NetBSD Problem Report #59056
From www@netbsd.org Fri Feb 7 19:36:44 2025
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
client-signature RSA-PSS (2048 bits) client-digest SHA256)
(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
by mollari.NetBSD.org (Postfix) with ESMTPS id A52081A923A
for <gnats-bugs@gnats.NetBSD.org>; Fri, 7 Feb 2025 19:36:44 +0000 (UTC)
Message-Id: <20250207193643.8A55D1A923C@mollari.NetBSD.org>
Date: Fri, 7 Feb 2025 19:36:43 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: poll POLLHUP bugs
X-Send-Pr-Version: www-1.0
>Number: 59056
>Category: kern
>Synopsis: poll POLLHUP bugs
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: kern-bug-people
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Fri Feb 07 19:40:01 +0000 2025
>Last-Modified: Tue Oct 06 02:05:00 +0000 2026
>Originator: Taylor R Campbell
>Release:
>Organization:
The NotPolleD Foundation
>Environment:
>Description:
If you open a {pipe, socketpair} and close the read side (either side for socket pair), polling the write side for POLLOUT returns:
- POLLHUP|POLLOUT, for pipe;
- POLLOUT, for socketpair.
The pipe case is wrong because POLLHUP and POLLOUT are mutually exclusive in POSIX:
POLLHUP
A device has been disconnected, or a pipe or FIFO has been closed by the last process that had it open for writing. [...] This event and POLLOUT are mutually-exclusive; a stream can never be writable if a hangup has occurred.
https://pubs.opengroup.org/onlinepubs/9699919799/functions/poll.html
The socketpair is also wrong because any attempt to write to the socket triggers SIGPIPE/EPIPE, so surely POLLHUP must be set for it.
>How-To-Repeat:
#include <sys/socket.h>
#include <err.h>
#include <poll.h>
#include <signal.h>
#include <stdio.h>
#include <unistd.h>
static void
ignoresig(int signo)
{
}
int
main(void)
{
int s[2];
struct pollfd pfd;
int i, nfds;
if (signal(SIGPIPE, ignoresig) == SIG_ERR)
err(1, "signal(SIGPIPE)");
if (socketpair(AF_LOCAL, SOCK_STREAM, 0, s) == -1)
err(1, "socketpair");
// if (pipe(s) == -1)
// err(1, "pipe");
pfd = (struct pollfd){ .fd = s[1], .events = POLLOUT };
nfds = poll(&pfd, 1, 0);
if (nfds == -1)
err(1, "poll");
printf("nfds=%d\n", nfds);
printf("[%d] .fd=%d .revents=0x%x\n", 0, pfd.fd, pfd.revents);
if (close(s[0]) == -1)
err(1, "close");
pfd = (struct pollfd){ .fd = s[1], .events = POLLOUT };
nfds = poll(&pfd, 1, 0);
if (nfds == -1)
err(1, "poll");
printf("nfds=%d\n", nfds);
printf("[%d] .fd=%d .revents=0x%x\n", 0, pfd.fd, pfd.revents);
fflush(stdout);
char ch = 0;
if (write(s[1], &ch, 1) == -1)
err(1, "write");
return ferror(stdout);
}
>Fix:
Yes, please!
>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/tests/lib/libc/sys
Date: Sun, 9 Feb 2025 17:09:51 +0000
Module Name: src
Committed By: riastradh
Date: Sun Feb 9 17:09:51 UTC 2025
Modified Files:
src/tests/lib/libc/sys: t_poll.c
Log Message:
t_poll: Make sure POLLOUT is clear when testing POLLHUP.
POLLOUT and POLLHUP are mutually exclusive in POSIX. Also, we're
only polling for POLLIN anyway.
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.8 -r1.9 src/tests/lib/libc/sys/t_poll.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/tests/lib/libc/sys
Date: Sun, 9 Feb 2025 17:10:23 +0000
Module Name: src
Committed By: riastradh
Date: Sun Feb 9 17:10:23 UTC 2025
Modified Files:
src/tests/lib/libc/sys: t_poll.c
Log Message:
t_poll: Tweak to improve diagnostics.
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.9 -r1.10 src/tests/lib/libc/sys/t_poll.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/tests/lib/libc/sys
Date: Sun, 9 Feb 2025 17:10:37 +0000
Module Name: src
Committed By: riastradh
Date: Sun Feb 9 17:10:37 UTC 2025
Modified Files:
src/tests/lib/libc/sys: Makefile t_poll.c
Log Message:
t_poll: Expand tests of polling when other endpoint is closed.
This covers fifos, pipes, and sockets; reads and writes; and polling
when the endpoint is already closed as well as sleeping until the
endpoint is closed after a delay.
Unfortunately, there is disagreement right now between:
(a) POSIX,
(b) our poll(2) man page, and
(c) our implementation,
for many of these cases. And we recently changed the behaviour of
poll(2) on fifos between 9 and 10 (PR kern/56429: poll(2) should
yield POLLHUP when last writer to a fifo close()'s it) but didn't get
it quite right.
So I've annotated these test cases with xfails for all the cases I
think we're currently doing wrong -- under a justification from some
combination of POSIX, our own documentation, and/or a reasonable
interpretation of what the semantics _should_ be based on how read(2)
and write(2) will behave. These are mostly edge cases:
1. [pollclosed_pipe_*_write*] When the read side of a pipe is closed,
poll(2) on the write side currently returns POLLHUP|POLLOUT, which
POSIX forbids because it requires POLLHUP to be mutually exclusive
with POLLOUT. And our man page concurs with POSIX on this rule,
and has for a long time (going as far back as NetBSD 1.3 or
earlier, judging by https://man.NetBSD.org/NetBSD-1.3/poll.2).
=> Fixing this won't change whether anything wakes up earlier or
later -- it will only change which bits are set when the
wakeups happen.
2. [pollclosed_fifo*_immediate_readsome] When the write side of a
fifo was previously open with the read side, and has since been
closed before calling poll(2), poll(2) on the read side returns 0
instead of POLLHUP|POLLIN as it is expected to, even though
read(2) will return EOF without blocking.
=> Fixing this may lead to more wakeups than before, but only in
cases where read(2) would actually return immediately anyway.
3. [pollclosed_fifo*_delayed_*_read] When the write side of a fifo is
closed, poll(2) on the read side returns POLLHUP|POLLIN, as it is
expected to. But this state currently isn't persistent, even
though the behaviour of read(2) in returning EOF without blocking
is persistent.
=> Fixing this may lead to more wakeups than before, but only in
cases where read(2) would actually return immediately anyway.
That said, it turns out that we are correct, according to POSIX, in
not setting POLLHUP on a socket whose peer has been closed: POLLHUP
is only for devices, pipes, and FIFOs. So one of the issues I
reported in PR 59056 turns out to be bogus. (Also POLLHUP is only
for the reader side anyway, not for the writer side.)
https://pubs.opengroup.org/onlinepubs/9799919799/functions/poll.html
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.77 -r1.78 src/tests/lib/libc/sys/Makefile
cvs rdiff -u -r1.10 -r1.11 src/tests/lib/libc/sys/t_poll.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/tests/lib/libc/sys
Date: Mon, 10 Feb 2025 02:41:34 +0000
Module Name: src
Committed By: riastradh
Date: Mon Feb 10 02:41:34 UTC 2025
Modified Files:
src/tests/lib/libc/sys: t_poll.c
Log Message:
t_poll: Extend the hangup tests to ptys too.
Of course, ptys work slightly differently from pipes and fifos and
sockets, presumably for hysterical raisins...
While here: add a more detailed comment to each xfail for the reason
why I think it is broken.
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.11 -r1.12 src/tests/lib/libc/sys/t_poll.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/tests/lib/libc/sys
Date: Wed, 23 Sep 2026 18:24:48 +0000
Module Name: src
Committed By: riastradh
Date: Wed Sep 23 18:24:48 UTC 2026
Modified Files:
src/tests/lib/libc/sys: t_poll.c
Log Message:
t_poll: Extend err test to cover POLLNVAL too.
Prompted by:
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.12 -r1.13 src/tests/lib/libc/sys/t_poll.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/tests/lib/libc/sys
Date: Wed, 23 Sep 2026 18:25:01 +0000
Module Name: src
Committed By: riastradh
Date: Wed Sep 23 18:25:01 UTC 2026
Modified Files:
src/tests/lib/libc/sys: t_poll.c
Log Message:
t_poll: Fix delayed_write checks.
1. Check the results of the poll(2) call that sleeps, not a
zero-timeout call instead -- not sure how that crept in.
2. Do also check a zero-timeout call at the end to make sure the
event state is persistent.
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.13 -r1.14 src/tests/lib/libc/sys/t_poll.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/tests/lib/libc/sys
Date: Wed, 23 Sep 2026 18:25:12 +0000
Module Name: src
Committed By: riastradh
Date: Wed Sep 23 18:25:12 UTC 2026
Modified Files:
src/tests/lib/libc/sys: t_poll.c
Log Message:
t_poll: Rename tests pollclosed -> pollclosedpeer.
These test what happens when we're polling a file descriptor for some
two-ended thing (pipe, fifo, socket, pty) and the _other_ end is
closed. This is to prepare for adding a suite of tests for when
_this_ end is closed, which I'll reuse the name `pollclosed' for.
Prompted by:
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.14 -r1.15 src/tests/lib/libc/sys/t_poll.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/tests/lib/libc/sys
Date: Wed, 23 Sep 2026 18:25:29 +0000
Module Name: src
Committed By: riastradh
Date: Wed Sep 23 18:25:29 UTC 2026
Modified Files:
src/tests/lib/libc/sys: t_poll.c
Log Message:
t_poll: Spruce up output of poll event bits.
Would be nice if we had a POLLFMT for use with snprintb(3)!
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.15 -r1.16 src/tests/lib/libc/sys/t_poll.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/tests/lib/libc/sys
Date: Wed, 23 Sep 2026 18:25:45 +0000
Module Name: src
Committed By: riastradh
Date: Wed Sep 23 18:25:45 UTC 2026
Modified Files:
src/tests/lib/libc/sys: t_poll.c
Log Message:
t_poll: Test concurrently closing an fd being polled.
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.16 -r1.17 src/tests/lib/libc/sys/t_poll.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src
Date: Fri, 2 Oct 2026 03:53:00 +0000
Module Name: src
Committed By: riastradh
Date: Fri Oct 2 03:53:00 UTC 2026
Modified Files:
src/sys/miscfs/fifofs: fifo_vnops.c
src/tests/lib/libc/sys: t_poll.c
Log Message:
fifo: Followups to fix previous fifo_vnops.c change.
1. Fix open so with O_RDONLY and not O_NONBLOCK, it will block as
POSIX specifies until there are writers -- not until there are
writers _or_ a read is possible without blocking (which is always
immediately true because read will immediately report EOF).
This was a regression in the previous change which I failed to
catch because I committed the change a few days ago to hg and
forgot that I hadn't yet run all the applicable tests when I
exported it to CVS today -- I had only done the background
research and thought about the semantics.
2. Clear xfail on various tests that were fixed by the change.
PR kern/59056: poll POLLHUP bugs
PR kern/60789: read on fifo without writer may block
To generate a diff of this commit:
cvs rdiff -u -r1.93 -r1.94 src/sys/miscfs/fifofs/fifo_vnops.c
cvs rdiff -u -r1.17 -r1.18 src/tests/lib/libc/sys/t_poll.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/sys/kern
Date: Sat, 3 Oct 2026 16:22:22 +0000
Module Name: src
Committed By: riastradh
Date: Sat Oct 3 16:22:22 UTC 2026
Modified Files:
src/sys/kern: sys_pipe.c
Log Message:
pipe(2): Rename pipe variables to make more sense.
- wpipe for the writer side of a pipe, associated with a file open
for FWRITE.
- rpipe for the writer side of a pipe, associated with a file open
for FREAD.
- pipe for either side of the pipe.
- ppipe for the peer corresponding to pipe.
No functional change intended.
Prompted by trying to wrap my head around this pipe(2) code in order
to address:
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.168 -r1.169 src/sys/kern/sys_pipe.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/sys/kern
Date: Sat, 3 Oct 2026 16:22:55 +0000
Module Name: src
Committed By: riastradh
Date: Sat Oct 3 16:22:55 UTC 2026
Modified Files:
src/sys/kern: sys_pipe.c
Log Message:
pipe(2): Split new function pipefree out of pipeclose.
Makes it easier to reason about pipeclose this way.
Prompted by:
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.169 -r1.170 src/sys/kern/sys_pipe.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/sys/kern
Date: Sat, 3 Oct 2026 16:23:46 +0000
Module Name: src
Committed By: riastradh
Date: Sat Oct 3 16:23:46 UTC 2026
Modified Files:
src/sys/kern: sys_pipe.c
Log Message:
pipe(2): Make pipe sides a little more symmetric.
1. When reading from or writing to a pipe, busy _this side_ of the
pipe, not the other side.
2. In pipeclose, all operations on _this side_ of the pipe have already
quiesced. But operations on the other side may not have. So wait
for the _other side_ to be unbusied before disconnecting the peer
(changing ppipe->pipe_peer from pipe to NULL).
With (1) and (2) we can prove a simple property that makes reasoning
about this code easier: If a pipe is busy, its peer pointer is stable
even across cv_wait on the pipe lock. Without these changes I'm not
sure I could prove that property (though I haven't exhibited a
reproducer for any issues arising from its failure).
3. Make write wait on wpipe->pipe_wcv, and make read wait on
rpipe->pipe_rcv, consistently, so that any waiters on one side of a
pipe will always be waiting on one of _that side's_ condvars.
This makes the logic in pipe_restart to wake any pending operations
on _this side_ simpler -- it doesn't have to reach over to the peer,
and it doesn't have to inadvertently wake the peer for no reason.
In fact this brings the text of the code in pipe_restart back to
what it was before I renamed the variables to reflect their actual
content, suggesting there has been some confusion from the variable
naming over the years...
(In a future change, I would like to merge pipe_rcv and pipe_wcv
into a single condvar per side -- no need to initialize two extra
condvars per pipe that will never be used!)
Preparation for:
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.171 -r1.172 src/sys/kern/sys_pipe.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/sys/kern
Date: Sat, 3 Oct 2026 16:24:04 +0000
Module Name: src
Committed By: riastradh
Date: Sat Oct 3 16:24:04 UTC 2026
Modified Files:
src/sys/kern: sys_pipe.c
Log Message:
pipe(2): Simplify PIPE_RESTART handling.
Now that it applies to each side independently, we can just make it
final, because new I/O operations are not allowed on an file that has
had its .fo_restart called. Makes reasoning about all this easier.
XXX Consider renaming PIPE_RESTART to PIPE_CLOSING: the .fo_restart
operation means the file is irreversibly destined to be closed soon
and just needs any pending I/O on it to be interrupted and fail
promptly so we can finally close the file.
Preparation for:
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.172 -r1.173 src/sys/kern/sys_pipe.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src
Date: Sat, 3 Oct 2026 16:26:51 +0000
Module Name: src
Committed By: riastradh
Date: Sat Oct 3 16:26:51 UTC 2026
Modified Files:
src/sys/kern: sys_pipe.c
src/tests/lib/libc/sys: t_poll.c t_sigio.c
Log Message:
pipe(2): Restructure select/poll/kqueue records.
1. When a thread is waiting on an endpoint of a pipe, have it wait on
_that endpoint_ (i.e., cv_wait or selrecord), not on the other
endpoint sometimes depending on the direction of the I/O.
2. Make poll(2) on the writer side of a pipe wake with POLLERR when
the reader side is closed, because write would return immediately,
and fail with EPIPE/SIGPIPE. See also:
https://mail-index.NetBSD.org/tech-kern/2026/09/21/msg031255.html
(In contrast, for the other way around, when the writer side of a
pipe is closed, poll(2) on the reader is already defined to wake
with POLLHUP, and while read would return immediately, it will not
_fail_; it will simply report EOF, so there is no justification
for POLLERR in that direction.)
3. For EVFILT_READ, require the reader side of a pipe; likewise, for
EVFILT_WRITE, require the writer side of a pipe. That this wasn't
enforced before was an accident, as far as I can tell, and made
the kevent paths very confusing about which side of the pipe is
which.
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.173 -r1.174 src/sys/kern/sys_pipe.c
cvs rdiff -u -r1.18 -r1.19 src/tests/lib/libc/sys/t_poll.c
cvs rdiff -u -r1.6 -r1.7 src/tests/lib/libc/sys/t_sigio.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/sys/kern
Date: Sat, 3 Oct 2026 16:28:04 +0000
Module Name: src
Committed By: riastradh
Date: Sat Oct 3 16:28:04 UTC 2026
Modified Files:
src/sys/kern: sys_pipe.c
Log Message:
pipe(2): Don't cv_wait_sig in a loop without breaking on signal.
If a signal does arrive, it will turn into a busy wait! Not helpful.
But this wait should be limited to scheduling delays for other
threads anyway, not for general I/O, so there's no need to be
interruptible by a signal.
Prompted by:
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.174 -r1.175 src/sys/kern/sys_pipe.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/tests/kernel/kqueue/write
Date: Sat, 3 Oct 2026 21:06:05 +0000
Module Name: src
Committed By: riastradh
Date: Sat Oct 3 21:06:05 UTC 2026
Modified Files:
src/tests/kernel/kqueue/write: t_pipe.c
Log Message:
kqueue/kernel/t_pipe: Fix newly failing test.
If the read side of a pipe has been closed, then for the write side:
- poll will set POLLOUT, not POLLNVAL (nor fail with EBADF), and
- select will report writable, not fail with EBADF,
because the write side is immediately writable and will fail with
EPIPE/SIGPIPE -- it won't block if you try to write.
So surely kqueue with EVFILT_WRITE should simply report immediately
writable too, not fail with EBADF. And that is what I caused to
happen by simplifying and clarifying the code and fixing various edge
cases. (The bad response that this test was added to check is a
kernel crash on null pointer dereference; that, fortunately, has not
regressed.)
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.2 -r1.3 src/tests/kernel/kqueue/write/t_pipe.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/sys/kern
Date: Mon, 5 Oct 2026 20:49:29 +0000
Module Name: src
Committed By: riastradh
Date: Mon Oct 5 20:49:28 UTC 2026
Modified Files:
src/sys/kern: sys_pipe.c
Log Message:
pipe(2): Plug mutex_obj leak.
This was introduced in what was supposed to be mere refactoring in
rev. 1.170 (pipe(2): Split new function pipefree out of pipeclose.) as
part of
PR kern/59056: poll POLLHUP bugs
I missed a spot, the mutex_obj_free in pipeclose, which should have
been moved into pipefree.
Noticed by mlelstv@.
To generate a diff of this commit:
cvs rdiff -u -r1.180 -r1.181 src/sys/kern/sys_pipe.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/sys
Date: Mon, 5 Oct 2026 21:01:22 +0000
Module Name: src
Committed By: riastradh
Date: Mon Oct 5 21:01:22 UTC 2026
Modified Files:
src/sys/kern: sys_pipe.c
src/sys/sys: pipe.h
Log Message:
Revert "pipe(2): Add memory safety diagnostics."
This was rather sloppily done (from my local tree, not cleaned up
before committing in haste in an attempt to help diagnose the spate
of crashes that have been seen today). Will redo this a little more
tidily.
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.181 -r1.182 src/sys/kern/sys_pipe.c
cvs rdiff -u -r1.44 -r1.45 src/sys/sys/pipe.h
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/sys/kern
Date: Mon, 5 Oct 2026 22:15:56 +0000
Module Name: src
Committed By: riastradh
Date: Mon Oct 5 22:15:56 UTC 2026
Modified Files:
src/sys/kern: sys_pipe.c
Log Message:
pipe(2): Fix possible use-after-free if both ends are closed at once.
Followup for:
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.183 -r1.184 src/sys/kern/sys_pipe.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/59056 CVS commit: src/sys/kern
Date: Tue, 6 Oct 2026 02:02:33 +0000
Module Name: src
Committed By: riastradh
Date: Tue Oct 6 02:02:33 UTC 2026
Modified Files:
src/sys/kern: sys_pipe.c
Log Message:
pipe(2): Fix possible null pointer deref if pipe_create fails.
Spotted by kre.
Followup for:
PR kern/59056: poll POLLHUP bugs
To generate a diff of this commit:
cvs rdiff -u -r1.185 -r1.186 src/sys/kern/sys_pipe.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
(Contact us)
$NetBSD: query-full-pr,v 1.51 2026/08/10 02:28:17 riastradh Exp $
$NetBSD: gnats_config.sh,v 1.10 2026/05/13 22:00:09 riastradh Exp $
Copyright © 1994-2026
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.
Home