring, 0);
+	if (ret) {
+		fprintf(stderr, "ring setup failed\n");
+		return 0;
+	}
+
+	ret = test(&ring, 1);
+	if (ret) {
+		fprintf(stderr, "test drops failed\n");
+		return ret;
+	}
+
+	return 0;
+}

data/vendor/liburing/test/eeed8b54e0df-test.c

@@ -0,0 +1,114 @@
+/* SPDX-License-Identifier: MIT */
+/*
+ * Description: -EAGAIN handling
+ *
+ */
+#include <errno.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <fcntl.h>
+
+#include "helpers.h"
+#include "liburing.h"
+
+#define BLOCK	4096
+
+#ifndef RWF_NOWAIT
+#define RWF_NOWAIT	8
+#endif
+
+static int get_file_fd(void)
+{
+	ssize_t ret;
+	char *buf;
+	int fd;
+
+	fd = open("testfile", O_RDWR | O_CREAT, 0644);
+	unlink("testfile");
+	if (fd < 0) {
+		perror("open file");
+		return -1;
+	}
+
+	buf = t_malloc(BLOCK);
+	ret = write(fd, buf, BLOCK);
+	if (ret != BLOCK) {
+		if (ret < 0)
+			perror("write");
+		else
+			printf("Short write\n");
+		goto err;
+	}
+	fsync(fd);
+
+	if (posix_fadvise(fd, 0, 4096, POSIX_FADV_DONTNEED)) {
+		perror("fadvise");
+err:
+		close(fd);
+		free(buf);
+		return -1;
+	}
+
+	free(buf);
+	return fd;
+}
+
+int main(int argc, char *argv[])
+{
+	struct io_uring ring;
+	struct io_uring_sqe *sqe;
+	struct io_uring_cqe *cqe;
+	struct iovec iov;
+	int ret, fd;
+
+	if (argc > 1)
+		return 0;
+
+	iov.iov_base = t_malloc(4096);
+	iov.iov_len = 4096;
+
+	ret = io_uring_queue_init(2, &ring, 0);
+	if (ret) {
+		printf("ring setup failed\n");
+		return 1;
+
+	}
+
+	sqe = io_uring_get_sqe(&ring);
+	if (!sqe) {
+		printf("get sqe failed\n");
+		return 1;
+	}
+
+	fd = get_file_fd();
+	if (fd < 0)
+		return 1;
+
+	io_uring_prep_readv(sqe, fd, &iov, 1, 0);
+	sqe->rw_flags = RWF_NOWAIT;
+
+	ret = io_uring_submit(&ring);
+	if (ret != 1) {
+		printf("Got submit %d, expected 1\n", ret);
+		goto err;
+	}
+
+	ret = io_uring_peek_cqe(&ring, &cqe);
+	if (ret) {
+		printf("Ring peek got %d\n", ret);
+		goto err;
+	}
+
+	if (cqe->res != -EAGAIN && cqe->res != 4096) {
+		printf("cqe error: %d\n", cqe->res);
+		goto err;
+	}
+
+	close(fd);
+	return 0;
+err:
+	close(fd);
+	return 1;
+}