Bug 250366 - [tcp] The ioctl of socket fd should return -1 after listen to avoid misusing.
Summary: [tcp] The ioctl of socket fd should return -1 after listen to avoid misusing.
Status: In Progress
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: Unspecified
Hardware: Any Any
: --- Affects Only Me
Assignee: Michael Tuexen
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-10-15 12:13 UTC by Yong-Hao Zou
Modified: 2020-10-21 22:11 UTC (History)
2 users (show)

See Also:
tuexen: mfc-stable12?


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Yong-Hao Zou 2020-10-15 12:13:56 UTC
The ioctl of socket fd should return -1 after listen to avoid misusing.

```
0   socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+0  setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
+0.1 ioctl(3, SIOCINQ, [0]) = 0

+0  bind(3, ..., ...) = 0
+0.1 ioctl(3, SIOCINQ, [0]) = 0

+0  listen(3, 1) = 0
+0  < S 0:0(0) win 32792 <mss 1000,sackOK,nop,nop,nop,wscale 7>
+0 ~ +1  > S. 0:0(0) ack 1 <...>

+.1 < . 1:1(0) ack 1 win 32792
+0.1  accept(3, ..., ...) = 4

+0 < . 1:41(40) ack 1 win 28273 

+0.1 ioctl(4, FIONREAD, [40]) = 0
+0.1 ioctl(3, FIONREAD, [0]) = -1 // f-stack/FreeBSD return 0 here
```
Comment 1 Yong-Hao Zou 2020-10-15 12:16:33 UTC
Sorry, the script should be

```
0   socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+0  setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
+0.1 ioctl(3, FIONREAD, [0]) = 0

+0  bind(3, ..., ...) = 0
+0.1 ioctl(3, FIONREAD, [0]) = 0

+0  listen(3, 1) = 0
+0  < S 0:0(0) win 32792 <mss 1000,sackOK,nop,nop,nop,wscale 7>
+0 ~ +1  > S. 0:0(0) ack 1 <...>

+.1 < . 1:1(0) ack 1 win 32792
+0.1  accept(3, ..., ...) = 4

+0 < . 1:41(40) ack 1 win 28273 

+0.1 ioctl(4, FIONREAD, [40]) = 0
+0.1 ioctl(3, FIONREAD, [0]) = -1
```

No SIOCINQ in FreeBSD.
Comment 2 Michael Tuexen freebsd_committer 2020-10-21 22:10:55 UTC
A fix is under review D26897. Avoiding accessing the send and receive buffers is necessary. Instead of returning an error, one could return 0 in all cases. Right now, I prefer to return an error. Let's see how the discussion of the review goes...