Date: Wed, 21 Nov 2012 13:27:03 +0100
From: Johannes Schilling <of82ecuq@stud.informatik.uni-erlangen.de>
To: krb5-bugs@mit.edu
Subject: select on set of all bad fds
CC: problems@stud.informatik.uni-erlangen.de

 

Submitter-Id:  new
Originator:    Johannes Schilling
Confidential:  no
Synopsis:      select on set of all bad fds
Severity:      non-critical
Priority:      medium
Category:      krb5-libs
Class:         sw-bug
Release:       1.10.1+dfsg
Environment:   debian wheezy, various machines. all have the debian
wheezy 1.10.1+dfsg kerberos packages installed. // TODO: wollen die mehr?
System:        Linux 3.0.31 #1 SMP x86_64 GNU/Linux
Machine:       x86_64
Description:   in src/lib/krb5/os/sendto_kdc.c:service_fds we iterate
over all fds in conns, doing a "continue" if the current fd is <0
(INVALID_SOCKET). now from time to time it happened that all these fds
were bad, so select() immediately returned, but nothing was done inside
the handling loop, so select() is called again, immediately returning,
... ssh was still functional, but sshds with >500 cpu-hours at 600h
uptime are not the nicest of things.
How-To-Repeat:  this is where i'm not exactly sure. setup sshd with
kerberos and wait.
Fix:            the attached patch checks if any fds are ok, and if not
returns 1, the error-code for which is also used if select failed, and
which is checked by the calling function so things can be
retried/aborted/...

Do you really mean select()?  I would expect krb5 1.10.x on Debian to use
poll().  That's not really important, though.

If there are no valid fds in the connection state list, then selstate-
>nfds should be 0 and the loop should terminate.  I can't find any bugs
which would violate that invariant.  If you see this happening again, can
you examine the contents of the selstate structure?

Date: Wed, 28 Nov 2012 19:42:14 +0100
From: Alexander Wuerstlein <snalwuer@cip.informatik.uni-erlangen.de>
To: rt@krbdev.mit.edu
CC: CIP Support <problems@stud.informatik.uni-erlangen.de>
Subject: Re: [krbdev.mit.edu #7454] select on set of all bad fds
RT-Send-Cc: 

 

Thanks for the detail.  At first I was perplexed, but then I realized
that line 1290 is passing the wrong list pointer to service_fds()--it's
passing only a subset of the connection list corresponding to sel_state.
I will commit a fix shortly.

From: ghudson@mit.edu
Subject: SVN Commit


Fix spin-loop bug in k5_sendto_kdc

In the second part of the first pass over the server list, we passed
the wrong list pointer to service_fds, causing it to see only a subset
of the server entries corresponding to sel_state.  This could cause
service_fds to spin if an event is reported on an fd not in the
subset.

https://github.com/krb5/krb5/commit/2b06a22f7fd8ec01fb27a7335125290b8ceb6f18
Author: Greg Hudson <ghudson@mit.edu>
Commit: 2b06a22f7fd8ec01fb27a7335125290b8ceb6f18
Branch: master
 src/lib/krb5/os/sendto_kdc.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

From: tlyu@mit.edu
Subject: SVN Commit


Fix spin-loop bug in k5_sendto_kdc

In the second part of the first pass over the server list, we passed
the wrong list pointer to service_fds, causing it to see only a subset
of the server entries corresponding to sel_state.  This could cause
service_fds to spin if an event is reported on an fd not in the
subset.

(cherry picked from commit 2b06a22f7fd8ec01fb27a7335125290b8ceb6f18)

https://github.com/krb5/krb5/commit/9eb2b4dfc136da326e54081ae18cb4d648c6500d
Author: Greg Hudson <ghudson@mit.edu>
Committer: Tom Yu <tlyu@mit.edu>
Commit: 9eb2b4dfc136da326e54081ae18cb4d648c6500d
Branch: krb5-1.11
 src/lib/krb5/os/sendto_kdc.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)