Thread (6 messages) 6 messages, 3 authors, 2025-07-09

Re: [PATCH net-next v4] vsock/test: Add test for null ptr deref when transport changes

From: Konstantin Shkolnyy <hidden>
Date: 2025-07-09 19:03:14
Also in: lkml, virtualization

On 09-Jul-25 10:41, Stefano Garzarella wrote:
On Wed, 9 Jul 2025 at 17:26, Stefano Garzarella [off-list ref] wrote:
quoted
On Wed, 9 Jul 2025 at 16:54, Konstantin Shkolnyy [off-list ref] wrote:
quoted
I'm seeing a problem on s390 with the new "SOCK_STREAM transport change
null-ptr-deref" test. Here is how it appears to happen:

test_stream_transport_change_client() spins for 2s and sends 70K+
CONTROL_CONTINUE messages to the "control" socket.

test_stream_transport_change_server() spins calling accept() because it
keeps receiving CONTROL_CONTINUE.

When the client exits, the server has received just under 1K of those
70K CONTROL_CONTINUE, so it calls accept() again but the client has
exited, so accept() never returns and the server never exits.
Just to be clear, I was seeing something a bit different.
The accept() in the server is no-blocking, since we set O_NONBLOCK on
the socket, so I see the server looping around a failing accept()
(errno == EAGAIN) while dequeueing the CONTROL_CONTINUE messages, so
after 10/15 seconds the server ends on my case.

It seems strange that in your case it blocks, since it should be a
no-blocking call.
It was my mistake. The accept() doesn't block. I've retested it more 
carefully and it keeps returning and the loop eventually consumes all 
queued CONTROL_CONTINUE messages and quits, as you described.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help