Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Do not try to fill fd_set with fd>=FD_SETSIZE #1471

Merged
merged 1 commit into from
Jul 19, 2017
Merged

Do not try to fill fd_set with fd>=FD_SETSIZE #1471

merged 1 commit into from
Jul 19, 2017

Conversation

veprbl
Copy link
Member

@veprbl veprbl commented Jul 18, 2017

This is UB and causes buffer overflow and crash on linux.

Test case:

default.nix

builtins.genList (i: derivation { name = "test-${toString i}"; builder = ./builder.sh; system = "x86_64-linux"; allowSubstitutes = false; }) 1000

builder.sh

#!/bin/sh

/bin/sleep 100
/bin/touch $out

nix-build -j 1000

@veprbl
Do not try to fill fd_set with fd>=FD_SETSIZE
d5e1bff 
This is UB and causes buffer overflow and crash on linux.
@dezgeg
Copy link
Contributor

dezgeg commented Jul 18, 2017

Does dropping LimitNOFILE = 4096; from nixos/modules/services/misc/nix-daemon.nix also workaround this?

@veprbl
Copy link
Member Author

veprbl commented Jul 19, 2017

@dezgeg FD_SETSIZE is hardcoded in glibc to 1024 and fd_set is defined to just be able to hold a 128 byte bitmask. Behaviour of the FD_SET macro when used with fd >= FD_SETSIZE is undefined by the POSIX standard and glibc doesn't impose any runtime checks, so it will try to write to memory outside the fd_set.

@veprbl
Copy link
Member Author

veprbl commented Jul 19, 2017

Also this is no easy to reproduce with daemon. You would need many build users for that :)

@edolstra edolstra merged commit 3162ad5 into NixOS:master Jul 19, 2017
@dezgeg
Copy link
Contributor

dezgeg commented Jul 19, 2017

Yes, I know, that's why all Linux distros set the default open file descriptor limit to 1024 by default...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@veprbl @dezgeg @edolstra