Memory access violation when using io_uring_submit_and_wait_reg()

[lichrot]

I'm sorry for the mistakes I'm probably gonna make in this issue in advance, as I'm currently learning C and I'm still very new to Linux programming, in general.

When trying to use the io_uring_submit_and_wait_reg() function, given a properly setup timer and zero submitted SQEs, everything works fine. But as soon as I try to submit SQEs, I get a SIGSEGV error, specifically when not enough (or zero) SQEs have been completed before the deadline, triggering the timeout. It took me a good while to figure out what's wrong, but after stepping through in the debugger, I've found that a particular branch in the internal _io_uring_get_cqe() function tries to access memory that is... not memory at all. I'm not sure as to the specifics of this issue, but I was able to find that the culprit was this line:

// src/queue.c:106
		if (looped && data->has_ts) {
			struct io_uring_getevents_arg *arg = data->arg;

			if (!cqe && arg->ts && !err) // <== arg->ts is illegal here
				err = -ETIME;
			break;
		}

After some further digging up and down the call stack, I've found that the data->arg member field in this particular case is set not to an address, but to an offset (i.e. regular non-address integer):

// src/queue.c:338
int io_uring_submit_and_wait_reg(struct io_uring *ring,
				 struct io_uring_cqe **cqe_ptr,
				 unsigned wait_nr, int reg_index)
{
	unsigned long offset = reg_index * sizeof(struct io_uring_reg_wait);

	struct get_data data = {
		.submit		= __io_uring_flush_sq(ring),
		.wait_nr	= wait_nr,
		.get_flags	= IORING_ENTER_EXT_ARG | IORING_ENTER_EXT_ARG_REG,
		.sz		= sizeof(struct io_uring_reg_wait),
		.has_ts		= true,
		.arg		= (void *) (uintptr_t) offset, // <== Here's the offset being casted to an address
	};

	if (!(ring->features & IORING_FEAT_EXT_ARG))
		return -EINVAL;

	return _io_uring_get_cqe(ring, cqe_ptr, &data);
}

I was able to "fix" this by just removing the arg->ts check, but this most assuredly wrong:

// src/queue.c:106
		if (looped && data->has_ts) {
			struct io_uring_getevents_arg *arg = data->arg;

			if (!cqe && !err) // <== arg->ts is removed
				err = -ETIME;
			break;
		}

Is it indeed a bug, or is my liburing-jutsu lacking?

[lichrot]

Here's the code I used to narrow down the issue:

#include <stdio.h>
#include <stdint.h>
#include <stddef.h>
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
#include <time.h>

#include <unistd.h>
#include <signal.h>
#include <sys/mman.h>
#include <sys/signalfd.h>

#include "liburing.h"

typedef int8_t    i8;
typedef int16_t   i16;
typedef int32_t   i32;
typedef int64_t   i64;
typedef uint8_t   u8;
typedef uint16_t  u16;
typedef uint32_t  u32;
typedef uint64_t  u64;
typedef float     f32;
typedef double    f64;
typedef ptrdiff_t isize;
typedef size_t    usize;

#ifndef NDEBUG
  [[noreturn, gnu::cold, gnu::format(printf, 4, 5)]]
  void xxx_assert_xxx(
    const char *restrict file,
    u32 line,
    const char *restrict condition,
    const char *restrict fmt,
    ...
  ) {
    fprintf(
      stderr,
      "\n[ASSERT FAILED] at %s:%u\nCondition: %s\nMessage: ",
      file,
      line,
      condition
    );

    va_list args;
    va_start(args, fmt);
    vfprintf(stderr, fmt, args);
    va_end(args);
    fprintf(stderr, "\n");

    exit(1);
    unreachable();
  }

  #define ASSERT(condition, ...) do { if (!(condition)) [[clang::unlikely]] { xxx_assert_xxx(__FILE__, __LINE__, #condition, __VA_ARGS__); } } while (false)
#else
  #define ASSERT(condition, ...) __builtin_assume(condition)
#endif

const u32 COUNT = 64;

int main() {
  const i32 page_size = getpagesize();

  struct io_uring ring = {0};
  {
    const i32 result = io_uring_queue_init(COUNT, &ring, IORING_SETUP_COOP_TASKRUN | IORING_SETUP_SINGLE_ISSUER | IORING_SETUP_DEFER_TASKRUN | IORING_SETUP_R_DISABLED);
    ASSERT(result >= 0, "Ring setup failed\ncode: %d\nmessage: %s", -result, strerror(-result));
  }

  struct __kernel_timespec *ts = nullptr;
  {
    struct io_uring_reg_wait *reg = mmap(nullptr, page_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
    ASSERT(reg > 0, "Memory region allocation failed\ncode: %d\nmessage: %s", errno, strerror(errno));
    reg->flags = IORING_REG_WAIT_TS;
    ts = &reg->ts;

    struct io_uring_region_desc region_desc = {0};
    region_desc.user_addr = (u64)reg;
    region_desc.size = page_size;
    region_desc.flags = IORING_MEM_REGION_TYPE_USER;

    struct io_uring_mem_region_reg region_reg = {0};
    region_reg.region_uptr = (u64)&region_desc;
    region_reg.flags = IORING_MEM_REGION_REG_WAIT_ARG;

    const i32 result = io_uring_register_region(&ring, &region_reg);
    ASSERT(result >= 0, "Memory region registration failed\ncode: %d\nmessage: %s", -result, strerror(-result));
  }

  {
    const i32 result = io_uring_enable_rings(&ring);
    ASSERT(result >= 0, "Ring failed to be enabled\ncode: %d\nmessage: %s", -result, strerror(-result));
  }

  {
    static const i32 signals[] = { SIGHUP, SIGINT, SIGTERM, SIGPIPE, SIGWINCH, SIGTSTP };

    sigset_t mask;
    sigemptyset(&mask);
    for (size_t idx = 0; idx < (sizeof(signals) / sizeof(i32)); idx++)
      sigaddset(&mask, signals[idx]);

    const i32 spm_result = sigprocmask(SIG_BLOCK, &mask, nullptr);
    ASSERT(spm_result >= 0, "Couldn't block signals\ncode: %d\nmessage: %s", errno, strerror(errno));

    const i32 signal_fd = signalfd(-1, &mask, SFD_NONBLOCK);
    ASSERT(signal_fd >= 0, "Couldn't open signal file descriptor\ncode: %d\nmessage: %s", errno, strerror(errno));

    const i32 iurf_result = io_uring_register_files(&ring, &signal_fd, 1);
    ASSERT(iurf_result >= 0, "FD registration failed\ncode: %d\nmessage: %s", -iurf_result, strerror(-iurf_result));
  }

  // struct signalfd_siginfo *buffer = mmap(nullptr, page_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  struct signalfd_siginfo buffer[6];
  {
    struct iovec vec = { .iov_base = buffer, .iov_len = page_size };
    const i32 result = io_uring_register_buffers(&ring, &vec, 1);
    ASSERT(result >= 0, "Buffer registration failed\ncode: %d\nmessage: %s", -result, strerror(-result));
  }

  {
    struct io_uring_sqe *sqe = io_uring_get_sqe(&ring);
    sqe->flags = IOSQE_FIXED_FILE;
    sqe->user_data = 0;
    io_uring_prep_read_fixed(sqe, 0, buffer, page_size, 0, 0);
  }

  {
    struct timespec start = {0};
    clock_gettime(CLOCK_MONOTONIC, &start);
    *ts = *(struct __kernel_timespec *)&start;
    ts->tv_sec += 60;

    struct io_uring_cqe *cqe = nullptr;
    const i32 result = io_uring_submit_and_wait_reg_abs(&ring, &cqe, COUNT, 0);
    ASSERT(result == -ETIME || result > 0, "Error submitting and waiting on ring\ncode: %d\nmessage: %s", -result, strerror(-result));

    struct timespec end = {0};
    clock_gettime(CLOCK_MONOTONIC, &end);
    const u64 end_time = end.tv_nsec + (u64)end.tv_sec * (u64)10e9;
    const u64 start_time = start.tv_nsec + (u64)start.tv_sec * (u64)10e9;
    const u64 diff_time = end_time - start_time;
    printf("Wait time: %lu seconds %lu nanoseconds\n", (diff_time / (u64)10e9), (diff_time % (u64)10e9));
  }

  {
    u32 head;
    u32 cqe_count = 0;
    struct io_uring_cqe *cqe;

    io_uring_for_each_cqe(&ring, head, cqe) {
      if (cqe->res < 0) {
        printf("CQE #%d error\ncode: %d\nmessage: %s\n", cqe_count, -cqe->res, strerror(-cqe->res));
      } else {
        printf("CQE #%d cool\ndata: %llu\n", cqe_count, cqe->user_data);
        if (cqe->user_data == 0) {
          for (usize idx = 0; idx < 6; idx++) {
            printf("Signal #%zu\nnumber: %d\nmessage: %s\n", idx, buffer[idx].ssi_signo, strsignal(buffer[idx].ssi_signo));
          }
        }
      }
      cqe_count += 1;
    }

    io_uring_cq_advance(&ring, cqe_count);
  }

  io_uring_queue_exit(&ring);
  printf("!!! Good Job !!!");
  return 0;
}

The io_uring_submit_and_wait_reg_abs() function was added by me, and it's just a copy of the io_uring_submit_and_wait_reg() function with .get_flags field being set to IORING_ENTER_EXT_ARG | IORING_ENTER_EXT_ARG_REG | IORING_ENTER_ABS_TIMER to get absolute timer on the wait region