From owner-freebsd-bugs  Wed Apr 24 18:21: 4 2002
Delivered-To: freebsd-bugs@hub.freebsd.org
Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP id 47A5A37B431
	for <freebsd-bugs@hub.freebsd.org>; Wed, 24 Apr 2002 18:20:56 -0700 (PDT)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.11.6/8.11.6) id g3P1K0h83465;
	Wed, 24 Apr 2002 18:20:00 -0700 (PDT)
	(envelope-from gnats)
Received: from eubie.lbl.gov (eubie.lbl.gov [131.243.2.36])
	by hub.freebsd.org (Postfix) with ESMTP id C08D137B400
	for <FreeBSD-gnats-submit@freebsd.org>; Wed, 24 Apr 2002 18:16:23 -0700 (PDT)
Received: (from jim@localhost)
	by eubie.lbl.gov (8.11.6/8.11.6) id g3P1EOZ28984;
	Wed, 24 Apr 2002 18:14:24 -0700 (PDT)
	(envelope-from jin)
Message-Id: <200204250114.g3P1EOZ28984@eubie.lbl.gov>
Date: Wed, 24 Apr 2002 18:14:24 -0700 (PDT)
From: Jin Guojun (DSD staff) <jin@eubie.lbl.gov>
Reply-To: j_guojun@lbl.gov
To: FreeBSD-gnats-submit@FreeBSD.org
X-Send-Pr-Version: 3.113
Subject: kern/37436: accept dead loop when out of file descriptor
Sender: owner-freebsd-bugs@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-bugs.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-bugs>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-bugs>
X-Loop: FreeBSD.org


>Number:         37436
>Category:       kern
>Synopsis:       accept dead loop when out of file descriptor
>Confidential:   Yes
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Apr 24 18:20:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Jin Guojun (DSD staff)
>Release:        FreeBSD 4.5-RELEASE i386
>Organization:
>Environment:

	FreeBSD 4.5-RELEASE (May be all)

>Description:
	If a user or system file descriptor table is full, the accept()
	will infinitly return an error EMFILE/ENFILE.
 
>How-To-Repeat:
	Set file descriptor table limit (from csh/tcsh):

	% limit descriptors 16 (or some reasonable number for testing)

	Then, open a TCP socket and listen on it, and start to connect
	to this TCP port from localhost or a remote host in muliple times.

	iperf may be an existing program to test this problem.
	To compile iperf in multi-thread mode, link libc_r.a to libpthead.a
	before doing the configure under iperf.

	Then start iperf server on a FreeBSD host that descriptors is limited.
	server% limit descriptors 16
	server% iperf -s

	On any other host to start a client and make 16 connections:
	remote% iperf -c server -P 16

	Program will hang on both systems. To trace it, use perror()
	to print error message after accept() when accept() return -1.

>Fix:

	The correct behave should close the duplicate socket to cause
	remote connection go away.

	Just for reference:
	This was tested under thread environment (-lc_r).
	I have not tested this under fork(), and this may only
	happened under libc_r.a, but it is possible inside the kernel.
	If this is true, then it can lead to DOS attack. An intruder
	can start connect to a port until a connect() call hangs,
	then kill rest connections and leave the last one alive to
	hang a remote server.

	The similar problem happens under Solaris.
	Linux implements this correctly.

>Release-Note:
>Audit-Trail:
>Unformatted:

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message