FD passing on 64-bit is hosed

--bi5JUZtvcfApsciF
Content-Type: multipart/mixed; boundary="M38YqGLZlgb6RLPS"
Content-Disposition: inline


--M38YqGLZlgb6RLPS
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

I first discovered this by running dovecot2 from pkgsrc, and got the
following errors:

dovecot: imap-login: Error: fd_send(imap, 20) failed: Invalid argument

After some discussion on IRC, we came to the conclusion that something
isn't right with the CMSG macros on 64-bit systems.

Venkatesh Srinivas wrote a test program that I've attached to this email
that prints "hello" on 32-bit, and loops forever on 64-bit.

--Peter

--M38YqGLZlgb6RLPS
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="sendhack.c"
Content-Transfer-Encoding: quoted-printable

#include <sys/socket.h>
#include <sys/uio.h>
#include <unistd.h>
#include <errno.h>

main(argc, argv)
	int argc;
	char **argv;
{
	int i;
	int j[2];

	socketpair(AF_UNIX, SOCK_STREAM, 0, j);

	i =3D fork();
	if (i =3D=3D 0) {
		close(0);
		close(1);
		close(2);

		int mysecretfd =3D recvfd(j[0]);
		write(mysecretfd, "hello\n", 7);
	} else {
		sendfd(j[1], 1);

		pause();
	}

}

int
sendfd(int s, int fd)
{
	char buf[1];
	struct iovec iov;
	struct msghdr msg;
	struct cmsghdr *cmsg;
	int n;
	char cms[CMSG_SPACE(sizeof(int))];
=09
	buf[0] =3D 0;
	iov.iov_base =3D buf;
	iov.iov_len =3D 1;

	memset(&msg, 0, sizeof msg);
	msg.msg_iov =3D &iov;
	msg.msg_iovlen =3D 1;
	msg.msg_control =3D (caddr_t)cms;
	msg.msg_controllen =3D CMSG_LEN(sizeof(int));

	cmsg =3D CMSG_FIRSTHDR(&msg);
	cmsg->cmsg_len =3D CMSG_LEN(sizeof(int));
	cmsg->cmsg_level =3D SOL_SOCKET;
	cmsg->cmsg_type =3D SCM_RIGHTS;
	memmove(CMSG_DATA(cmsg), &fd, sizeof(int));

	if((n=3Dsendmsg(s, &msg, 0)) !=3D iov.iov_len)
		return -1;
	return 0;
}

int
recvfd(int s)
{
	int n;
	int fd;
	char buf[1];
	struct iovec iov;
	struct msghdr msg;
	struct cmsghdr *cmsg;
	char cms[CMSG_SPACE(sizeof(int))];

	iov.iov_base =3D buf;
	iov.iov_len =3D 1;

	memset(&msg, 0, sizeof msg);
	msg.msg_name =3D 0;
	msg.msg_namelen =3D 0;
	msg.msg_iov =3D &iov;
	msg.msg_iovlen =3D 1;

	msg.msg_control =3D (caddr_t)cms;
	msg.msg_controllen =3D sizeof cms;

	if((n=3Drecvmsg(s, &msg, 0)) < 0)
		return -1;
	if(n =3D=3D 0){
		return -1;
	}
	cmsg =3D CMSG_FIRSTHDR(&msg);
	memmove(&fd, CMSG_DATA(cmsg), sizeof(int));
	return fd;
}

--M38YqGLZlgb6RLPS--

--bi5JUZtvcfApsciF
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (DragonFly)

iEYEARECAAYFAk5Lgh4ACgkQKjaxugguz8WoSwCfbbglRFW6gSUhvwPW5j2TkASX
GUoAn0EtfTBB+FYOjYlky3NCI0j8T/9G
=EUq7
-----END PGP SIGNATURE-----

--bi5JUZtvcfApsciF--