Mooncake plugin: fix checkXfer use-after-free, postXfer null deref, and an uninitialized test length (#2081)
Three independent fixes in the Mooncake plugin and its unit test, found while working on TENT-mode support (RFC: #2083). 1. **checkXfer crashes when polled again after completion.** The batch is freed on completion but `request_count` is not reset, so a later poll dereferences the stale batch id as a descriptor pointer. Clear both fields and guard the entry. 2. **postXfer dereferences `opt_args` without a null check.** The SB API declares the parameter nullable. 3. **`allocateWrongGPUTest` reads `desc.len` uninitialized** before `allocateBuffer()` uses it as the allocation size (found via a random-size registration failure on a multi-GPU machine). Verified on an 8×H20 / 5×RoCE-HCA server (Ubuntu 22.04, CUDA 13): upstream `mooncake_backend_test` passes its DRAM and VRAM transfer sections (599 data verifications, 300 notification checks). Note: the final `allocateWrongGPUTest` assertion itself expects `NIXL_ERR_NOT_SUPPORTED`, which the plugin has never returned — that pre-existing test/plugin mismatch aborts the run on any multi-GPU machine and is unrelated to these fixes; happy to address it in a follow-up once the intended semantics are clarified. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Bug Fixes * Improved reliability when checking completed transfer batches. * Notifications now handle missing optional arguments safely. * Request and batch state is initialized and reset consistently. ## Tests * Updated GPU buffer allocation coverage with an explicit buffer size. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: xiaodouzi666 <j.liu.86@student.rug.nl> Co-authored-by: Frank <xiaodouzi6661@gmail.com>
A
Azuki Junjun committed
6bff065e70fab5fd6a4ca6379350a34f50d08b32
Parent: b459fe3
Committed by GitHub <noreply@github.com>
on 8/20/2026, 1:47:03 PM