NetBSD Problem Report #59750

From www@netbsd.org  Fri Nov  7 02:41:58 2025
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 8DF691A9239
	for <gnats-bugs@gnats.NetBSD.org>; Fri,  7 Nov 2025 02:41:58 +0000 (UTC)
Message-Id: <20251107024157.563E51A923C@mollari.NetBSD.org>
Date: Fri,  7 Nov 2025 02:41:57 +0000 (UTC)
From: nervoso@k1.com.br
Reply-To: nervoso@k1.com.br
To: gnats-bugs@NetBSD.org
Subject: yppush aborts _svc_run: select failed: Bad file descriptor
X-Send-Pr-Version: www-1.0

>Number:         59750
>Category:       bin
>Synopsis:       yppush aborts _svc_run: select failed: Bad file descriptor
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Nov 07 02:45:00 +0000 2025
>Last-Modified:  Fri Jan 30 11:00:03 +0000 2026
>Originator:     sergio lenzi
>Release:        10.1_STABLE
>Organization:
k12.su
>Environment:
NetBSD desktop2.lenzicasa 10.1_STABLE NetBSD 10.1_STABLE (LZT) #11: Sat Aug 30 14:14:22 -03 2025  NetBSD@nvme.lenzicasa:/home/NetBSD/BUILD/10/amd64/OBJ/sys/arch/amd64/compile/GENERIC amd64
>Description:
setup of a nis (yp) master => slave ... when updated some server db the system tries to yppush to slace, it aborts with:
yppush -h sip -v passwd.byname
pushing passwd.byname [order=1762482473] in domain lenzicasa
pushing map passwd.byname in lenzicasa: order=1762482473, owner=fserver.lenzicasa
pushing to sip
asking host sip to transfer map (xid=4441)
yppush: _svc_run: select failed: Bad file descriptor
>How-To-Repeat:
command:
yppush  -h <slave addr>  -passwd.byname

or... update master.passwd via vipw.....

cd /var/yp
make


I have made a patch for yppush with the help of chat-gpt... seems to work...
>Fix:
Index: usr/src/usr.sbin/ypserv/yppush/yppush.c
===================================================================
RCS file: /cvsroot/src/usr.sbin/ypserv/yppush/yppush.c,v
retrieving revision 1.25
diff -u -r1.25 yppush.c
--- usr/src/usr.sbin/ypserv/yppush/yppush.c	24 Jul 2021 21:31:39 -0000	1.25
+++ usr/src/usr.sbin/ypserv/yppush/yppush.c	7 Nov 2025 01:29:49 -0000
@@ -53,6 +53,8 @@
 #include <rpcsvc/yp_prot.h>
 #include <rpcsvc/ypclnt.h>

+
+static int yppush_cbfd = -1;
 #include "ypdb.h"
 #include "ypdef.h"
 #include "yplib_host.h"
@@ -347,6 +349,9 @@
 			break;
 	}
 	if (prog >= 0x5fffffff) {
+		/* failed to register a callback program; bail out gracefully */
+		/* (don't enter the svc loop with a bogus fdset) */
+		yppush_cbfd = -1;
 		warnx("unable to register callback");
 		goto error;
 	}
@@ -355,6 +360,9 @@
          * now fork off a server to catch our reply
          */
 	pid = fork();
+	/* remember the UDP transport fd for the child select() loop */
+	if (pid >= 0)
+		yppush_cbfd = transp->xp_fd;
 	if (pid == -1) {
 		svc_unregister(prog, 1);	/* drop our mapping with
 						 * portmap */
@@ -429,10 +437,12 @@
 	struct timeval tv;
 	int     rv, nfds;

-	nfds = sysconf(_SC_OPEN_MAX);
+	nfds = (yppush_cbfd >= 0) ? (yppush_cbfd + 1) : sysconf(_SC_OPEN_MAX);
 	while (1) {

-		readfds = svc_fdset;	/* structure copy from global var */
+		FD_ZERO(&readfds);
+		if (yppush_cbfd >= 0)
+			FD_SET(yppush_cbfd, &readfds);
 		tv.tv_sec = 60;
 		tv.tv_usec = 0;

>Audit-Trail:
From: mlelstv@serpens.de (Michael van Elst)
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: bin/59750: yppush aborts _svc_run: select failed: Bad file descriptor
Date: Fri, 7 Nov 2025 10:52:30 -0000 (UTC)

 nervoso@k1.com.br writes:

 >setup of a nis (yp) master => slave ... when updated some server db the system tries to yppush to slace, it aborts with:
 >yppush -h sip -v passwd.byname
 >pushing passwd.byname [order=1762482473] in domain lenzicasa
 >pushing map passwd.byname in lenzicasa: order=1762482473, owner=fserver.lenzicasa
 >pushing to sip
 >asking host sip to transfer map (xid=4441)
 >yppush: _svc_run: select failed: Bad file descriptor


 Thanks for reporting the bug.



 >I have made a patch for yppush with the help of chat-gpt... seems to work...


 That however is mostly nonsense. The file descriptor handling is
 done in libc and possible errors are already correctly handled.

 Your patch seems to work because of this part:

 >-	nfds = sysconf(_SC_OPEN_MAX);
 >+	nfds = (yppush_cbfd >= 0) ? (yppush_cbfd + 1) : sysconf(_SC_OPEN_MAX);

 Checking yppush_cbfd here serves no purpose, the program only
 reaches that point when the descriptor is valid.

 Assuming yppush_cbfd were captured, your change could be
 stripped to:

 >-	nfds = sysconf(_SC_OPEN_MAX);
 >+	nfds = yppush_cbfd + 1;

 Or, without peeking the descriptor (svc_maxfd is a value maintained
 by the library, just like svc_fdset).

 -	nfds = sysconf(_SC_OPEN_MAX);
 +	nfds = svc_maxfd + 1;


 The bug is to call select() with the maximum number of open
 file descriptors. The fd_set data structure however is limited
 to only FD_SETSIZE entries.

 FD_SETSIZE is special in that you can #define it yourself
 before including <sys/select.h> to extend the data structure.
 The kernel just accepts a larger nfds parameter to select()
 and treats the fd_set pointer then like such an extended
 structure.

 Since FD_SETSIZE is not #defined in yppush.c, the kernel reads
 beyond the end of the (regular sized) fd_set and if any of the
 following bits in memory is a '1' it is references an invalid file
 descriptor and select() fails correctly with EBADF.

 If your nfds value is even larger than sysconf(_SC_OPEN_MAX)+FD_SETSIZE,
 the kernel would have returned EINVAL instead. That's a safety
 measure against arbitrarily large values, where a huge fd_set
 would need to be copied into the kernel and checked.


 The bug only became visible, when NetBSD changed the default
 resource limit for open file descriptors from 128 to 1024
 for some architectures.


From: Christos Zoulas <christos@zoulas.com>
To: gnats-bugs@netbsd.org
Cc: gnats-admin@netbsd.org,
 netbsd-bugs@netbsd.org
Subject: Re: bin/59750: yppush aborts _svc_run: select failed: Bad file
 descriptor
Date: Sun, 9 Nov 2025 12:08:59 -0500

 --Apple-Mail=_EEFFD414-BD8A-4974-B5A5-B0A2D6941926
 Content-Transfer-Encoding: quoted-printable
 Content-Type: text/plain;
 	charset=us-ascii

 This does not look right to me. Can you try deleting the custom =
 _svc_run() method and run the regular svc_run() instead?

 christos=

 --Apple-Mail=_EEFFD414-BD8A-4974-B5A5-B0A2D6941926
 Content-Transfer-Encoding: 7bit
 Content-Disposition: attachment;
 	filename=signature.asc
 Content-Type: application/pgp-signature;
 	name=signature.asc
 Content-Description: Message signed with OpenPGP

 -----BEGIN PGP SIGNATURE-----
 Comment: GPGTools - http://gpgtools.org

 iF0EARECAB0WIQS+BJlbqPkO0MDBdsRxESqxbLM7OgUCaRDKqwAKCRBxESqxbLM7
 OrDnAKDOcz3a0HtAAsTihulRRe166ef31QCfeB9MG/JjMu2xQLYRtKIIW8w5o0g=
 =1pLG
 -----END PGP SIGNATURE-----

 --Apple-Mail=_EEFFD414-BD8A-4974-B5A5-B0A2D6941926--

From: "Michael van Elst" <mlelstv@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/59750 CVS commit: src/usr.sbin/ypserv/yppush
Date: Wed, 3 Dec 2025 08:26:10 +0000

 Module Name:	src
 Committed By:	mlelstv
 Date:		Wed Dec  3 08:26:10 UTC 2025

 Modified Files:
 	src/usr.sbin/ypserv/yppush: yppush.c

 Log Message:
 _SC_OPEN_MAX can exceed FD_SETSIZE. Use the compat value svc_maxfd+1
 from the rpc library similar to ypbind(8).

 The custom _svc_run() function is required as the standard svc_run()
 may hang for retries.

 Fixes PR 59750.


 To generate a diff of this commit:
 cvs rdiff -u -r1.25 -r1.26 src/usr.sbin/ypserv/yppush/yppush.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/59750 CVS commit: [netbsd-11] src/usr.sbin/ypserv/yppush
Date: Fri, 30 Jan 2026 10:53:51 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Fri Jan 30 10:53:51 UTC 2026

 Modified Files:
 	src/usr.sbin/ypserv/yppush [netbsd-11]: yppush.c

 Log Message:
 Pull up following revision(s) (requested by mrg in ticket #168):

 	usr.sbin/ypserv/yppush/yppush.c: revision 1.26

 _SC_OPEN_MAX can exceed FD_SETSIZE. Use the compat value svc_maxfd+1
 from the rpc library similar to ypbind(8).

 The custom _svc_run() function is required as the standard svc_run()
 may hang for retries.

 Fixes PR 59750.


 To generate a diff of this commit:
 cvs rdiff -u -r1.25 -r1.25.6.1 src/usr.sbin/ypserv/yppush/yppush.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/59750 CVS commit: [netbsd-10] src/usr.sbin/ypserv/yppush
Date: Fri, 30 Jan 2026 10:55:12 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Fri Jan 30 10:55:12 UTC 2026

 Modified Files:
 	src/usr.sbin/ypserv/yppush [netbsd-10]: yppush.c

 Log Message:
 Pull up following revision(s) (requested by mrg in ticket #1230):

 	usr.sbin/ypserv/yppush/yppush.c: revision 1.26

 _SC_OPEN_MAX can exceed FD_SETSIZE. Use the compat value svc_maxfd+1
 from the rpc library similar to ypbind(8).

 The custom _svc_run() function is required as the standard svc_run()
 may hang for retries.

 Fixes PR 59750.


 To generate a diff of this commit:
 cvs rdiff -u -r1.25 -r1.25.2.1 src/usr.sbin/ypserv/yppush/yppush.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/59750 CVS commit: [netbsd-9] src/usr.sbin/ypserv/yppush
Date: Fri, 30 Jan 2026 10:56:30 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Fri Jan 30 10:56:30 UTC 2026

 Modified Files:
 	src/usr.sbin/ypserv/yppush [netbsd-9]: yppush.c

 Log Message:
 Pull up following revision(s) (requested by mrg in ticket #2001):

 	usr.sbin/ypserv/yppush/yppush.c: revision 1.26

 _SC_OPEN_MAX can exceed FD_SETSIZE. Use the compat value svc_maxfd+1
 from the rpc library similar to ypbind(8).

 The custom _svc_run() function is required as the standard svc_run()
 may hang for retries.

 Fixes PR 59750.


 To generate a diff of this commit:
 cvs rdiff -u -r1.24 -r1.24.44.1 src/usr.sbin/ypserv/yppush/yppush.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

Home	PR Database Search