libcglue select() overruns native socket bitmaps when socket IDs reach 64

Đang mở
  • Có gì không ổn?
#401 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
42/100
Loại issue
Lỗi
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
c
Lĩnh vực
backend, networking

Hướng nghiên cứu

Start with src/libcglue/select.c, especially the SCE_FD_SET macro and the read- and write-side failure branches. Trace how libc descriptors map to native socket IDs and how sceNetInetSelect() uses its bitmaps and nfds. The issue reports a local adapter and host reproductions; inspect the focused reproducer and adapter changes if available. Done means native IDs through 255 are handled without overrunning buffers, the public fd_set ABI is preserved, and firmware errors propagate correctly.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

Summary

src/libcglue/select.c uses newlib's public fd_set for the bitmaps passed to sceNetInetSelect(). With the installed PSP toolchain, FD_SETSIZE is 64 and sizeof(fd_set) is 8 bytes. However, SCE_FD_SET indexes those bitmaps using native PSP socket IDs, with an 8-bit mask.

A valid native socket ID of 98 therefore writes past these stack buffers, even when the application's libc descriptor is only 8. This appears to explain network failures that start after repeated socket creation.

Reviewed source: select.c at 6ef2b21.

Out-of-bounds access

The native bitmaps are declared as:

fd_set scereadfds, scewritefds;

But the macro uses:

#define SCE_FD_SET(n, p) \
    ((p)->fds_bits[((n) & 0xFF) / _NFDBITS] |= (1 << ((n) % _NFDBITS)))

On PSP, _NFDBITS is 32. For native ID 98, this accesses word 3, at byte offset 12, outside an 8-byte fd_set. The following firmware call also receives nfds = 99 with this undersized bitmap.

This is separate from the public descriptor limit: libcglue maps a small libc descriptor to a larger native socket ID. Increasing FD_SETSIZE in only the library is not sufficient, because copying the resulting larger public fd_set back into callers would change the ABI.

Real-device observations

While debugging an application with PSPLink:

  • The application descriptor was 8; __descriptormap[8]->descriptor was 98.
  • The write-side sceNetInetSelect() returned -1. Calling sceNetInetGetErrno() in that same paused request thread returned 9 (EBADF).
  • The application showed curl errors 43 (CURLE_BAD_FUNCTION_ARGUMENT) and later 7 (CURLE_COULDNT_CONNECT). These are application-level symptoms; the out-of-bounds indexing above is the concrete source defect.

Environment: GCC 15.2.0, curl 8.10.1, mbedTLS 2.28.10. The application link map confirmed the original select() came from libcglue.a(select.o). The reviewed commit above identifies the source inspected, not an asserted revision of the installed SDK.

Related error-handling defects

In the write-side failure branch, errno is not updated from sceNetInetGetErrno(), unlike the read-side branch. A previous connect() error such as EINPROGRESS can therefore survive a failed select() call. A host mock of the upstream function reproduced this.

Also, setting count = -1 does not stop the descriptor loop. Later readiness can increment it back to zero and hide the failure; this was reproduced with mocked firmware results as well.

Local fix and validation

A project-local adapter uses separate 256-bit native bitmaps, fully initializes them, preserves the public fd_set ABI, and propagates firmware errors immediately with the correct errno.

Validation of that adapter:

  • Host tests with AddressSanitizer and UndefinedBehaviorSanitizer cover native IDs 0, 31, 32, 63, 64, 98, 127, 128 and 255, stale errno, hard-error propagation and zero timeout.
  • On the real PSP, 80 consecutive UDP socket open/select-for-write/close cycles passed. All 80 native IDs were >=64, with a maximum of 180; failures: 0. Networking was already initialized by the application.

The 80-cycle result validates the corrected adapter; it is not a claim that the unpatched SDK was run through the same full loop. Extended application/video testing of the SDK-level fix is still pending.

Would a dedicated native socket bitmap, kept separate from newlib's public fd_set, be the preferred upstream fix? I can provide the focused reproducer and adapter changes if useful.

Ngôn ngữ chính
C
Star
1.2k
Fork
190
Merge trung bình
1 ngày 18 giờ
Pull request đã merge (30 ngày)
8

Chuẩn bị môi trường

  • Có Dockerfile hoặc tệp Docker Compose
  • Không có mẫu pull request
  • Không có hướng dẫn đóng góp

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của pspdev/pspsdk

Tất cả issue của pspdev/pspsdk

Issue tương tự

Thêm issue về C

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.