NetBSD Problem Report #17507

Received: (qmail 24283 invoked by uid 605); 7 Jul 2002 17:59:58 -0000
Message-Id: <20020707175956.0D97F1104@bzz.taranis.org>
Date: Sun,  7 Jul 2002 13:59:56 -0400 (EDT)
From: kalt@taranis.org
Sender: gnats-bugs-owner@netbsd.org
To: gnats-bugs@gnats.netbsd.org
Subject: poll(2) makes an erroneous assumption
X-Send-Pr-Version: 3.95

>Number:         17507
>Category:       kern
>Synopsis:       poll(2) ignores
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jul 07 18:00:00 +0000 2002
>Closed-Date:    Sat Dec 12 17:47:58 +0000 2009
>Last-Modified:  Fri Apr 24 05:50:01 +0000 2015
>Originator:     Christophe Kalt
>Release:        NetBSD 1.6_BETA4
>Organization:

>Environment:


System: NetBSD bzz.taranis.org 1.6_BETA4 NetBSD 1.6_BETA4 (bzz) #4: Wed Jul 3 20:33:50 EDT 2002 root@bzz.taranis.org:/scratch/NetBSD/1.6.x/obj/scratch/NetBSD/1.6.x/src/sys/arch/sparc/compile/bzz sparc
Architecture: sparc
Machine: sparc
>Description:
This was previously discussed on tech-userlevel, so you may want to check
the archives for posts starting July 7, 2002 with subject "poll(2) oddity".

Basically, poll() takes two (main) arguments: a set of struct pollfd
and the size of the set.  Unfortunately, the first thing sys_poll() does
is the following:

         if (SCARG(uap, nfds) > p->p_fd->fd_nfiles) {
                 /* forgiving; slightly wrong */
                 SCARG(uap, nfds) = p->p_fd->fd_nfiles;
         }

Effectively, this may truncate the set, resulting in part of it being
ignored.
>How-To-Repeat:
Compile the following snippet:
#include <sys/types.h>
#include <poll.h>

main()
{
    struct pollfd pfd[21];
    int i;

    for (i=0; i<21; i++)
      {
	pfd[i].fd = -1;
	pfd[i].events = 0;
      }
    pfd[20].fd = 0;
    pfd[20].events = POLLIN;

    printf("%d\n", poll(pfd, 21, 1000));
}

no, if you run this with "echo foo | ./a.out" you should get 1, but you
never do.  try changing 20 to anything below and you do.
20 seems to be the default for fd_nflies (according to Ben Harris who
shed some light on this for me).
>Fix:
Get rid of the code included in the description, but i imagine it's there
for a reason and needs to be replaced with something better.
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed
State-Changed-By: dsl@NetBSD.org
State-Changed-When: Sat, 12 Dec 2009 17:47:58 +0000
State-Changed-Why:
Code changed to make the limit somewhat larger.


From: David Laight <dsl@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/17507 CVS commit: src/sys/kern
Date: Sat, 12 Dec 2009 17:47:05 +0000

 Module Name:	src
 Committed By:	dsl
 Date:		Sat Dec 12 17:47:05 UTC 2009

 Modified Files:
 	src/sys/kern: sys_select.c

 Log Message:
 Bounding the 'nfds' arg to poll() at the current process limit for actual
 open files is rather gross - the poll map isn't required to be dense.
 Instead limit to a much larger value (1000 + dt_nfiles) so that user
 programs cannot allocate indefinite sized blocks of kvm.
 If the limit is exceeded, then return EINVAL instead of silently truncating
 the list.
 (The silent truncation in select isn't quite as bad - although even there
 any high bits that are set ought to generate an EBADF response.)
 Move the code that converts ERESTART and EWOULDBLOCK into common code.
 Effectively fixes PR/17507 since the new limit is unlikely to be detected.


 To generate a diff of this commit:
 cvs rdiff -u -r1.19 -r1.20 src/sys/kern/sys_select.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "SAITOH Masanobu" <msaitoh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/17507 CVS commit: [netbsd-5] src/sys/kern
Date: Fri, 24 Apr 2015 05:45:48 +0000

 Module Name:	src
 Committed By:	msaitoh
 Date:		Fri Apr 24 05:45:48 UTC 2015

 Modified Files:
 	src/sys/kern [netbsd-5]: sys_select.c

 Log Message:
 Pull up following revision(s) (requested by prlw1 in ticket #1957):

 sys/kern/sys_select.c				patch

 	Limit nfds arg to poll() to a large enough value that user programs
 	cannot allocate indefinite sized blocks of kvm. If the limit is
 	exceeded, then return EINVAL instead of silently truncating the list.
 	Addresses PR/17507.


 To generate a diff of this commit:
 cvs rdiff -u -r1.10 -r1.10.4.1 src/sys/kern/sys_select.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "SAITOH Masanobu" <msaitoh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/17507 CVS commit: [netbsd-5-2] src/sys/kern
Date: Fri, 24 Apr 2015 05:46:09 +0000

 Module Name:	src
 Committed By:	msaitoh
 Date:		Fri Apr 24 05:46:09 UTC 2015

 Modified Files:
 	src/sys/kern [netbsd-5-2]: sys_select.c

 Log Message:
 Pull up following revision(s) (requested by prlw1 in ticket #1957):

 sys/kern/sys_select.c				patch

 	Limit nfds arg to poll() to a large enough value that user programs
 	cannot allocate indefinite sized blocks of kvm. If the limit is
 	exceeded, then return EINVAL instead of silently truncating the list.
 	Addresses PR/17507.
 	[prlw1, ticket #1957]


 To generate a diff of this commit:
 cvs rdiff -u -r1.10 -r1.10.14.1 src/sys/kern/sys_select.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "SAITOH Masanobu" <msaitoh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/17507 CVS commit: [netbsd-5-1] src/sys/kern
Date: Fri, 24 Apr 2015 05:46:33 +0000

 Module Name:	src
 Committed By:	msaitoh
 Date:		Fri Apr 24 05:46:33 UTC 2015

 Modified Files:
 	src/sys/kern [netbsd-5-1]: sys_select.c

 Log Message:
 Pull up following revision(s) (requested by prlw1 in ticket #1957):

 sys/kern/sys_select.c				patch

 	Limit nfds arg to poll() to a large enough value that user programs
 	cannot allocate indefinite sized blocks of kvm. If the limit is
 	exceeded, then return EINVAL instead of silently truncating the list.
 	Addresses PR/17507.
 	[prlw1, ticket #1957]


 To generate a diff of this commit:
 cvs rdiff -u -r1.10 -r1.10.10.1 src/sys/kern/sys_select.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search