<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style="--code-editor-font: var(--default-mono-font, "GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;">
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style="font-size: inherit; -webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";">
<div class="content">
<p class="details" style="font-style: italic; color: #626168;">
Issue created by <a href="https://gitlab.rtems.org/physwkim">Sang Woo Kim</a>: <a href="https://gitlab.rtems.org/rtems/rtos/rtems/-/work_items/5670">#5670</a>
</p>
<div class="md" style="position: relative; z-index: 1; color: #3a383f; word-wrap: break-word;">
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">Found while testing descriptor duplication for an EPICS IOC, measured on arm/xilinx_zynq_a9_qemu (the dup2()/F_DUP2FD paths are untouched by <a href="https://gitlab.rtems.org/rtems/rtos/rtems/-/merge_requests/1381" title="libio: Implement F_DUPFD_CLOEXEC and honor the F_DUPFD minimum" class="gfm gfm-merge_request" data-original="!1381" data-link="false" data-link-reference="false" data-merge-request="2833" data-project="26" data-project-path="rtems/rtos/rtems" data-iid="1381" data-container="body" data-placement="top" data-reference-type="merge_request" style="margin-top: 0px;">!1381</a>, so this is the behavior of main).</p>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial"><code style="font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; margin-top: 0px; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;">duplicate2_iop()</code> in <code style="font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;">cpukit/libcsupport/src/fcntl.c</code> assumes the target descriptor is open. When it is free the call appears to succeed but every step is wrong: the iop is never unlinked from <code style="font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;">rtems_libio_iop_free_head</code> (the free list linked through <code style="font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;">iop->data1</code>), <code style="font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;">LIBIO_FLAGS_OPEN</code> is never set (the F_DUPFD path sets it after the open handler; F_DUP2FD has no equivalent), and no reference is taken.</p>
<div class="gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang="c" class="code highlight js-syntax-highlight language-c" v-pre="true" style="display: block; font-size: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-radius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px solid #dcdcde;"><code style="font-size: inherit; color: inherit; word-wrap: normal; word-break: keep-all; background-color: inherit; border-radius: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset;"><span id="LC1" class="line" lang="c" style="margin-top: 0px;"><span class="kt" style="margin-top: 0px;">int</span> <span class="n">s</span> <span class="o">=</span> <span class="n">socket</span><span class="p">(</span><span class="n">AF_INET</span><span class="p">,</span> <span class="n">SOCK_DGRAM</span><span class="p">,</span> <span class="mi">0</span><span class="p">);</span></span>
<span id="LC2" class="line" lang="c"><span class="kt" style="margin-top: 0px;">int</span> <span class="n">f</span> <span class="o">=</span> <span class="n">open</span><span class="p">(</span><span class="s">"/tmp-probe"</span><span class="p">,</span> <span class="n">O_CREAT</span> <span class="o">|</span> <span class="n">O_RDWR</span><span class="p">,</span> <span class="mo">0644</span><span class="p">);</span></span>
<span id="LC3" class="line" lang="c"><span class="n" style="margin-top: 0px;">close</span><span class="p">(</span><span class="n">f</span><span class="p">);</span> <span class="cm">/* f is now on the iop free list */</span></span>
<span id="LC4" class="line" lang="c"><span class="n" style="margin-top: 0px;">fcntl</span><span class="p">(</span><span class="n">s</span><span class="p">,</span> <span class="n">F_DUP2FD</span><span class="p">,</span> <span class="n">f</span><span class="p">);</span> <span class="cm">/* returns f: "success" */</span></span>
<span id="LC5" class="line" lang="c"><span class="n" style="margin-top: 0px;">fcntl</span><span class="p">(</span><span class="n">f</span><span class="p">,</span> <span class="n">F_GETFL</span><span class="p">);</span> <span class="cm">/* -1, errno = EBADF */</span></span>
<span id="LC6" class="line" lang="c"><span class="n" style="margin-top: 0px;">fstat</span><span class="p">(</span><span class="n">f</span><span class="p">,</span> <span class="o">&</span><span class="n">st</span><span class="p">);</span> <span class="cm">/* -1, errno = EBADF */</span></span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir="auto" style="color: #3a383f; margin: 0px 0px 1rem;" align="initial">So the caller gets back a descriptor that answers EBADF to everything, while the iop keeps the pathinfo cloned from the source descriptor: that location reference is never released, and the iop is still on the free list, so a later allocation hands it out while it holds the stale clone.</p>
<p dir="auto" style="color: #3a383f; margin: 0px;" align="initial">This is reachable directly through the BSD-compat F_DUP2FD command today, and becomes the dup2() path the moment <a href="https://gitlab.rtems.org/rtems/rtos/rtems/-/work_items/5669" title="dup2() fails with EBADF when fildes2 is not open" class="gfm gfm-issue" data-original="#5669" data-link="false" data-link-reference="false" data-issue="29864" data-project="26" data-iid="5669" data-namespace-path="rtems/rtos/rtems" data-project-path="rtems/rtos/rtems" data-issue-type="issue" data-container="body" data-placement="top" data-reference-type="issue" style="margin-top: 0px;">#5669</a> is fixed. The fix needs an allocate-specific-descriptor step (unlink the target iop from the free list, as <code style="font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;">rtems_libio_allocate_minimum()</code> does for F_DUPFD) and must set <code style="font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;">LIBIO_FLAGS_OPEN</code> on success; the open-target case also wants the close to go through proper accounting rather than a bare <code style="font-size: 90%; color: #18171d; word-wrap: break-word; background-color: #ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; font-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;">close_h</code> call.</p>
</div>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #626168;">
—
<br>
<a href="https://gitlab.rtems.org/rtems/rtos/rtems/-/work_items/5670">View it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://gitlab.rtems.org">gitlab.rtems.org</a>. <a href="https://gitlab.rtems.org/-/sent_notifications/4-42plj18jx969x4eis1c4v206z-1d/unsubscribe" target="_blank" rel="noopener noreferrer">Unsubscribe</a> from this thread · <a href="https://gitlab.rtems.org/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://gitlab.rtems.org/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
<span style="color: transparent; font-size: 0; display: none; overflow: hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://gitlab.rtems.org/rtems/rtos/rtems/-/work_items/5670 at 1785248712
</span>
<script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","action":{"@type":"ViewAction","name":"View Work item","url":"https://gitlab.rtems.org/rtems/rtos/rtems/-/work_items/5670"}}</script>
</p>
</div>
</body>
</html>