kern/167612: The portal file system gets stuck inside portal_open(). ("1 extra fds")

[Jukka Ukkonen]

>Number:         167612
>Category:       kern
>Synopsis:       The portal file system gets stuck inside portal_open(). ("1 extra fds")
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat May 05 13:00:21 UTC 2012
>Closed-Date:
>Last-Modified:
>Originator:     Jukka Ukkonen
>Release:        9.0-STABLE
>Organization:
---
>Environment:
FreeBSD sleipnir 9.0-STABLE FreeBSD 9.0-STABLE #0: Sat May  5 10:19:05 EEST 2012     root at sleipnir:/usr/obj/usr/src/sys/Sleipnir  amd64
>Description:
All attempts to refer to any file under the mounted portal file system end up waiting indefinitely.
Actually the portal ends up reading STDIN while it should be reading from a command.
E.g. the following command should simply list the output from who, but instead it does nothing until ctrl-D is given on the tty...

cat /p/pipe/usr/bin/who

At the same time the following complaint gets written to syslog...

May  5 15:28:36 sleipnir kernel: portal_open: 1 extra fds

Apparently the faulty takes place and gets also partially handled within the following snippet of code in portal_vnops.c ...

        cmsg = mtod(cm, struct cmsghdr *);
        newfds = (cmsg->cmsg_len - sizeof(*cmsg)) / sizeof (int);
        if (newfds == 0) {
                error = ECONNREFUSED;
                goto bad;
        }
        /*
         * At this point the rights message consists of a control message
         * header, followed by a data region containing a vector of
         * integer file descriptors.  The fds were allocated by the action
         * of receiving the control message.
         */
        ip = (int *) (cmsg + 1);
        fd = *ip++;
        if (newfds > 1) {
                /*
                 * Close extra fds.
                 */
                int i;
                printf("portal_open: %d extra fds\n", newfds - 1);
                for (i = 1; i < newfds; i++) {
                        portal_closefd(td, *ip);
                        ip++;
                }
        }

It seems that newfds gets calculated wrong and fd gets picked too early in the message.
After that the correct fd gets treated as extra and closed.

>How-To-Repeat:
See full description above.

>Fix:
Apparently some further jugglery with the control message is needed to get the data alignment right.
At the time of this writing I do not have a patch.


>Release-Note:
>Audit-Trail:
>Unformatted: