1 /* SPDX-License-Identifier: MIT */
2 /*
3 * Description: trigger segfault. A recent 6.4-rc kernel introduced a bug
4 * via vhost where segfaults for applications using io_uring
5 * would hang in D state forever upon trying to generate the
6 * core file. Perform a trivial test where a child process
7 * generates a NULL pointer dereference and ensure that we don't
8 * hang.
9 *
10 */
11 #include <stdio.h>
12 #include <stdlib.h>
13 #include <unistd.h>
14 #include <sys/wait.h>
15
16 #include "liburing.h"
17 #include "helpers.h"
18
19 #ifndef CONFIG_USE_SANITIZER
test(void)20 static void test(void)
21 {
22 struct io_uring_sqe *sqe;
23 struct io_uring ring;
24 int *ptr = NULL;
25 int fds[2];
26 char r1;
27
28 if (pipe(fds) < 0) {
29 perror("pipe");
30 exit(0);
31 }
32
33 io_uring_queue_init(8, &ring, 0);
34
35 sqe = io_uring_get_sqe(&ring);
36 io_uring_prep_read(sqe, fds[0], &r1, sizeof(r1), 0);
37 sqe->flags = IOSQE_ASYNC;
38 sqe->user_data = 1;
39
40 io_uring_submit(&ring);
41 *ptr = 0;
42 exit(0);
43 }
44
main(int argc,char * argv[])45 int main(int argc, char *argv[])
46 {
47 pid_t pid;
48 int wstat;
49
50 pid = fork();
51 if (pid < 0) {
52 perror("fork");
53 return T_EXIT_SKIP;
54 } else if (!pid) {
55 test();
56 }
57
58 wait(&wstat);
59 unlink("core");
60 return T_EXIT_PASS;
61 }
62 #else
main(int argc,char * argv[])63 int main(int argc, char *argv[])
64 {
65 return T_EXIT_SKIP;
66 }
67 #endif
68