1 /* SPDX-License-Identifier: MIT */
2 /*
3 * Description: Check to see if the asan checks catch an stack-use-after-free for io_uring_sqe_set_data
4 */
5
6 #include <stdio.h>
7 #include <errno.h>
8 #include <sys/socket.h>
9 #include <sys/un.h>
10 #include <assert.h>
11 #include <stdlib.h>
12 #include "liburing.h"
13 #include "helpers.h"
14
15 #include <stdio.h>
16
17 #define BUFFERS 8
18 #define BUFFER_SIZE 128
19
main(int argc,char * argv[])20 int main(int argc, char *argv[])
21 {
22 struct io_uring ring;
23 struct iovec *iovs;
24 int i;
25 int ret;
26
27 if (argc > 1)
28 return T_EXIT_SKIP;
29
30 ret = io_uring_queue_init(8, &ring, 0);
31 if (ret < 0) {
32 printf("io_uring_queue_init ret %i\n", ret);
33 return T_EXIT_PASS; // this test expects an inverted exit code
34 }
35
36 iovs = calloc(BUFFERS, sizeof(struct iovec));
37 for (i = 0; i < BUFFERS; i++) {
38 iovs[i].iov_base = malloc(BUFFER_SIZE);
39 iovs[i].iov_len = BUFFER_SIZE;
40 }
41 // force one iov_base to be freed, test "passes" if asan catches this bug.
42 free(iovs[4].iov_base);
43
44 ret = io_uring_register_buffers(&ring, iovs, BUFFERS);
45 printf("io_uring_register_buffers %i\n", ret);
46
47 ret = io_uring_submit_and_wait(&ring, 1);
48 printf("submit_and_wait %i\n", ret);
49
50 return T_EXIT_PASS; // this test expects an inverted exit code
51 }
52