Support clnt_raw's use of FD_SETSIZE as a fake file descriptor.
ClosedPublic
Actions

Authored by brooks on Apr 27 2017, 11:43 PM.

Details

Reviewers

rmacklem
rwatson
ngie

Commits

rS318327: MFC r317660, r317710
rS318322: MFC r317660, r317710
rS317660: Support clnt_raw's use of FD_SETSIZE as a fake file descriptor.

Summary

Accomplish this by allocating space for it in __svc_xports and allowing
it to be registered. The failure to allocate space was causing an out of
bounds read in svc_getreq_common(). The failure to register caused PR 211804.

The bug was found with CHERI bounds checking.

PR: 211804
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL

Diff Detail

Repository

rS FreeBSD src repository - subversion

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

brooks created this revision.Apr 27 2017, 11:43 PM

Harbormaster completed remote builds in B8943: Diff 27800.Apr 27 2017, 11:43 PM

brooks edited the summary of this revision. (Show Details)Apr 27 2017, 11:43 PM

FWIW, NetBSD switched to using -1 instead of FD_SETSIZE to allow larger sets. We should probably pick up their assorted RPC fixes at some point.

In D10528#218125, @brooks wrote:

FWIW, NetBSD switched to using -1 instead of FD_SETSIZE to allow larger sets. We should probably pick up their assorted RPC fixes at some point.

Does supporting code need to be added to not leak the extra bogus descriptor?