From nobody Fri May 1 08:11:17 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4g6NzL2CnQz6c7WR for ; Fri, 01 May 2026 08:11:26 +0000 (UTC) (envelope-from oliver.pntr@gmail.com) Received: from mail-yx1-xb132.google.com (mail-yx1-xb132.google.com [IPv6:2607:f8b0:4864:20::b132]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "WR4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4g6NzK4z8lz3j4N for ; Fri, 01 May 2026 08:11:25 +0000 (UTC) (envelope-from oliver.pntr@gmail.com) Authentication-Results: mx1.freebsd.org; dkim=pass header.d=gmail.com header.s=20251104 header.b=LuUHD7mx; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (mx1.freebsd.org: domain of oliver.pntr@gmail.com designates 2607:f8b0:4864:20::b132 as permitted sender) smtp.mailfrom=oliver.pntr@gmail.com; arc=pass ("google.com:s=arc-20240605:i=1") Received: by mail-yx1-xb132.google.com with SMTP id 956f58d0204a3-6563f83ae9fso2032456d50.1 for ; Fri, 01 May 2026 01:11:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1777623079; cv=none; d=google.com; s=arc-20240605; b=aFl4ZdjCF//wLbpg8S2B0sfGSKRc8R6yjUTT2FuO0MG+2NBvLrWtX84K7B9/6CWE7O +M+vyO8FtU7NFdAK4/7EUJpCBbZZYz+Vi9yZSPpi/rrDLGj8yRQutfyJR0ZzHVg0nhw2 JmNz0b26r2sQji74/pCNGwBIXQAruLYAfzahZCisAkVIQDH9M+k1UnqUCIek25VwhtxN 9al0l36tQj8RiloVo5oL3YBfo4BK8lPOJgxfYqShlS7XTw/dbOexLwUc61Rvdb5VJqHm OeD7HDvkjUkIcZu28SuMvGTpMlZtD5uilx0ShyZHUKtK70VvBsDW24KV4xIYd1w4y1MI budQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=cc:to:subject:message-id:date:from:references:in-reply-to :mime-version:dkim-signature; bh=A/IPIE/pM9mntYa6vB/UUxLL14EyCVD8IwUPKXlG6+w=; fh=J/On5DkferkigE01hAw17DEX61Oi3kF2dEHkVXq1I5g=; b=ItA0KFy72giG+B07ECyAaNax3MavxFzacCeTizcv7yV8JdAb+/la++gvYGHnsc/uOu iN0H/iXuR7Qm/cXEWT3sg/esHNDPPwaR8Z/KjGmHXgkaGZ52wMcKzB8Kg81V7C5LhiNy 6JMVOzuFYxcn/66TDN0772SdF8+tJuiNo0sgueP4v6Teop+uEt0XACguQb2PvjS/8RiZ SnPfoazT+KkAWnVkiALxb3+13+PYmEijUjbpQv3fdi+ScLLKvY1fi/T4g5TdKxJgPmBb W6BJ9a77XpLHLKn2N0ZvzW6FsUaSj2Lp36GihDJyg+COSl6Nm3IKQNnCYLQUZ2uyxVMY pSdw==; darn=freebsd.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1777623079; x=1778227879; darn=freebsd.org; h=cc:to:subject:message-id:date:from:references:in-reply-to :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=A/IPIE/pM9mntYa6vB/UUxLL14EyCVD8IwUPKXlG6+w=; b=LuUHD7mxyPIdEANbU9vByiGoMMOxSkMNE49+RXsM+Sdw3I78sUKNa/8AeDRY81RZm3 duwE6rI9yPtte82SxsSG4gCCvXKeWNVbViV9ffjBUS1P5xv49MLU/FvSs6wfEsE89UuZ rOVSycE6UtHqxfG/Qj8LSdEo2Y6yOlpQFmHvY0Nhm/eGL7mtCOGc60z58b2AEE/k+5JU Ggegvi56AUrbave9elM7qbQrDRn+UeLjwbxrX8daqAZOdO2QUIhH0mPZJedaLX/tBDaB 0N6enGn54hg6TnfT3gyARWzgLh7HdFV4PycUDIJOnFeCWkImjhmHmrm3OdgdX+Ilietp ZKtg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777623079; x=1778227879; h=cc:to:subject:message-id:date:from:references:in-reply-to :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=A/IPIE/pM9mntYa6vB/UUxLL14EyCVD8IwUPKXlG6+w=; b=W2jrBM7FprWyfy1nq9CVWII4RjE5aZjWW7wwY3WUUW68/xKPND0uagzsozbF9kucNG B74g0hh3p/5qAMCHPWDCZxM7AlqIuHsIpMZ9SPltpROvadZOqHBZqjBnU85rSicnMsUm 96DAs/sStDbBLeYol8FCZ1iItyG/PTYpYbxHGULFQ2PMGqh1sGCmpuMYHON2vgc6kPq0 tAm3Ct/RBZ7j80Ea7fh67ERDRj2x4J6eOxTHTuSQXyO2PXuy0Akg6DyLFr+K4fEezxIZ jN4zUunBy6fpxcDuHt9Kp0coMH0tgajdilgQ/fZQjGwjARplj8jmSUcOfRfBT9CBMuGq CPpw== X-Forwarded-Encrypted: i=1; AFNElJ8f7JbPf49U65TPsinELQ4xMsFGkb6cWSRZMODfL2Qg5O+g6MuYG8e4MfhBeyCZfDOg0ZXnPXbf42JB9mYy1rLAmJVU@freebsd.org X-Gm-Message-State: AOJu0YxP4H+1XCVR1HFbbompG8GKDDprJcR/swq5vSy/RO8X8I6M6jl5 DmTJTiAzkJiVZNTk2BT09frv77uNnH1HyJSGmIBJS/an5NTk3njgbSZtIF86YdJnUS/TN/dFaAD BoiXchPAnKgVrozp5Fh5V6a2YA8naoOU= X-Gm-Gg: AeBDietNudvSFAWvsCr5ExsAISBQIm6DasLHrj66fJLiBc83hmfo6PzxGAMXIA55idd n4Rg6JW66NRK2sxZ/Q5obdI+mqlKtJt8n06rTE+xzMwcJIuCU9i1ir8qrN4znFANOvsRYa10OtY 7SgVA4KUsSSx90xeDW0AWbNGV4xlp/Ne9s80ZS06RV0wb60lHPKNoafKLYrtujWEQClzSuEEIQ+ fSlhgi4/2AtJ0n8SkSjLZcFLMVPH4gkTULf1SFurUdsNIx7bwZgU3sBEFmRnVjs4JmzhP4a0IkW kVY7ffpq6AVi3KbO676prVM8kbLb4OFTpMo4zscJEd2jbaR8XJYsGbng/LcFfw== X-Received: by 2002:a05:690e:118a:b0:651:b593:d3cb with SMTP id 956f58d0204a3-65c35e0475bmr590837d50.24.1777623078962; Fri, 01 May 2026 01:11:18 -0700 (PDT) List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Received: by 2002:a05:7011:b05:b0:515:7a65:37dc with HTTP; Fri, 1 May 2026 01:11:17 -0700 (PDT) In-Reply-To: <69f219fc.3d583.73783562@gitrepo.freebsd.org> References: <69f219fc.3d583.73783562@gitrepo.freebsd.org> From: Oliver Pinter Date: Fri, 1 May 2026 09:11:17 +0100 X-Gm-Features: AVHnY4IsiLAPo2HThGG5Si0V_lmMxCRaEd3Imq7l3TI1Gb3PMKaIc7p0fYVQid4 Message-ID: Subject: Re: git: f5ea3dce2cbe - main - libnv: switch fd_wait() from select(2) to poll(2) To: Mark Johnston Cc: "src-committers@freebsd.org" , "dev-commits-src-all@freebsd.org" , "dev-commits-src-main@freebsd.org" , Mariusz Zaborski Content-Type: multipart/alternative; boundary="0000000000002a8ab80650bd20fd" X-Spamd-Result: default: False [-4.97 / 15.00]; ARC_ALLOW(-1.00)[google.com:s=arc-20240605:i=1]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_SHORT(-0.97)[-0.967]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; R_DKIM_ALLOW(-0.20)[gmail.com:s=20251104]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4864::/56:c]; MIME_GOOD(-0.10)[multipart/alternative,text/plain]; RCVD_TLS_LAST(0.00)[]; TO_DN_EQ_ADDR_SOME(0.00)[]; MIME_TRACE(0.00)[0:+,1:+,2:~]; FREEMAIL_ENVFROM(0.00)[gmail.com]; TAGGED_FROM(0.00)[]; DWL_DNSWL_NONE(0.00)[gmail.com:dkim]; TO_DN_SOME(0.00)[]; FREEMAIL_FROM(0.00)[gmail.com]; FROM_HAS_DN(0.00)[]; MISSING_XM_UA(0.00)[]; RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::b132:from]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RCVD_COUNT_TWO(0.00)[2]; FROM_EQ_ENVFROM(0.00)[]; DKIM_TRACE(0.00)[gmail.com:+]; PREVIOUSLY_DELIVERED(0.00)[dev-commits-src-all@freebsd.org]; MLMMJ_DEST(0.00)[dev-commits-src-all@freebsd.org]; MID_RHS_MATCH_FROMTLD(0.00)[]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; RCPT_COUNT_FIVE(0.00)[5] X-Spamd-Bar: ---- X-Rspamd-Queue-Id: 4g6NzK4z8lz3j4N --0000000000002a8ab80650bd20fd Content-Type: text/plain; charset="UTF-8" On Wednesday, April 29, 2026, Mark Johnston wrote: > The branch main has been updated by markj: > > URL: https://cgit.FreeBSD.org/src/commit/?id= > f5ea3dce2cbe1ee2068c5e5c11bb066f5789685b > > commit f5ea3dce2cbe1ee2068c5e5c11bb066f5789685b > Author: Mariusz Zaborski > AuthorDate: 2026-04-28 14:35:10 +0000 > Commit: Mark Johnston > CommitDate: 2026-04-29 14:39:28 +0000 > > libnv: switch fd_wait() from select(2) to poll(2) > > The previous implementation used FD_SET() on a stack-allocated fd_set, > which is an out-of-bounds write whenever the socket fd is >= FD_SETSIZE > (1024). This problem seems like a more generic problem, after looking into sys/select.h What about adding a check for the FD_SET about the variable is on the stack or not? And enforce the FD_SETSIZE limit almost the same way as it is already done with fortify source. Maybe the https://lists.llvm.org/pipermail/llvm-dev/2013-October/066294.html can be used (or abused) to implement this check. Feel free to correct me, if I'm wrong. > Approved by: so > Security: FreeBSD-SA-26:16.libnv > Security: CVE-2026-39457 > Reported by: Joshua Rogers of AISLE Research Team ( > https://aisle.com/) > Reviewed by: markj > Differential Revision: https://reviews.freebsd.org/D56689 > --- > lib/libnv/msgio.c | 12 +++---- > lib/libnv/tests/nvlist_send_recv_test.c | 56 > +++++++++++++++++++++++++++++++++ > 2 files changed, 62 insertions(+), 6 deletions(-) > > diff --git a/lib/libnv/msgio.c b/lib/libnv/msgio.c > index f6f75241ff06..de2994e47fef 100644 > --- a/lib/libnv/msgio.c > +++ b/lib/libnv/msgio.c > @@ -32,10 +32,10 @@ > > #include > #include > -#include > > #include > #include > +#include > #include > #include > #include > @@ -86,14 +86,14 @@ msghdr_add_fd(struct cmsghdr *cmsg, int fd) > static void > fd_wait(int fd, bool doread) > { > - fd_set fds; > + struct pollfd pfd; > > PJDLOG_ASSERT(fd >= 0); > > - FD_ZERO(&fds); > - FD_SET(fd, &fds); > - (void)select(fd + 1, doread ? &fds : NULL, doread ? NULL : &fds, > - NULL, NULL); > + pfd.fd = fd; > + pfd.events = doread ? POLLIN : POLLOUT; > + pfd.revents = 0; > + (void)poll(&pfd, 1, -1); > } > > static int > diff --git a/lib/libnv/tests/nvlist_send_recv_test.c > b/lib/libnv/tests/nvlist_send_recv_test.c > index 4a5c10df656d..d655a26a7362 100644 > --- a/lib/libnv/tests/nvlist_send_recv_test.c > +++ b/lib/libnv/tests/nvlist_send_recv_test.c > @@ -27,6 +27,8 @@ > */ > > #include > +#include > +#include > #include > #include > #include > @@ -531,6 +533,59 @@ ATF_TC_BODY(nvlist_send_recv__send_nvlist__stream, > tc) > nvlist_send_recv__send_nvlist(SOCK_STREAM); > } > > +/* > + * Regression test for fd_wait(): the previous select(2)-based > implementation > + * called FD_SET() unconditionally, which is an out-of-bounds stack write > when > + * the socket fd is >= FD_SETSIZE. Force the socketpair fds above > FD_SETSIZE > + * and verify a full nvlist round-trip still works. > + */ > +ATF_TC_WITHOUT_HEAD(nvlist_send_recv__highfd); > +ATF_TC_BODY(nvlist_send_recv__highfd, tc) > +{ > + struct rlimit rl; > + nvlist_t *nvl; > + int socks[2], hi_send, hi_recv, status; > + pid_t pid; > + > + hi_send = FD_SETSIZE + 5; > + hi_recv = FD_SETSIZE + 6; > + > + rl.rlim_cur = rl.rlim_max = hi_recv + 1; > + if (setrlimit(RLIMIT_NOFILE, &rl) != 0) > + atf_tc_skip("cannot raise RLIMIT_NOFILE: %s", > strerror(errno)); > + > + ATF_REQUIRE(socketpair(PF_UNIX, SOCK_STREAM, 0, socks) == 0); > + ATF_REQUIRE(dup2(socks[0], hi_recv) == hi_recv); > + ATF_REQUIRE(dup2(socks[1], hi_send) == hi_send); > + (void)close(socks[0]); > + (void)close(socks[1]); > + > + pid = fork(); > + ATF_REQUIRE(pid >= 0); > + if (pid == 0) { > + /* Child: send. */ > + (void)close(hi_recv); > + nvl = nvlist_create(0); > + nvlist_add_string(nvl, "key", "value"); > + if (nvlist_send(hi_send, nvl) != 0) > + err(EXIT_FAILURE, "nvlist_send"); > + nvlist_destroy(nvl); > + _exit(0); > + } > + > + (void)close(hi_send); > + nvl = nvlist_recv(hi_recv, 0); > + ATF_REQUIRE(nvl != NULL); > + ATF_REQUIRE(nvlist_error(nvl) == 0); > + ATF_REQUIRE(nvlist_exists_string(nvl, "key")); > + ATF_REQUIRE(strcmp(nvlist_get_string(nvl, "key"), "value") == 0); > + nvlist_destroy(nvl); > + > + ATF_REQUIRE(waitpid(pid, &status, 0) == pid); > + ATF_REQUIRE(status == 0); > + (void)close(hi_recv); > +} > + > ATF_TC_WITHOUT_HEAD(nvlist_send_recv__send_closed_fd__dgram); > ATF_TC_BODY(nvlist_send_recv__send_closed_fd__dgram, tc) > { > @@ -734,6 +789,7 @@ ATF_TP_ADD_TCS(tp) > > ATF_TP_ADD_TC(tp, nvlist_send_recv__send_nvlist__dgram); > ATF_TP_ADD_TC(tp, nvlist_send_recv__send_nvlist__stream); > + ATF_TP_ADD_TC(tp, nvlist_send_recv__highfd); > ATF_TP_ADD_TC(tp, nvlist_send_recv__send_closed_fd__dgram); > ATF_TP_ADD_TC(tp, nvlist_send_recv__send_closed_fd__stream); > ATF_TP_ADD_TC(tp, nvlist_send_recv__send_many_fds__dgram); > > --0000000000002a8ab80650bd20fd Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Wednesday, April 29, 2026, Mark Johnston <markj@freebsd.org> wrote:
The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=3Df5ea3dce2cbe1ee2068c5e5c11bb066f5789685b

commit f5ea3dce2cbe1ee2068c5e5c11bb066f5789685b
Author:=C2=A0 =C2=A0 =C2=A0Mariusz Zaborski <oshogbo@FreeBSD.org>
AuthorDate: 2026-04-28 14:35:10 +0000
Commit:=C2=A0 =C2=A0 =C2=A0Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-04-29 14:39:28 +0000

=C2=A0 =C2=A0 libnv: switch fd_wait() from select(2) to poll(2)

=C2=A0 =C2=A0 The previous implementation used FD_SET() on a stack-allocate= d fd_set,
=C2=A0 =C2=A0 which is an out-of-bounds write whenever the socket fd is >= ;=3D FD_SETSIZE
=C2=A0 =C2=A0 (1024).

This problem seems li= ke a more generic problem, after looking into sys/select.h

What about adding a check for the FD_SET about the variable is on = the stack or not? And enforce the FD_SETSIZE limit almost the same way as i= t is already done with fortify source.

Maybe the= =C2=A0https://lists.llvm.org/pipermail/llvm-dev/2013-October/066294.htm= l=C2=A0can be used (or abused) to implement this check.
=C2= =A0
Feel free to correct me, if I'm wrong.


=C2=A0 =C2=A0 Approved by:=C2=A0 =C2=A0 so
=C2=A0 =C2=A0 Security:=C2=A0 =C2=A0 =C2=A0 =C2=A0FreeBSD-SA-26:16.libnv =C2=A0 =C2=A0 Security:=C2=A0 =C2=A0 =C2=A0 =C2=A0CVE-2026-39457
=C2=A0 =C2=A0 Reported by:=C2=A0 =C2=A0 Joshua Rogers of AISLE Research Tea= m (https://aisle.com/)=
=C2=A0 =C2=A0 Reviewed by:=C2=A0 =C2=A0 markj
=C2=A0 =C2=A0 Differential Revision:=C2=A0 https://reviews.freebsd.org/D56689
---
=C2=A0lib/libnv/msgio.c=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0| 12 +++----
=C2=A0lib/libnv/tests/nvlist_send_recv_test.c | 56 +++++++++++++++++++= ++++++++++++++
=C2=A02 files changed, 62 insertions(+), 6 deletions(-)

diff --git a/lib/libnv/msgio.c b/lib/libnv/msgio.c
index f6f75241ff06..de2994e47fef 100644
--- a/lib/libnv/msgio.c
+++ b/lib/libnv/msgio.c
@@ -32,10 +32,10 @@

=C2=A0#include <sys/param.h>
=C2=A0#include <sys/socket.h>
-#include <sys/select.h>

=C2=A0#include <errno.h>
=C2=A0#include <fcntl.h>
+#include <poll.h>
=C2=A0#include <stdbool.h>
=C2=A0#include <stdint.h>
=C2=A0#include <stdlib.h>
@@ -86,14 +86,14 @@ msghdr_add_fd(struct cmsghdr *cmsg, int fd)
=C2=A0static void
=C2=A0fd_wait(int fd, bool doread)
=C2=A0{
-=C2=A0 =C2=A0 =C2=A0 =C2=A0fd_set fds;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0struct pollfd pfd;

=C2=A0 =C2=A0 =C2=A0 =C2=A0 PJDLOG_ASSERT(fd >=3D 0);

-=C2=A0 =C2=A0 =C2=A0 =C2=A0FD_ZERO(&fds);
-=C2=A0 =C2=A0 =C2=A0 =C2=A0FD_SET(fd, &fds);
-=C2=A0 =C2=A0 =C2=A0 =C2=A0(void)select(fd + 1, doread ? &fds : NULL, = doread ? NULL : &fds,
-=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0NULL, NULL);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0pfd.fd =3D fd;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0pfd.events =3D doread ? POLLIN : POLLOUT;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0pfd.revents =3D 0;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0(void)poll(&pfd, 1, -1);
=C2=A0}

=C2=A0static int
diff --git a/lib/libnv/tests/nvlist_send_recv_test.c b/lib/libnv/tests= /nvlist_send_recv_test.c
index 4a5c10df656d..d655a26a7362 100644
--- a/lib/libnv/tests/nvlist_send_recv_test.c
+++ b/lib/libnv/tests/nvlist_send_recv_test.c
@@ -27,6 +27,8 @@
=C2=A0 */

=C2=A0#include <sys/param.h>
+#include <sys/resource.h>
+#include <sys/select.h>
=C2=A0#include <sys/socket.h>
=C2=A0#include <sys/sysctl.h>
=C2=A0#include <sys/wait.h>
@@ -531,6 +533,59 @@ ATF_TC_BODY(nvlist_send_recv__send_nvlist__stream= , tc)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 nvlist_send_recv__send_nvlist(SOCK_STREAM)= ;
=C2=A0}

+/*
+ * Regression test for fd_wait(): the previous select(2)-based implementat= ion
+ * called FD_SET() unconditionally, which is an out-of-bounds stack write = when
+ * the socket fd is >=3D FD_SETSIZE.=C2=A0 Force the socketpair fds abo= ve FD_SETSIZE
+ * and verify a full nvlist round-trip still works.
+ */
+ATF_TC_WITHOUT_HEAD(nvlist_send_recv__highfd);
+ATF_TC_BODY(nvlist_send_recv__highfd, tc)
+{
+=C2=A0 =C2=A0 =C2=A0 =C2=A0struct rlimit rl;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0nvlist_t *nvl;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0int socks[2], hi_send, hi_recv, status;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0pid_t pid;
+
+=C2=A0 =C2=A0 =C2=A0 =C2=A0hi_send =3D FD_SETSIZE + 5;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0hi_recv =3D FD_SETSIZE + 6;
+
+=C2=A0 =C2=A0 =C2=A0 =C2=A0rl.rlim_cur =3D rl.rlim_max =3D hi_recv + 1; +=C2=A0 =C2=A0 =C2=A0 =C2=A0if (setrlimit(RLIMIT_NOFILE, &rl) !=3D 0) +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0atf_tc_skip("c= annot raise RLIMIT_NOFILE: %s", strerror(errno));
+
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(socketpair(PF_UNIX, SOCK_STREA= M, 0, socks) =3D=3D 0);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(dup2(socks[0], hi_recv) =3D=3D hi_r= ecv);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(dup2(socks[1], hi_send) =3D=3D hi_s= end);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0(void)close(socks[0]);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0(void)close(socks[1]);
+
+=C2=A0 =C2=A0 =C2=A0 =C2=A0pid =3D fork();
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(pid >=3D 0);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0if (pid =3D=3D 0) {
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/* Child: send. */<= br> +=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0(void)close(hi_recv= );
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0nvl =3D nvlist_crea= te(0);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0nvlist_add_string(n= vl, "key", "value");
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0if (nvlist_send(hi_= send, nvl) !=3D 0)
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0err(EXIT_FAILURE, "nvlist_send");
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0nvlist_destroy(nvl)= ;
+=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0_exit(0);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0}
+
+=C2=A0 =C2=A0 =C2=A0 =C2=A0(void)close(hi_send);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0nvl =3D nvlist_recv(hi_recv, 0);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(nvl !=3D NULL);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(nvlist_error(nvl) =3D=3D 0);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(nvlist_exists_string(nvl, &quo= t;key"));
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(strcmp(nvlist_get_string(nvl, = "key"), "value") =3D=3D 0);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0nvlist_destroy(nvl);
+
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(waitpid(pid, &status, 0) =3D=3D= pid);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_REQUIRE(status =3D=3D 0);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0(void)close(hi_recv);
+}
+
=C2=A0ATF_TC_WITHOUT_HEAD(nvlist_send_recv__send_closed_fd__dgram= );
=C2=A0ATF_TC_BODY(nvlist_send_recv__send_closed_fd__dgram, tc)
=C2=A0{
@@ -734,6 +789,7 @@ ATF_TP_ADD_TCS(tp)

=C2=A0 =C2=A0 =C2=A0 =C2=A0 ATF_TP_ADD_TC(tp, nvlist_send_recv__send_nvlist= __dgram);
=C2=A0 =C2=A0 =C2=A0 =C2=A0 ATF_TP_ADD_TC(tp, nvlist_send_recv__send_nvlist= __stream);
+=C2=A0 =C2=A0 =C2=A0 =C2=A0ATF_TP_ADD_TC(tp, nvlist_send_recv__highfd); =C2=A0 =C2=A0 =C2=A0 =C2=A0 ATF_TP_ADD_TC(tp, nvlist_send_recv__send_closed= _fd__dgram);
=C2=A0 =C2=A0 =C2=A0 =C2=A0 ATF_TP_ADD_TC(tp, nvlist_send_recv__send_closed= _fd__stream);
=C2=A0 =C2=A0 =C2=A0 =C2=A0 ATF_TP_ADD_TC(tp, nvlist_send_recv__send_many_<= wbr>fds__dgram);

--0000000000002a8ab80650bd20fd--