From nobody Fri May 1 08:11:17 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4g6NzG5GgDz6c7hF for ; Fri, 01 May 2026 08:11:22 +0000 (UTC) (envelope-from oliver.pntr@gmail.com) Received: from mail-yx1-xb131.google.com (mail-yx1-xb131.google.com [IPv6:2607:f8b0:4864:20::b131]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "WR4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4g6NzF0q3hz3hxt for ; Fri, 01 May 2026 08:11:21 +0000 (UTC) (envelope-from oliver.pntr@gmail.com) Authentication-Results: mx1.freebsd.org; dkim=pass header.d=gmail.com header.s=20251104 header.b=LuUHD7mx; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (mx1.freebsd.org: domain of oliver.pntr@gmail.com designates 2607:f8b0:4864:20::b131 as permitted sender) smtp.mailfrom=oliver.pntr@gmail.com; arc=pass ("google.com:s=arc-20240605:i=1") Received: by mail-yx1-xb131.google.com with SMTP id 956f58d0204a3-64eaf8aa893so1409752d50.3 for ; Fri, 01 May 2026 01:11:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1777623079; cv=none; d=google.com; s=arc-20240605; b=OZgMHoer2BoKAhze2BUOlWI6uz+lqdagATAjRBIqIvZbn8iuVZxNDrpEdjrhsGn6ae 7Vmil8WH0ZfiyxHzCzDMrpfJjXRuFTlJSbaCqZ6WxpAKu6MMiG367hs+nxeYBU+CTIJx huUo9FkLMR9NXQq3PsDMLOXzPCN5RddKowwVbXpMBKLlwzP0VzeuB8/JMB9FAazg8fwg X3xD0DY2XlIB0cLhV2rICke1+PfFrNTErkmJeNGDBgV1KnehYRRtii52NcCmyhQ3TG69 oT8izoQCGald6j2Smc17DWiPpPljZYKGVCg++JN3eqfPk+wLupxIXlMkSLK2kM/2z/n/ RqeA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=cc:to:subject:message-id:date:from:references:in-reply-to :mime-version:dkim-signature; bh=A/IPIE/pM9mntYa6vB/UUxLL14EyCVD8IwUPKXlG6+w=; fh=UYPo8BPCl7Ah2BmwYDhmtiQ3m7P7cxTgF59Pag727m0=; b=RPP5bZfutKCpI+ZdCPRDSkJaURY44xexv/T5K0gX6YYsiAiX+c6j+r2x7O3cbUv7yC CzAW+y+p0/vP9hzW7umVOV5rOs9cVBuTMCsbTf3YKZJLKYz3gnRcJERuM7gsCIQqKbVf xyc46SEfe48ujp88t/vhtzX4eNx3UIma4KO8NHhyox6mzspILYFyahto10k8BxOfjAFY EBM5hY5ZgeAVw7FGDG/qiGA5XeDEDINRpC/nOQXiIn1eiM2G5rnSPbfkO9HBwsXxraDW gqRDIkra7gg496FzCFoixnu+XhSspLNChvZs4LFJUlG522EaGa0ne+wG/4bISVfnE2uD QxFQ==; darn=freebsd.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1777623079; x=1778227879; darn=freebsd.org; h=cc:to:subject:message-id:date:from:references:in-reply-to :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=A/IPIE/pM9mntYa6vB/UUxLL14EyCVD8IwUPKXlG6+w=; b=LuUHD7mxyPIdEANbU9vByiGoMMOxSkMNE49+RXsM+Sdw3I78sUKNa/8AeDRY81RZm3 duwE6rI9yPtte82SxsSG4gCCvXKeWNVbViV9ffjBUS1P5xv49MLU/FvSs6wfEsE89UuZ rOVSycE6UtHqxfG/Qj8LSdEo2Y6yOlpQFmHvY0Nhm/eGL7mtCOGc60z58b2AEE/k+5JU Ggegvi56AUrbave9elM7qbQrDRn+UeLjwbxrX8daqAZOdO2QUIhH0mPZJedaLX/tBDaB 0N6enGn54hg6TnfT3gyARWzgLh7HdFV4PycUDIJOnFeCWkImjhmHmrm3OdgdX+Ilietp ZKtg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777623079; x=1778227879; h=cc:to:subject:message-id:date:from:references:in-reply-to :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=A/IPIE/pM9mntYa6vB/UUxLL14EyCVD8IwUPKXlG6+w=; b=rg2IwW1zhsQkr8G73WDZVs/r4G4muZ3yIX7kLDk0wew1mK/GeB1TkJcivkTZ4L5gDg gpbLwdbZZv/H5PeTniiNY0eY4KOuKgeq4U5itvvHco/MIHbndNKzXrJfktSImvvRXJt1 MRFv6XTeik2RuZTfQTNsTovNr0AWD3laEXO407jvpNKqJYhxf+ifxcJvoe2IDVlPaC4P 43LhReiWsx6z41fC5yYwqlemJwOZ9LCLDS5b+6IIwm/30LEx67Ec3cc3sIW+jI6YZl05 Rua1zjH1kj+fuVnLXJOWhWHzv7pJ13APgHvTSYCxzVmXPJ+isJaDi3lo0Nr3tJc9UxOx XPKA== X-Forwarded-Encrypted: i=1; AFNElJ+p8c7hgbSPy52E89IdXKZMk1xSkggGOMddBcWEPkQYGdD8MtNdibhOAbjdW+oRyODdBjvFbDsNy0UYibKXixNIbVq6jQ==@freebsd.org X-Gm-Message-State: AOJu0YxEThDP315YIvj8/VEY2GMmQKCsTs87mMsT3P7AuLuZDTjO3Tyd IPB638lqEKMgXO+Ze5CiwR2pMCz/VVVNwgbS8fYp4gRpRzSP0pEASMsWLmXZ1RLh3IqG/YIAk9J hpnwD8rPI/Le2Y1CKmd5ZSaWw5aYZll+1Hg== X-Gm-Gg: AeBDiesJMHdms3GR5P7eEFF7eQeGgPuNiGbmHVKs0zMKwUqFtQUHjtIoe3HA1fzMUg5 qd3o1bMoLM8ljrIOH6h13yH8e2y9V5Qa7XEtAHUQgsp+KOILM+66q5jvc0nnQ2d/yDJ8MP+DjIp 4VtXaQUmJFWdAUFAjCD6PooiAl5lt9++DosD9bhPpApnXqoLEMsb87SG8iCFXeIgQSimydNrvPR UGmQTrHZf30cpy4e/rLb0hhWYBGXdBysNgWxm5ZxcQfFzXDEV7Z9EQEV0vZGOmYVqS0qh38nn9p AudNDb1uYrOXYGnXVQxX4HAsQLgtfUKGzdWj43se0u3sq5ucIKkGA8YQ0bRUoQ== X-Received: by 2002:a05:690e:118a:b0:651:b593:d3cb with SMTP id 956f58d0204a3-65c35e0475bmr590837d50.24.1777623078962; Fri, 01 May 2026 01:11:18 -0700 (PDT) List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Received: by 2002:a05:7011:b05:b0:515:7a65:37dc with HTTP; Fri, 1 May 2026 01:11:17 -0700 (PDT) In-Reply-To: <69f219fc.3d583.73783562@gitrepo.freebsd.org> References: <69f219fc.3d583.73783562@gitrepo.freebsd.org> From: Oliver Pinter Date: Fri, 1 May 2026 09:11:17 +0100 X-Gm-Features: AVHnY4IsiLAPo2HThGG5Si0V_lmMxCRaEd3Imq7l3TI1Gb3PMKaIc7p0fYVQid4 Message-ID: Subject: Re: git: f5ea3dce2cbe - main - libnv: switch fd_wait() from select(2) to poll(2) To: Mark Johnston Cc: "src-committers@freebsd.org" , "dev-commits-src-all@freebsd.org" , "dev-commits-src-main@freebsd.org" , Mariusz Zaborski Content-Type: multipart/alternative; boundary="0000000000002a8ab80650bd20fd" X-Spamd-Result: default: False [-4.97 / 15.00]; ARC_ALLOW(-1.00)[google.com:s=arc-20240605:i=1]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_SHORT(-0.97)[-0.969]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; R_DKIM_ALLOW(-0.20)[gmail.com:s=20251104]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4864::/56:c]; MIME_GOOD(-0.10)[multipart/alternative,text/plain]; RCVD_TLS_LAST(0.00)[]; TO_DN_EQ_ADDR_SOME(0.00)[]; MIME_TRACE(0.00)[0:+,1:+,2:~]; RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::b131:from]; TAGGED_FROM(0.00)[]; FREEMAIL_ENVFROM(0.00)[gmail.com]; TO_DN_SOME(0.00)[]; FREEMAIL_FROM(0.00)[gmail.com]; FROM_HAS_DN(0.00)[]; MISSING_XM_UA(0.00)[]; RCPT_COUNT_FIVE(0.00)[5]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RCVD_COUNT_TWO(0.00)[2]; FROM_EQ_ENVFROM(0.00)[]; DKIM_TRACE(0.00)[gmail.com:+]; PREVIOUSLY_DELIVERED(0.00)[dev-commits-src-main@freebsd.org]; MLMMJ_DEST(0.00)[dev-commits-src-main@freebsd.org]; MID_RHS_MATCH_FROMTLD(0.00)[]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; DWL_DNSWL_NONE(0.00)[gmail.com:dkim] X-Spamd-Bar: ---- X-Rspamd-Queue-Id: 4g6NzF0q3hz3hxt --0000000000002a8ab80650bd20fd Content-Type: text/plain; charset="UTF-8" On Wednesday, April 29, 2026, Mark Johnston wrote: > The branch main has been updated by markj: > > URL: https://cgit.FreeBSD.org/src/commit/?id= > f5ea3dce2cbe1ee2068c5e5c11bb066f5789685b > > commit f5ea3dce2cbe1ee2068c5e5c11bb066f5789685b > Author: Mariusz Zaborski > AuthorDate: 2026-04-28 14:35:10 +0000 > Commit: Mark Johnston > CommitDate: 2026-04-29 14:39:28 +0000 > > libnv: switch fd_wait() from select(2) to poll(2) > > The previous implementation used FD_SET() on a stack-allocated fd_set, > which is an out-of-bounds write whenever the socket fd is >= FD_SETSIZE > (1024). This problem seems like a more generic problem, after looking into sys/select.h What about adding a check for the FD_SET about the variable is on the stack or not? And enforce the FD_SETSIZE limit almost the same way as it is already done with fortify source. Maybe the https://lists.llvm.org/pipermail/llvm-dev/2013-October/066294.html can be used (or abused) to implement this check. Feel free to correct me, if I'm wrong. > Approved by: so > Security: FreeBSD-SA-26:16.libnv > Security: CVE-2026-39457 > Reported by: Joshua Rogers of AISLE Research Team ( > https://aisle.com/) > Reviewed by: markj > Differential Revision: https://reviews.freebsd.org/D56689 > --- > lib/libnv/msgio.c | 12 +++---- > lib/libnv/tests/nvlist_send_recv_test.c | 56 > +++++++++++++++++++++++++++++++++ > 2 files changed, 62 insertions(+), 6 deletions(-) > > diff --git a/lib/libnv/msgio.c b/lib/libnv/msgio.c > index f6f75241ff06..de2994e47fef 100644 > --- a/lib/libnv/msgio.c > +++ b/lib/libnv/msgio.c > @@ -32,10 +32,10 @@ > > #include > #include > -#include > > #include > #include > +#include > #include > #include > #include > @@ -86,14 +86,14 @@ msghdr_add_fd(struct cmsghdr *cmsg, int fd) > static void > fd_wait(int fd, bool doread) > { > - fd_set fds; > + struct pollfd pfd; > > PJDLOG_ASSERT(fd >= 0); > > - FD_ZERO(&fds); > - FD_SET(fd, &fds); > - (void)select(fd + 1, doread ? &fds : NULL, doread ? NULL : &fds, > - NULL, NULL); > + pfd.fd = fd; > + pfd.events = doread ? POLLIN : POLLOUT; > + pfd.revents = 0; > + (void)poll(&pfd, 1, -1); > } > > static int > diff --git a/lib/libnv/tests/nvlist_send_recv_test.c > b/lib/libnv/tests/nvlist_send_recv_test.c > index 4a5c10df656d..d655a26a7362 100644 > --- a/lib/libnv/tests/nvlist_send_recv_test.c > +++ b/lib/libnv/tests/nvlist_send_recv_test.c > @@ -27,6 +27,8 @@ > */ > > #include > +#include > +#include > #include > #include > #include > @@ -531,6 +533,59 @@ ATF_TC_BODY(nvlist_send_recv__send_nvlist__stream, > tc) > nvlist_send_recv__send_nvlist(SOCK_STREAM); > } > > +/* > + * Regression test for fd_wait(): the previous select(2)-based > implementation > + * called FD_SET() unconditionally, which is an out-of-bounds stack write > when > + * the socket fd is >= FD_SETSIZE. Force the socketpair fds above > FD_SETSIZE > + * and verify a full nvlist round-trip still works. > + */ > +ATF_TC_WITHOUT_HEAD(nvlist_send_recv__highfd); > +ATF_TC_BODY(nvlist_send_recv__highfd, tc) > +{ > + struct rlimit rl; > + nvlist_t *nvl; > + int socks[2], hi_send, hi_recv, status; > + pid_t pid; > + > + hi_send = FD_SETSIZE + 5; > + hi_recv = FD_SETSIZE + 6; > + > + rl.rlim_cur = rl.rlim_max = hi_recv + 1; > + if (setrlimit(RLIMIT_NOFILE, &rl) != 0) > + atf_tc_skip("cannot raise RLIMIT_NOFILE: %s", > strerror(errno)); > + > + ATF_REQUIRE(socketpair(PF_UNIX, SOCK_STREAM, 0, socks) == 0); > + ATF_REQUIRE(dup2(socks[0], hi_recv) == hi_recv); > + ATF_REQUIRE(dup2(socks[1], hi_send) == hi_send); > + (void)close(socks[0]); > + (void)close(socks[1]); > + > + pid = fork(); > + ATF_REQUIRE(pid >= 0); > + if (pid == 0) { > + /* Child: send. */ > + (void)close(hi_recv); > + nvl = nvlist_create(0); > + nvlist_add_string(nvl, "key", "value"); > + if (nvlist_send(hi_send, nvl) != 0) > + err(EXIT_FAILURE, "nvlist_send"); > + nvlist_destroy(nvl); > + _exit(0); > + } > + > + (void)close(hi_send); > + nvl = nvlist_recv(hi_recv, 0); > + ATF_REQUIRE(nvl != NULL); > + ATF_REQUIRE(nvlist_error(nvl) == 0); > + ATF_REQUIRE(nvlist_exists_string(nvl, "key")); > + ATF_REQUIRE(strcmp(nvlist_get_string(nvl, "key"), "value") == 0); > + nvlist_destroy(nvl); > + > + ATF_REQUIRE(waitpid(pid, &status, 0) == pid); > + ATF_REQUIRE(status == 0); > + (void)close(hi_recv); > +} > + > ATF_TC_WITHOUT_HEAD(nvlist_send_recv__send_closed_fd__dgram); > ATF_TC_BODY(nvlist_send_recv__send_closed_fd__dgram, tc) > { > @@ -734,6 +789,7 @@ ATF_TP_ADD_TCS(tp) > > ATF_TP_ADD_TC(tp, nvlist_send_recv__send_nvlist__dgram); > ATF_TP_ADD_TC(tp, nvlist_send_recv__send_nvlist__stream); > + ATF_TP_ADD_TC(tp, nvlist_send_recv__highfd); > ATF_TP_ADD_TC(tp, nvlist_send_recv__send_closed_fd__dgram); > ATF_TP_ADD_TC(tp, nvlist_send_recv__send_closed_fd__stream); > ATF_TP_ADD_TC(tp, nvlist_send_recv__send_many_fds__dgram); > > --0000000000002a8ab80650bd20fd Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Wednesday, April 29, 2026, Mark Johnston <markj@freebsd.org> wrote:
The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=3Df5ea3dce2cbe1ee2068c5e5c11bb066f5789685b

commit f5ea3dce2cbe1ee2068c5e5c11bb066f5789685b
Author:=C2=A0 =C2=A0 =C2=A0Mariusz Zaborski <oshogbo@FreeBSD.org>
AuthorDate: 2026-04-28 14:35:10 +0000
Commit:=C2=A0 =C2=A0 =C2=A0Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-04-29 14:39:28 +0000

=C2=A0 =C2=A0 libnv: switch fd_wait() from select(2) to poll(2)

=C2=A0 =C2=A0 The previous implementation used FD_SET() on a stack-allocate= d fd_set,
=C2=A0 =C2=A0 which is an out-of-bounds write whenever the socket fd is >= ;=3D FD_SETSIZE
=C2=A0 =C2=A0 (1024).

This problem seems li= ke a more generic problem, after looking into sys/select.h

What about adding a check for the FD_SET about the variable is on = the stack or not? And enforce the FD_SETSIZE limit almost the same way as i= t is already done with fortify source.

Maybe the= =C2=A0https://lists.llvm.org/pipermail/llvm-dev/2013-October/066294.htm= l=C2=A0can be used (or abused) to implement this check.
=C2= =A0
Feel free to correct me, if I'm wrong.


=C2=A0 =C2=A0 Approved by:=C2=A0 =C2=A0 so
=C2=A0 =C2=A0 Security:=C2=A0 =C2=A0 =C2=A0 =C2=A0FreeBSD-SA-26:16.libnv =C2=A0 =C2=A0 Security:=C2=A0 =C2=A0 =C2=A0 =C2=A0CVE-2026-39457
=C2=A0 =C2=A0 Reported by:=C2=A0 =C2=A0 Joshua Rogers of AISLE Research Tea= m (https://aisle.com/)=
=C2=A0 =C2=A0 Reviewed by:=C2=A0 =C2=A0 markj
=C2=A0 =C2=A0 Differential Revision:=C2=A0 https://reviews.freebsd.org/D56689
---
=C2=A0lib/libnv/msgio.c=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| 12 +++----
=C2=A0lib/libnv/tests/nvlist_send_recv_test.c | 56 +++++++++++++++++++= ++++++++++++++
=C2=A02 files changed, 62 insertions(+), 6 deletions(-)

diff --git a/lib/libnv/msgio.c b/lib/libnv/msgio.c
index f6f75241ff06..de2994e47fef 100644
--- a/lib/libnv/msgio.c
+++ b/lib/libnv/msgio.c
@@ -32,10 +32,10 @@

=C2=A0#include <sys/param.h>
=C2=A0#include <sys/socket.h>
-#include <sys/select.h>

=C2=A0#include <errno.h>
=C2=A0#include <fcntl.h>
+#include <poll.h>
=C2=A0#include <stdbool.h>
=C2=A0#include <stdint.h>
=C2=A0#include <stdlib.h>
@@ -86,14 +86,14 @@ msghdr_add_fd(struct cmsghdr *cmsg, int fd)
=C2=A0static void
=C2=A0fd_wait(int fd, bool doread)
=C2=A0{
-=C2=A0 =C2=A0 =C2=A0 =C2=A0fd_set fds;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0struct pollfd pfd;

=C2=A0 =C2=A0 =C2=A0 =C2=A0 PJDLOG_ASSERT(fd >=3D 0);

-=C2=A0 =C2=A0 =C2=A0 =C2=A0FD_ZERO(&fds);
-=C2=A0 =C2=A0 =C2=A0 =C2=A0FD_SET(fd, &fds);
-=C2=A0 =C2=A0 =C2=A0 =C2=A0(void)select(fd + 1, doread ? &fds : NULL, = doread ? NULL : &fds,
-=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0NULL, NULL);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0pfd.fd =3D fd;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0pfd.events =3D doread ? POLLIN : POLLOUT;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0pfd.revents =3D 0;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0(void)poll(&pfd, 1, -1);
=C2=A0}

=C2=A0static int
diff --git a/lib/libnv/tests/nvlist_send_recv_test.c b/lib/libnv/tests= /nvlist_send_recv_test.c
index 4a5c10df656d..d655a26a7362 100644
--- a/lib/libnv/tests/nvlist_send_recv_test.c
+++ b/lib/libnv/tests/nvlist_send_recv_test.c
@@ -27,6 +27,8 @@
=C2=A0 */

=C2=A0#include <sys/param.h>
+#include <sys/resource.h>
+#include <sys/select.h>
=C2=A0#include <sys/socket.h>
=C2=A0#include <sys/sysctl.h>
=C2=A0#include <sys/wait.h>
@@ -531,6 +533,59 @@ ATF_TC_BODY(nvlist_send_recv__send_nvlist__stream= , tc)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 nvlist_send_recv__send_nvlist(SOCK_STREAM)= ;
=C2=A0}

+/*
+ * Regression test for fd_wait(): the previous select(2)-based implementat= ion
+ * called FD_SET() unconditionally, which is an out-of-bounds stack write = when
+ * the socket fd is >=3D FD_SETSIZE.=C2=A0 Force the socketpair fds abo= ve FD_SETSIZE
+ * and verify a full nvlist round-trip still works.
+ */
+ATF_TC_WITHOUT_HEAD(nvlist_send_recv__highfd);
+ATF_TC_BODY(nvlist_send_recv__highfd, tc)
+{
+=C2=A0 =C2=A0 =C2=A0 =C2=A0struct rlimit rl;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0nvlist_t *nvl;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0int socks[2], hi_send, hi_recv, status;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0pid_t pid;
+
+=C2=A0 =C2=A0 =C2=A0 =C2=A0hi_send =3D FD_SETSIZE + 5;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0hi_recv =3D FD_SETSIZE + 6;
+
+=C2=A0 =C2=A0 =C2=A0 =C2=A0rl.rlim_cur =3D rl.rlim_max =3D hi_recv + 1; +=C2=A0 =C2=A0 =C2=A0 =C2=A0if (setrlimit(RLIMIT_NOFILE, &rl) !=3D 0) +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0atf_tc_skip("c= annot raise RLIMIT_NOFILE: %s", strerror(errno));
+
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(socketpair(PF_UNIX, SOCK_STREA= M, 0, socks) =3D=3D 0);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(dup2(socks[0], hi_recv) =3D=3D hi_r= ecv);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(dup2(socks[1], hi_send) =3D=3D hi_s= end);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0(void)close(socks[0]);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0(void)close(socks[1]);
+
+=C2=A0 =C2=A0 =C2=A0 =C2=A0pid =3D fork();
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(pid >=3D 0);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0if (pid =3D=3D 0) {
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/* Child: send. */<= br> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0(void)close(hi_recv= );
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0nvl =3D nvlist_crea= te(0);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0nvlist_add_string(n= vl, "key", "value");
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0if (nvlist_send(hi_= send, nvl) !=3D 0)
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0err(EXIT_FAILURE, "nvlist_send");
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0nvlist_destroy(nvl)= ;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0_exit(0);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0}
+
+=C2=A0 =C2=A0 =C2=A0 =C2=A0(void)close(hi_send);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0nvl =3D nvlist_recv(hi_recv, 0);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(nvl !=3D NULL);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(nvlist_error(nvl) =3D=3D 0);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(nvlist_exists_string(nvl, &quo= t;key"));
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(strcmp(nvlist_get_string(nvl, = "key"), "value") =3D=3D 0);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0nvlist_destroy(nvl);
+
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(waitpid(pid, &status, 0) =3D=3D= pid);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(status =3D=3D 0);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0(void)close(hi_recv);
+}
+
=C2=A0ATF_TC_WITHOUT_HEAD(nvlist_send_recv__send_closed_fd__dgram= );
=C2=A0ATF_TC_BODY(nvlist_send_recv__send_closed_fd__dgram, tc)
=C2=A0{
@@ -734,6 +789,7 @@ ATF_TP_ADD_TCS(tp)

=C2=A0 =C2=A0 =C2=A0 =C2=A0 ATF_TP_ADD_TC(tp, nvlist_send_recv__send_nvlist= __dgram);
=C2=A0 =C2=A0 =C2=A0 =C2=A0 ATF_TP_ADD_TC(tp, nvlist_send_recv__send_nvlist= __stream);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_TP_ADD_TC(tp, nvlist_send_recv__highfd); =C2=A0 =C2=A0 =C2=A0 =C2=A0 ATF_TP_ADD_TC(tp, nvlist_send_recv__send_closed= _fd__dgram);
=C2=A0 =C2=A0 =C2=A0 =C2=A0 ATF_TP_ADD_TC(tp, nvlist_send_recv__send_closed= _fd__stream);
=C2=A0 =C2=A0 =C2=A0 =C2=A0 ATF_TP_ADD_TC(tp, nvlist_send_recv__send_many_<= wbr>fds__dgram);

--0000000000002a8ab80650bd20fd--