[PATCH 1/1] rpcbind: Fix DoS vulnerability in rpcbind.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Currently my_svc_run does not handle poll time allowing idle TCP
connections to remain ESTABLISHED indefinitely. When the number
of connections reaches the limit the open file descriptors
(ulimit -n) then accept(2) fails with EMFILE. Since libtirpc does
not handle EMFILE returned from accept(2) this get my_svc_run into
a tight loop calling accept(2) resulting in the RPC service being
down, it's no longer able to service any requests.

Fix by add call to __svc_destroy_idle to my_svc_run to remove
inactive connections when poll(2) returns timeout.

Fixes: b2c9430f46c4 Use poll() instead of select() in svc_run()
Signed-off-by: dai.ngo@xxxxxxxxxx
---
 src/rpcb_svc_com.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/rpcb_svc_com.c b/src/rpcb_svc_com.c
index 1743dadf5db7..cb33519010d3 100644
--- a/src/rpcb_svc_com.c
+++ b/src/rpcb_svc_com.c
@@ -1048,6 +1048,8 @@ netbuffree(struct netbuf *ap)
 }
 
 
+extern void __svc_destroy_idle(int, bool_t);
+
 void
 my_svc_run()
 {
@@ -1076,6 +1078,7 @@ my_svc_run()
 			 * other outside event) and not caused by poll().
 			 */
 		case 0:
+			__svc_destroy_idle(30, FALSE);
 			continue;
 		default:
 			/*
-- 
2.26.2




[Index of Archives]     [Linux Filesystem Development]     [Linux USB Development]     [Linux Media Development]     [Video for Linux]     [Linux NILFS]     [Linux Audio Users]     [Yosemite Info]     [Linux SCSI]

  Powered by Linux