Issue created by Sang Woo Kim: https://gitlab.rtems.org/rtems/pkg/rtems-libbsd/-/work_items/103
## Summary `rtems_bsd_libio_fo_poll()` releases the reference `rtems_bsd_libio_iop_hold()` took, which is keyed by the libio descriptor. Its callers disagree about what to pass: | caller | branch | passes | | --- | --- | --- | | `selrescan()`, `selscan()` | 6-freebsd-12 | the libio descriptor | | `pollscan()`, `pollrescan()` | 6-freebsd-12 | the BSD descriptor | | `selrescan()`, `selscan()` | 7-freebsd-14, 6-freebsd-14 | the BSD descriptor, renamed over `fd` | | `pollrescan()` | 7-freebsd-14, 6-freebsd-14 | `(intptr_t)fd` — the address of the `struct pollfd` | The helper hides this by ignoring its argument whenever the descriptor is libbsd-backed and recovering the descriptor from `fp->f_io`. That holds only while one file has one descriptor; with #101 fixed, the scan of a duplicate charges the original. Two more in the same lines on `7-freebsd-14` and `6-freebsd-14`: `selrescan()` recomputes the `fd_set` bit index from the renamed descriptor, so it reports readiness on whichever bit the BSD number lands on; and the four scan sites pass `fp` to `fdrop()` / `fput_only_user()` unchecked, where `fp` is NULL for a descriptor that is not libbsd-backed. Also, every scan site reaches `rtems_bsd_libio_fo_poll()` only after `fget` has succeeded, so the `fget`-failure path returns or continues with the hold outstanding — on `7-freebsd-14` that path additionally abandons the rest of the `select()` scan. Fix: name the parameter `libio_fd`, have every caller pass the descriptor it held, drop the `fp->f_io` recovery, and acquire the hold and the file reference in one helper whose contract is that failure leaves nothing held. [7-freebsd-14](https://github.com/physwkim/rtems-libbsd/commit/ebe7749f4b1bc4362283b275b1e61f7aba1efc3f) · [6-freebsd-14](https://github.com/physwkim/rtems-libbsd/commit/e263c7611c56a2083147e90e519fc369ddff277e) · [6-freebsd-12](https://github.com/physwkim/rtems-libbsd/commit/6432575f02f10704db8665de6931447f14fc2ad8) -- View it on GitLab: https://gitlab.rtems.org/rtems/pkg/rtems-libbsd/-/work_items/103 You're receiving this email because of your account on gitlab.rtems.org. Unsubscribe from this thread: https://gitlab.rtems.org/-/sent_notifications/4-3roagx6ngaj1c5g98fb0o8ojo-k/unsubscribe | Manage all notifications: https://gitlab.rtems.org/-/profile/notifications | Help: https://gitlab.rtems.org/help
_______________________________________________ bugs mailing list [email protected] http://lists.rtems.org/mailman/listinfo/bugs
