libcglue select() overruns native socket bitmaps when socket IDs reach 64

オープン
  • 何か問題がありますか？
#401 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
42/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
c
領域
backend, networking

調査の方向性

Start with src/libcglue/select.c, especially the SCE_FD_SET macro and the read- and write-side failure branches. Trace how libc descriptors map to native socket IDs and how sceNetInetSelect() uses its bitmaps and nfds. The issue reports a local adapter and host reproductions; inspect the focused reproducer and adapter changes if available. Done means native IDs through 255 are handled without overrunning buffers, the public fd_set ABI is preserved, and firmware errors propagate correctly.

索引モデルが issue の本文から書いたものです。

説明

Summary

src/libcglue/select.c uses newlib's public fd_set for the bitmaps passed to sceNetInetSelect(). With the installed PSP toolchain, FD_SETSIZE is 64 and sizeof(fd_set) is 8 bytes. However, SCE_FD_SET indexes those bitmaps using native PSP socket IDs, with an 8-bit mask.

A valid native socket ID of 98 therefore writes past these stack buffers, even when the application's libc descriptor is only 8. This appears to explain network failures that start after repeated socket creation.

Reviewed source: select.c at 6ef2b21.

Out-of-bounds access

The native bitmaps are declared as:

fd_set scereadfds, scewritefds;

But the macro uses:

#define SCE_FD_SET(n, p) \
    ((p)->fds_bits[((n) & 0xFF) / _NFDBITS] |= (1 << ((n) % _NFDBITS)))

On PSP, _NFDBITS is 32. For native ID 98, this accesses word 3, at byte offset 12, outside an 8-byte fd_set. The following firmware call also receives nfds = 99 with this undersized bitmap.

This is separate from the public descriptor limit: libcglue maps a small libc descriptor to a larger native socket ID. Increasing FD_SETSIZE in only the library is not sufficient, because copying the resulting larger public fd_set back into callers would change the ABI.

Real-device observations

While debugging an application with PSPLink:

  • The application descriptor was 8; __descriptormap[8]->descriptor was 98.
  • The write-side sceNetInetSelect() returned -1. Calling sceNetInetGetErrno() in that same paused request thread returned 9 (EBADF).
  • The application showed curl errors 43 (CURLE_BAD_FUNCTION_ARGUMENT) and later 7 (CURLE_COULDNT_CONNECT). These are application-level symptoms; the out-of-bounds indexing above is the concrete source defect.

Environment: GCC 15.2.0, curl 8.10.1, mbedTLS 2.28.10. The application link map confirmed the original select() came from libcglue.a(select.o). The reviewed commit above identifies the source inspected, not an asserted revision of the installed SDK.

Related error-handling defects

In the write-side failure branch, errno is not updated from sceNetInetGetErrno(), unlike the read-side branch. A previous connect() error such as EINPROGRESS can therefore survive a failed select() call. A host mock of the upstream function reproduced this.

Also, setting count = -1 does not stop the descriptor loop. Later readiness can increment it back to zero and hide the failure; this was reproduced with mocked firmware results as well.

Local fix and validation

A project-local adapter uses separate 256-bit native bitmaps, fully initializes them, preserves the public fd_set ABI, and propagates firmware errors immediately with the correct errno.

Validation of that adapter:

  • Host tests with AddressSanitizer and UndefinedBehaviorSanitizer cover native IDs 0, 31, 32, 63, 64, 98, 127, 128 and 255, stale errno, hard-error propagation and zero timeout.
  • On the real PSP, 80 consecutive UDP socket open/select-for-write/close cycles passed. All 80 native IDs were >=64, with a maximum of 180; failures: 0. Networking was already initialized by the application.

The 80-cycle result validates the corrected adapter; it is not a claim that the unpatched SDK was run through the same full loop. Extended application/video testing of the SDK-level fix is still pending.

Would a dedicated native socket bitmap, kept separate from newlib's public fd_set, be the preferred upstream fix? I can provide the focused reproducer and adapter changes if useful.

主要言語
C
スター
1.2k
フォーク
190
平均マージ
1日 18時間
マージ済み PR（30日）
8

環境構築

  • Dockerfile または Docker Compose ファイルあり
  • プルリクエストのテンプレートなし
  • コントリビューションガイドなし

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

pspdev/pspsdk のほかの issue

pspdev/pspsdk の issue をすべて見る

似ている issue

C の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。