libcglue select() overruns native socket bitmaps when socket IDs reach 64

Abierto
  • ¿Algo no está bien?
#401 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
42/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
c
Área
backend, networking

Línea de trabajo

Start with src/libcglue/select.c, especially the SCE_FD_SET macro and the read- and write-side failure branches. Trace how libc descriptors map to native socket IDs and how sceNetInetSelect() uses its bitmaps and nfds. The issue reports a local adapter and host reproductions; inspect the focused reproducer and adapter changes if available. Done means native IDs through 255 are handled without overrunning buffers, the public fd_set ABI is preserved, and firmware errors propagate correctly.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

src/libcglue/select.c uses newlib's public fd_set for the bitmaps passed to sceNetInetSelect(). With the installed PSP toolchain, FD_SETSIZE is 64 and sizeof(fd_set) is 8 bytes. However, SCE_FD_SET indexes those bitmaps using native PSP socket IDs, with an 8-bit mask.

A valid native socket ID of 98 therefore writes past these stack buffers, even when the application's libc descriptor is only 8. This appears to explain network failures that start after repeated socket creation.

Reviewed source: select.c at 6ef2b21.

Out-of-bounds access

The native bitmaps are declared as:

fd_set scereadfds, scewritefds;

But the macro uses:

#define SCE_FD_SET(n, p) \
    ((p)->fds_bits[((n) & 0xFF) / _NFDBITS] |= (1 << ((n) % _NFDBITS)))

On PSP, _NFDBITS is 32. For native ID 98, this accesses word 3, at byte offset 12, outside an 8-byte fd_set. The following firmware call also receives nfds = 99 with this undersized bitmap.

This is separate from the public descriptor limit: libcglue maps a small libc descriptor to a larger native socket ID. Increasing FD_SETSIZE in only the library is not sufficient, because copying the resulting larger public fd_set back into callers would change the ABI.

Real-device observations

While debugging an application with PSPLink:

  • The application descriptor was 8; __descriptormap[8]->descriptor was 98.
  • The write-side sceNetInetSelect() returned -1. Calling sceNetInetGetErrno() in that same paused request thread returned 9 (EBADF).
  • The application showed curl errors 43 (CURLE_BAD_FUNCTION_ARGUMENT) and later 7 (CURLE_COULDNT_CONNECT). These are application-level symptoms; the out-of-bounds indexing above is the concrete source defect.

Environment: GCC 15.2.0, curl 8.10.1, mbedTLS 2.28.10. The application link map confirmed the original select() came from libcglue.a(select.o). The reviewed commit above identifies the source inspected, not an asserted revision of the installed SDK.

Related error-handling defects

In the write-side failure branch, errno is not updated from sceNetInetGetErrno(), unlike the read-side branch. A previous connect() error such as EINPROGRESS can therefore survive a failed select() call. A host mock of the upstream function reproduced this.

Also, setting count = -1 does not stop the descriptor loop. Later readiness can increment it back to zero and hide the failure; this was reproduced with mocked firmware results as well.

Local fix and validation

A project-local adapter uses separate 256-bit native bitmaps, fully initializes them, preserves the public fd_set ABI, and propagates firmware errors immediately with the correct errno.

Validation of that adapter:

  • Host tests with AddressSanitizer and UndefinedBehaviorSanitizer cover native IDs 0, 31, 32, 63, 64, 98, 127, 128 and 255, stale errno, hard-error propagation and zero timeout.
  • On the real PSP, 80 consecutive UDP socket open/select-for-write/close cycles passed. All 80 native IDs were >=64, with a maximum of 180; failures: 0. Networking was already initialized by the application.

The 80-cycle result validates the corrected adapter; it is not a claim that the unpatched SDK was run through the same full loop. Extended application/video testing of the SDK-level fix is still pending.

Would a dedicated native socket bitmap, kept separate from newlib's public fd_set, be the preferred upstream fix? I can provide the focused reproducer and adapter changes if useful.

Lenguaje dominante
C
Estrellas
1.2k
Forks
190
Merge medio
1 d 18 h
PR fusionados (30 d)
8

Preparar el entorno

  • Incluye un Dockerfile o un archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de pspdev/pspsdk

Todos los issues de pspdev/pspsdk

Issues similares

Más issues de C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.