Re: linux-user: array overflow in pselect6 emulation

[Richard Henderson <richard.henderson@linaro.org>]

On 6/17/24 03:43, Andreas Schwab wrote:
> $ cat select.c
> #include <stdlib.h>
> #include <fcntl.h>
> #include <unistd.h>
> #include <sys/resource.h>
> #include <sys/select.h>
> #include <sys/syscall.h>
> 
> int
> main (int argc, char **argv)
> {
>    int nfds = (argc > 1 ? atoi (argv[1]) : 1031);
>    fd_set *fds = calloc ((nfds + (sizeof (fd_mask) * 8) - 1)
>                          / (sizeof (fd_mask) * 8), sizeof (fd_mask));
>    setrlimit (RLIMIT_NOFILE,
>               &(struct rlimit){ .rlim_cur = nfds, .rlim_max = nfds });
>    dup2 (open ("/dev/null", O_RDONLY), nfds - 1);
>    FD_SET (nfds - 1, fds);
>    syscall (SYS_pselect6, nfds, fds, 0, 0, 0, 0);
> }

Ack.

We use libc fd_set, which is sized for FD_SETSIZE at 1024.

We can either artificially limit RLIMIT_NOFILE (not ideal), or dynamically allocate all 
fd_set within qemu (which will take some time and effort).


r~