Date: Sat, 5 May 2012 12:51:34 GMT
From: Jukka Ukkonen <jau@iki.fi>
To: freebsd-gnats-submit@FreeBSD.org
Subject: kern/167612: The portal file system gets stuck inside portal_open(). ("1 extra fds")
Message-ID: <201205051251.q45CpYa1052899@red.freebsd.org>
Resent-Message-ID: <201205051300.q45D0LBa051340@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 167612
>Category: kern
>Synopsis: The portal file system gets stuck inside portal_open(). ("1 extra fds")
>Confidential: no
>Severity: serious
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sat May 05 13:00:21 UTC 2012
>Closed-Date:
>Last-Modified:
>Originator: Jukka Ukkonen
>Release: 9.0-STABLE
>Organization:
---
>Environment:
FreeBSD sleipnir 9.0-STABLE FreeBSD 9.0-STABLE #0: Sat May 5 10:19:05 EEST 2012 root@sleipnir:/usr/obj/usr/src/sys/Sleipnir amd64
>Description:
All attempts to refer to any file under the mounted portal file system end up waiting indefinitely.
Actually the portal ends up reading STDIN while it should be reading from a command.
E.g. the following command should simply list the output from who, but instead it does nothing until ctrl-D is given on the tty...
cat /p/pipe/usr/bin/who
At the same time the following complaint gets written to syslog...
May 5 15:28:36 sleipnir kernel: portal_open: 1 extra fds
Apparently the faulty takes place and gets also partially handled within the following snippet of code in portal_vnops.c ...
cmsg = mtod(cm, struct cmsghdr *);
newfds = (cmsg->cmsg_len - sizeof(*cmsg)) / sizeof (int);
if (newfds == 0) {
error = ECONNREFUSED;
goto bad;
}
/*
* At this point the rights message consists of a control message
* header, followed by a data region containing a vector of
* integer file descriptors. The fds were allocated by the action
* of receiving the control message.
*/
ip = (int *) (cmsg + 1);
fd = *ip++;
if (newfds > 1) {
/*
* Close extra fds.
*/
int i;
printf("portal_open: %d extra fds\n", newfds - 1);
for (i = 1; i < newfds; i++) {
portal_closefd(td, *ip);
ip++;
}
}
It seems that newfds gets calculated wrong and fd gets picked too early in the message.
After that the correct fd gets treated as extra and closed.
>How-To-Repeat:
See full description above.
>Fix:
Apparently some further jugglery with the control message is needed to get the data alignment right.
At the time of this writing I do not have a patch.
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201205051251.q45CpYa1052899>