Attachment 101811 Details for Bug 80163 – [PATCH] Handle ETOOMANYREFS when sending recursive fds (SCM_RIGHTS)

[patch] [PATCH] Handle ETOOMANYREFS when sending recursive fds (SCM_RIGHTS)

0001-Handle-ETOOMANYREFS-when-sending-recursive-fds-SCM_R.patch (text/plain), 4.17 KB, created by Alban Crequy on 2014-06-26 15:40:47 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Alban Crequy

Created: 2014-06-26 15:40:47 UTC

Size: 4.17 KB

patch

obsolete

>From a2ab6cc47100f65771071a6c1b390907284b6e2a Mon Sep 17 00:00:00 2001
>From: Alban Crequy <alban.crequy@collabora.co.uk>
>Date: Tue, 24 Jun 2014 17:57:14 +0100
>Subject: [PATCH] Handle ETOOMANYREFS when sending recursive fds (SCM_RIGHTS)
>
>Since Linux commit 25888e (from 2.6.37-rc4, Nov 2010), sendmsg() on Unix
>sockets returns -1 errno=ETOOMANYREFS ("Too many references: cannot splice")
>when the passfd mechanism (SCM_RIGHTS) is "abusively" used recursively by
>applications.
>
>This patch silently drops the D-Bus message on ETOOMANYREFS and does not close
>the connection.
>
>https://bugs.freedesktop.org/show_bug.cgi?id=80163
>---
> dbus/dbus-sysdeps.c          | 14 ++++++++++++++
> dbus/dbus-sysdeps.h          |  1 +
> dbus/dbus-transport-socket.c | 34 +++++++++++++++++++++++++++++++++-
> 3 files changed, 48 insertions(+), 1 deletion(-)
>
>diff --git a/dbus/dbus-sysdeps.c b/dbus/dbus-sysdeps.c
>index de3a18c..f4ba0fa 100644
>--- a/dbus/dbus-sysdeps.c
>+++ b/dbus/dbus-sysdeps.c
>@@ -762,6 +762,20 @@ _dbus_get_is_errno_epipe (void)
> }
> 
> /**
>+ * See if errno is ETOOMANYREFS
>+ * @returns #TRUE if errno == ETOOMANYREFS
>+ */
>+dbus_bool_t
>+_dbus_get_is_errno_etoomanyrefs (void)
>+{
>+#ifdef ETOOMANYREFS
>+  return errno == ETOOMANYREFS;
>+#else
>+  return FALSE;
>+#endif
>+}
>+
>+/**
>  * Get error message from errno
>  * @returns _dbus_strerror(errno)
>  */
>diff --git a/dbus/dbus-sysdeps.h b/dbus/dbus-sysdeps.h
>index e586946..21033eb 100644
>--- a/dbus/dbus-sysdeps.h
>+++ b/dbus/dbus-sysdeps.h
>@@ -384,6 +384,7 @@ dbus_bool_t _dbus_get_is_errno_eagain_or_ewouldblock (void);
> dbus_bool_t _dbus_get_is_errno_enomem                (void);
> dbus_bool_t _dbus_get_is_errno_eintr                 (void);
> dbus_bool_t _dbus_get_is_errno_epipe                 (void);
>+dbus_bool_t _dbus_get_is_errno_etoomanyrefs           (void);
> const char* _dbus_strerror_from_errno                (void);
> 
> void _dbus_disable_sigpipe (void);
>diff --git a/dbus/dbus-transport-socket.c b/dbus/dbus-transport-socket.c
>index 774f459..199d3b5 100644
>--- a/dbus/dbus-transport-socket.c
>+++ b/dbus/dbus-transport-socket.c
>@@ -645,12 +645,44 @@ do_writing (DBusTransport *transport)
>         {
>           /* EINTR already handled for us */
>           
>-          /* For some discussion of why we also ignore EPIPE here, see
>+          /* If the other end closed the socket with close() or shutdown(), we
>+           * receive EPIPE here but we must not close the socket yet: there
>+           * might still be some data to read. See:
>            * http://lists.freedesktop.org/archives/dbus/2008-March/009526.html
>            */
>           
>           if (_dbus_get_is_errno_eagain_or_ewouldblock () || _dbus_get_is_errno_epipe ())
>             goto out;
>+
>+          /* Since Linux commit 25888e (from 2.6.37-rc4, Nov 2010), sendmsg()
>+           * on Unix sockets returns -1 errno=ETOOMANYREFS when the passfd
>+           * mechanism (SCM_RIGHTS) is used recursively with a recursion level
>+           * of maximum 4. The kernel does not have an API to check whether
>+           * the passed fds can be forwarded and it can change asynchronously.
>+           * See:
>+           * https://bugs.freedesktop.org/show_bug.cgi?id=80163
>+           */
>+
>+          else if (_dbus_get_is_errno_etoomanyrefs ())
>+            {
>+              /* We only send fds in the first byte of the message.
>+               * ETOOMANYREFS cannot happen after.
>+               */
>+              _dbus_assert (socket_transport->message_bytes_written == 0);
>+
>+              _dbus_verbose (" discard message of %d bytes due to ETOOMANYREFS\n",
>+                             total_bytes_to_write);
>+
>+              socket_transport->message_bytes_written = 0;
>+              _dbus_string_set_length (&socket_transport->encoded_outgoing, 0);
>+              _dbus_string_compact (&socket_transport->encoded_outgoing, 2048);
>+
>+              /* The message was not actually sent but it needs to be removed
>+               * from the outgoing queue
>+               */
>+              _dbus_connection_message_sent_unlocked (transport->connection,
>+                                                      message);
>+            }
>           else
>             {
>               _dbus_verbose ("Error writing to remote app: %s\n",
>-- 
>1.8.5.3
>

Actions: View | Splinter Review

Attachments on bug 80163: 101289 | 101748 | 101754 | 101811

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.