[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150818205144.GM32742@brightrain.aerifal.cx>
Date: Tue, 18 Aug 2015 16:51:44 -0400
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Cc: Tastky <tastky@...il.com>
Subject: Re: nfs-utils broken with musl: "select: Bad file descriptor"
On Tue, Aug 18, 2015 at 09:18:10PM +0200, Szabolcs Nagy wrote:
> * Felix Janda <felix.janda@...teo.de> [2015-08-18 20:20:14 +0200]:
>
> > Rich Felker wrote:
> > > On Tue, Aug 18, 2015 at 06:50:54PM +0200, Tastky wrote:
> > > > Just checked with said include and everything recompiled.
> > > > Unfortunately the same error persists.
> > > >
> > > > Running OpenWrt's command
> > > > /usr/sbin/rpc.statd -p 32778 -o 32779 -F
> > > > manually (following the script's prior steps, ofc) results in a loop of:
> > > >
> > > > sm-notify: Version 1.3.2 starting
> > > > sm-notify: Already notifying clients; Exiting
> > > >
> > > > With strace: http://pastebin.com/raw.php?i=9ypUbmsp
> > >
> > > From the strace, I see that a nonsensical fd #105 is in the fd_set
> > > readfds that comes from SVC_FDSET. I don't know where the latter is
> > > defined or modified.
> >
> > It is defined in system.h (now hopefully) to be svc_fdset, which seems
> > to be defined as a global variable by the rpc headers.
> >
>
> i think this call goes wrong:
>
> http://git.linux-nfs.org/?p=steved/nfs-utils.git;a=blob;f=utils/statd/rmtcall.c;hb=HEAD#l56
>
> it loops for 100 iterations and if all ports are used
> according to getservbyport then it FD_SET(sockfd, &SVC_FDSET);
> with some random high sockfd (eg. 105) that is closed.
>
> ...so should getservbyport fail there?
>
> (according to strace it tries ports 883 to 982)
I think the application's expectation is that it fail rather than
returning a decimal-string-only service entity. However it looks like
the code is written to handle the case where all 100 iterations fail
to get an anonymous port. The problem seems to be that, when the loop
stops due to hitting the iteration count rather than exiting with
break, i has already been incremented past the last tmp_socket slot,
so the close loop closes the fd that they actually want to use, later
causing EBADF. This is purely an application bug, but it happens not
to get noticed if getservbyport fails anywhere along the way, which
they expect to happen in the usual case.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
