Re: file descripter leak in current with Qmail?

On Mon, 7 Jun 2004, Arjan van Leeuwen wrote:

> On Monday 07 June 2004 21:42, you wrote:
> > On Mon, 7 Jun 2004, Arjan van Leeuwen wrote:
> > > > > In terms of debugging it: your first task it to identify if there's
> > > > > one process that's holding all the fd's, or if it is distributed over
> > > > > many proceses.  After that, you want to track down what kind of fd is
> > > > > being left open, which may help you track down why it's left open...
> > > >
> > > > Just as I'm reading this, I'm seeing the same thing on my -CURRENT
> > > > server, which has a _very_ low load (atm, it's only routing the
> > > > internet traffic for 3 users and serving SMTP for 2 of them). I'm also
> > > > running qmail. The kernel is from June 6. How do I go about
> > > > investigating this further?
> > >
> > > Replying to myself -
> > > fstat shows all open files evenly distributed among the running
> > > processes.
> >
> > It could be that this is related to the esd file descriptor leak problem
> > also being reported.  You might also try the attached patch.
> 
> I get a panic (address not allocated) when using the patch. I can't
> write down any useful details about it right now, because although the
> server has only 3 users, they're very disconcerned when I disrupt their
> internet traffic :). 

Doh.  Sorry about that.  Revised patch attached.  I'm able to test the
leak with the attached C file, and on my test box (now that it doesn't
panic), the leak appears fixed for non-blocking accepts. 

Robert N M Watson             FreeBSD Core Team, TrustedBSD Projects
robert_at_fledge.watson.org      Senior Research Scientist, McAfee Research

Index: uipc_syscalls.c
===================================================================
RCS file: /data/ncvs/src/sys/kern/uipc_syscalls.c,v
retrieving revision 1.187
diff -u -r1.187 uipc_syscalls.c
--- uipc_syscalls.c	7 Jun 2004 09:59:50 -0000	1.187
+++ uipc_syscalls.c	7 Jun 2004 20:21:30 -0000
_at__at_ -253,7 +253,7 _at__at_
 {
 	struct filedesc *fdp;
 	struct file *nfp = NULL;
-	struct sockaddr *sa;
+	struct sockaddr *sa = NULL;
 	socklen_t namelen;
 	int error;
 	struct socket *head, *so;
_at__at_ -285,7 +285,7 _at__at_
 	if ((head->so_state & SS_NBIO) && TAILQ_EMPTY(&head->so_comp)) {
 		ACCEPT_UNLOCK();
 		error = EWOULDBLOCK;
-		goto done;
+		goto noconnection;
 	}
 	while (TAILQ_EMPTY(&head->so_comp) && head->so_error == 0) {
 		if (head->so_state & SS_CANTRCVMORE) {
_at__at_ -296,14 +296,14 _at__at_
 		    "accept", 0);
 		if (error) {
 			ACCEPT_UNLOCK();
-			goto done;
+			goto noconnection;
 		}
 	}
 	if (head->so_error) {
 		error = head->so_error;
 		head->so_error = 0;
 		ACCEPT_UNLOCK();
-		goto done;
+		goto noconnection;
 	}
 	so = TAILQ_FIRST(&head->so_comp);
 	KASSERT(!(so->so_qstate & SQ_INCOMP), ("accept1: so SQ_INCOMP"));


#include <sys/types.h>
#include <sys/socket.h>

#include <netinet/in.h>

#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int
main(int argc, char *argv[])
{
	struct sockaddr_in sin;
	socklen_t size;
	int i, s;

	s = socket(PF_INET, SOCK_STREAM, 0);
	if (s == -1) {
		perror("socket");
		exit(-1);
	}

	bzero(&sin, sizeof(sin));
	sin.sin_len = sizeof(sin);
	sin.sin_family = AF_INET;
	sin.sin_addr.s_addr = INADDR_ANY;
	sin.sin_port = htons(8080);

	if (bind(s, (struct sockaddr *) &sin, sizeof(sin)) != 0) {
		perror("bind");
		exit(-1);
	}

	if (listen(s, -1) != 0) {
		perror("listen");
		exit(-1);
	}

	i = 1;
	if (fcntl(s, O_NONBLOCK, &i) != 0) {
		perror("O_NONBLOCK");
		exit(-1);
	}

	for (i = 0; i < 1000; i++)
		accept(s, (struct sockaddr *)&sin, &size);

	printf("fd returned by open(/dev/null) = %d\n",
	   open("/dev/null", O_RDONLY));

	return (0);
}