[GHC] #9168: reading/writing blocking FDs over FD_SETSIZE is broken
#9168: reading/writing blocking FDs over FD_SETSIZE is broken ------------------------------------+------------------------------------- Reporter: rwbarton | Owner: Type: bug | Status: new Priority: normal | Milestone: Component: libraries/base | Version: 7.8.1 Keywords: | Operating System: Unknown/Multiple Architecture: Unknown/Multiple | Type of failure: None/Unknown Difficulty: Unknown | Test Case: Blocked By: | Blocking: Related Tickets: | ------------------------------------+------------------------------------- In `GHC.IO.FD` when reading from or writing to a blocking FD we first check (using our C function `fdReady`) whether the underlying fd is ready for read/write, in an attempt to avoid blocking the current OS thread. On POSIX this check is done using select, with no test for whether the fd exceeds `FD_SETSIZE`, causing a write out of bounds and various bad consequences. Also, while `readRawBufferPtr` checks the error status of `fdReady`, `readRawBufferPtrNoBlock`, `writeRawBufferPtr`, `writeRawBufferPtrNoBlock` do not, making this issue harder to diagnose. I suggest that `fdReady` use `poll(2)` where available. I can prepare a set of patches if needed. -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9168 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler
#9168: reading/writing blocking FDs over FD_SETSIZE is broken -------------------------------------+------------------------------------ Reporter: rwbarton | Owner: Type: bug | Status: new Priority: normal | Milestone: Component: libraries/base | Version: 7.8.1 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Unknown/Multiple Type of failure: None/Unknown | Difficulty: Unknown Test Case: | Blocked By: Blocking: | Related Tickets: -------------------------------------+------------------------------------ Comment (by rwbarton): A reproducer, based on https://github.com/smurphy8/broken-acid-test. Note: you need a max open files ulimit of more than about 1030 to reproduce the bug with this program. -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9168#comment:1 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler
#9168: reading/writing blocking FDs over FD_SETSIZE is broken -------------------------------------+------------------------------------ Reporter: rwbarton | Owner: Type: bug | Status: new Priority: normal | Milestone: Component: libraries/base | Version: 7.8.1 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Unknown/Multiple Type of failure: None/Unknown | Difficulty: Unknown Test Case: | Blocked By: Blocking: | Related Tickets: -------------------------------------+------------------------------------ Comment (by rwbarton): Oh, and if `poll(2)` is not available and so we have to fall back to `select`, and we call `fdReady` on an fd exceeding `FD_SETSIZE`, we should raise an exception, of course. -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9168#comment:2 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler
#9168: reading/writing blocking FDs over FD_SETSIZE is broken -------------------------------------+------------------------------------ Reporter: rwbarton | Owner: Type: bug | Status: new Priority: normal | Milestone: Component: libraries/base | Version: 7.8.1 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Unknown/Multiple Type of failure: None/Unknown | Difficulty: Unknown Test Case: | Blocked By: Blocking: | Related Tickets: -------------------------------------+------------------------------------ Comment (by nicolast): Can't the changes from #4934 (9fd507e5758f4141ac2619f0db57136bcab035c6) trigger this as well? -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9168#comment:3 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler
Can't the changes from #4934 (9fd507e5758f4141ac2619f0db57136bcab035c6)
#9168: reading/writing blocking FDs over FD_SETSIZE is broken -------------------------------------+------------------------------------ Reporter: rwbarton | Owner: Type: bug | Status: new Priority: normal | Milestone: Component: libraries/base | Version: 7.8.1 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Unknown/Multiple Type of failure: None/Unknown | Difficulty: Unknown Test Case: | Blocked By: Blocking: | Related Tickets: -------------------------------------+------------------------------------ Comment (by slyfox): Replying to [comment:3 nicolast]: trigger this as well? You mean regression introduction? I think not, as fd sanity is checked right before main select() call. As it's a single-threaded runtime case no haskell tasks should be able to be pushed to blocked queue (with very big FD). -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9168#comment:4 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler
#9168: reading/writing blocking FDs over FD_SETSIZE is broken -------------------------------------+------------------------------------ Reporter: rwbarton | Owner: Type: bug | Status: new Priority: normal | Milestone: Component: libraries/base | Version: 7.8.1 Resolution: | Keywords: Operating System: Unknown/Multiple | Architecture: Unknown/Multiple Type of failure: None/Unknown | Difficulty: Unknown Test Case: | Blocked By: Blocking: | Related Tickets: -------------------------------------+------------------------------------ Comment (by slyfox): Simplest "fix" (as done in non-threaded IOmanager): {{{ --- a/libraries/base/cbits/inputReady.c +++ b/libraries/base/cbits/inputReady.c @@ -25,7 +25,9 @@ fdReady(int fd, int write, int msecs, int isSock) int maxfd, ready; fd_set rfd, wfd; struct timeval tv; - + if ((fd >= (int)FD_SETSIZE) || (fd < 0)) { + return -1; + } FD_ZERO(&rfd); FD_ZERO(&wfd); if (write) { }}} -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9168#comment:5 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler
#9168: reading/writing blocking FDs over FD_SETSIZE is broken -------------------------------------+------------------------------------ Reporter: rwbarton | Owner: Type: bug | Status: closed Priority: normal | Milestone: 7.8.3 Component: libraries/base | Version: 7.8.1 Resolution: fixed | Keywords: Operating System: Unknown/Multiple | Architecture: Unknown/Multiple Type of failure: None/Unknown | Difficulty: Unknown Test Case: | Blocked By: Blocking: | Related Tickets: -------------------------------------+------------------------------------ Changes (by thoughtpolice): * status: new => closed * resolution: => fixed * milestone: => 7.8.3 Comment: Merged into 7.8.3. -- Ticket URL: http://ghc.haskell.org/trac/ghc/ticket/9168#comment:6 GHC http://www.haskell.org/ghc/ The Glasgow Haskell Compiler
participants (1)
-
GHC