SIGN IN SIGN UP

Mooncake plugin: fix checkXfer use-after-free, postXfer null deref, and an uninitialized test length (#2081)

Three independent fixes in the Mooncake plugin and its unit test, found
while
working on TENT-mode support (RFC: #2083).

1. **checkXfer crashes when polled again after completion.** The batch
is
   freed on completion but `request_count` is not reset, so a later poll
dereferences the stale batch id as a descriptor pointer. Clear both
fields
   and guard the entry.
2. **postXfer dereferences `opt_args` without a null check.** The SB API
   declares the parameter nullable.
3. **`allocateWrongGPUTest` reads `desc.len` uninitialized** before
`allocateBuffer()` uses it as the allocation size (found via a
random-size
   registration failure on a multi-GPU machine).

Verified on an 8×H20 / 5×RoCE-HCA server (Ubuntu 22.04, CUDA 13):
upstream
`mooncake_backend_test` passes its DRAM and VRAM transfer sections (599
data
verifications, 300 notification checks). Note: the final
`allocateWrongGPUTest`
assertion itself expects `NIXL_ERR_NOT_SUPPORTED`, which the plugin has
never
returned — that pre-existing test/plugin mismatch aborts the run on any
multi-GPU machine and is unrelated to these fixes; happy to address it
in a
follow-up once the intended semantics are clarified.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Bug Fixes

* Improved reliability when checking completed transfer batches.
* Notifications now handle missing optional arguments safely.
* Request and batch state is initialized and reset consistently.

## Tests

* Updated GPU buffer allocation coverage with an explicit buffer size.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: xiaodouzi666 <j.liu.86@student.rug.nl>
Co-authored-by: Frank <xiaodouzi6661@gmail.com>
A
Azuki Junjun committed
6bff065e70fab5fd6a4ca6379350a34f50d08b32
Parent: b459fe3
Committed by GitHub <noreply@github.com> on 8/20/2026, 1:47:03 PM