From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id CDE00383F849; Thu, 10 Dec 2020 10:13:16 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org CDE00383F849 From: "cvs-commit at gcc dot gnu.org" To: glibc-bugs@sourceware.org Subject: [Bug network/14889] svc_run() produces high cpu usage when accept() fails with EMFILE (CVE-2011-4609) Date: Thu, 10 Dec 2020 10:13:16 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: glibc X-Bugzilla-Component: network X-Bugzilla-Version: 2.17 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: cvs-commit at gcc dot gnu.org X-Bugzilla-Status: RESOLVED X-Bugzilla-Resolution: FIXED X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: unassigned at sourceware dot org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: security+ X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: glibc-bugs@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Glibc-bugs mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Dec 2020 10:13:16 -0000 https://sourceware.org/bugzilla/show_bug.cgi?id=3D14889 --- Comment #5 from cvs-commit at gcc dot gnu.org --- The master branch has been updated by Stefan Liebler : https://sourceware.org/git/gitweb.cgi?p=3Dglibc.git;h=3D4b2e40a9259fab08161= e1c607b06a41e15d543dc commit 4b2e40a9259fab08161e1c607b06a41e15d543dc Author: Stefan Liebler Date: Fri Dec 4 17:00:27 2020 +0100 Handle out-of-memory case in svc_tcp.c/svc_unix.c:rendezvous_request. If glibc is build with -O3 on at least 390 (-m31) or x86 (-m32), gcc 11 dumps this warning: svc_tcp.c: In function 'rendezvous_request': svc_tcp.c:274:3: error: 'memcpy' offset [0, 15] is out of the bounds [0= , 0] [-Werror=3Darray-bounds] 274 | memcpy (&xprt->xp_raddr, &addr, sizeof (addr)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors In out-of-memory case, if one of the mallocs in makefd_xprt function returns NULL, a message is dumped, makefd_xprt returns NULL and the subsequent memcpy would copy to NULL. Instead of a segfaulting, we delay a bit (see also __svc_accept_failed and Bug 14889 (CVE-2011-4609) - svc_run() produces high cpu usage when accept() fails with EMFILE (CVE-2011-4609). The same applies to svc_unix.c. Reviewed-by: Adhemerval Zanella --=20 You are receiving this mail because: You are on the CC list for the bug.=