netdev - Re: Fw: [Bug 8013] New: select for write hangs on a socket after write returned ECONNRESET

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 16 Feb 2007 18:54:50 +0300
From:	Evgeniy Polyakov <johnpol@....mipt.ru>
To:	Stephen Hemminger <shemminger@...ux-foundation.org>
Cc:	netdev@...r.kernel.org
Subject: Re: Fw: [Bug 8013] New: select for write hangs on a socket after write returned ECONNRESET

On Fri, Feb 16, 2007 at 06:39:58PM +0300, Evgeniy Polyakov (johnpol@....mipt.ru) wrote:
> On Fri, Feb 16, 2007 at 06:28:58PM +0300, Evgeniy Polyakov (johnpol@....mipt.ru) wrote:
> > On Fri, Feb 16, 2007 at 06:25:57PM +0300, Evgeniy Polyakov (johnpol@....mipt.ru) wrote:
> > > On Thu, Feb 15, 2007 at 04:04:05PM -0800, Stephen Hemminger (shemminger@...ux-foundation.org) wrote:
> > > > Someone want to take a stab at fixing this??
> 
> Ok, I've fund a reason - select() only checks if valid output condition
> is 
> #define POLLOUT_SET (POLLWRBAND | POLLWRNORM | POLLOUT | POLLERR)
> 
> Linux never sets POLLERR on shutdown - only on socket error, on shutdown
> POLLHUP is setup instead, so reading always shows that:
> 
> #define POLLIN_SET (POLLRDNORM | POLLRDBAND | POLLIN | POLLHUP |
> POLLERR)
> 
> A 'fix' can be to add POLLHUP into POLLOUT_SET or workaround that in
> application to check both input and output events in select() or use
> poll and explicitly check returned mask.

Here is mask returned from poll() in the described case:

pollin
[ 2000.564000] do_select: 2076: mask: 104, i: 3/4, j: 3/32, ret: 0, in:

pollin/pollout
[ 2000.572000] do_select: 2076: mask: 145, i: 3/4, j: 3/32, ret: 1, in:
[ 2000.572000] do_select: 2076: mask: 145, i: 3/4, j: 3/32, ret: 1, in:

error is set! but only once since sock_error() replaces sk->sk_err with
zero. Also pollhup is set.
[ 2000.572000] do_select: 2076: mask: 2059, i: 3/4, j: 3/32, ret: 1, in:

Only pollhup is set without pollerr.
[ 2000.572000] do_select: 2076: mask: 2051, i: 3/4, j: 3/32, ret: 0, in:
[ 2014.400000] do_select: 2076: mask: 2051, i: 3/4, j: 3/32, ret: 0, in:

Above sock_error() is called through the following codepath:

write() -> tcp_sendmsg() -> disconnect detected -> sk_stream_error() ->
sock_error() ==> ends up with zero sk->sk_err.

select() -> tcp_poll() ==> check for sk->sk_err fails and thus poller is
not set and tcp_poll() does not return that bit, so select() fails to
say that file descriptor is ready for output.

-- 
	Evgeniy Polyakov
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html