libcglue select() overruns native socket bitmaps when socket IDs reach 64

Aperta
  • Qualcosa non va?
#401 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
42/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
c
Ambito
backend, networking

Direzione di ricerca

Start with src/libcglue/select.c, especially the SCE_FD_SET macro and the read- and write-side failure branches. Trace how libc descriptors map to native socket IDs and how sceNetInetSelect() uses its bitmaps and nfds. The issue reports a local adapter and host reproductions; inspect the focused reproducer and adapter changes if available. Done means native IDs through 255 are handled without overrunning buffers, the public fd_set ABI is preserved, and firmware errors propagate correctly.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

src/libcglue/select.c uses newlib's public fd_set for the bitmaps passed to sceNetInetSelect(). With the installed PSP toolchain, FD_SETSIZE is 64 and sizeof(fd_set) is 8 bytes. However, SCE_FD_SET indexes those bitmaps using native PSP socket IDs, with an 8-bit mask.

A valid native socket ID of 98 therefore writes past these stack buffers, even when the application's libc descriptor is only 8. This appears to explain network failures that start after repeated socket creation.

Reviewed source: select.c at 6ef2b21.

Out-of-bounds access

The native bitmaps are declared as:

fd_set scereadfds, scewritefds;

But the macro uses:

#define SCE_FD_SET(n, p) \
    ((p)->fds_bits[((n) & 0xFF) / _NFDBITS] |= (1 << ((n) % _NFDBITS)))

On PSP, _NFDBITS is 32. For native ID 98, this accesses word 3, at byte offset 12, outside an 8-byte fd_set. The following firmware call also receives nfds = 99 with this undersized bitmap.

This is separate from the public descriptor limit: libcglue maps a small libc descriptor to a larger native socket ID. Increasing FD_SETSIZE in only the library is not sufficient, because copying the resulting larger public fd_set back into callers would change the ABI.

Real-device observations

While debugging an application with PSPLink:

  • The application descriptor was 8; __descriptormap[8]->descriptor was 98.
  • The write-side sceNetInetSelect() returned -1. Calling sceNetInetGetErrno() in that same paused request thread returned 9 (EBADF).
  • The application showed curl errors 43 (CURLE_BAD_FUNCTION_ARGUMENT) and later 7 (CURLE_COULDNT_CONNECT). These are application-level symptoms; the out-of-bounds indexing above is the concrete source defect.

Environment: GCC 15.2.0, curl 8.10.1, mbedTLS 2.28.10. The application link map confirmed the original select() came from libcglue.a(select.o). The reviewed commit above identifies the source inspected, not an asserted revision of the installed SDK.

Related error-handling defects

In the write-side failure branch, errno is not updated from sceNetInetGetErrno(), unlike the read-side branch. A previous connect() error such as EINPROGRESS can therefore survive a failed select() call. A host mock of the upstream function reproduced this.

Also, setting count = -1 does not stop the descriptor loop. Later readiness can increment it back to zero and hide the failure; this was reproduced with mocked firmware results as well.

Local fix and validation

A project-local adapter uses separate 256-bit native bitmaps, fully initializes them, preserves the public fd_set ABI, and propagates firmware errors immediately with the correct errno.

Validation of that adapter:

  • Host tests with AddressSanitizer and UndefinedBehaviorSanitizer cover native IDs 0, 31, 32, 63, 64, 98, 127, 128 and 255, stale errno, hard-error propagation and zero timeout.
  • On the real PSP, 80 consecutive UDP socket open/select-for-write/close cycles passed. All 80 native IDs were >=64, with a maximum of 180; failures: 0. Networking was already initialized by the application.

The 80-cycle result validates the corrected adapter; it is not a claim that the unpatched SDK was run through the same full loop. Extended application/video testing of the SDK-level fix is still pending.

Would a dedicated native socket bitmap, kept separate from newlib's public fd_set, be the preferred upstream fix? I can provide the focused reproducer and adapter changes if useful.

Lingua principale
C
Stelle
1.2k
Fork
190
Merge medio
1g 18h
PR unite (30g)
8

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di pspdev/pspsdk

Tutte le issue di pspdev/pspsdk

Issue simili

Altre issue su C

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.