Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

A dup of a timerfd, signalfd, inotify or netlink fd has no state behind it

Open
  • Is something wrong?
#412 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
52/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
c, linux
Domain
operating-systems

Research direction

Start with duplicate_guest_fd in src/syscall/fs.c, then read the side-table lookup and cleanup paths for timerfd, signalfd, inotify, and netlink. Compare the alias mapping and reference-counting approach in eventfd_dup_fd and pidfd_dup_ref/pidfd_map. Done means aliases share the original state until the last descriptor closes, and the listed operations work through either fd.

Written by the indexing model from the issue text.

Description

bug

dup(2) returns a second fd for the same open file description, so on Linux every operation works through either fd and the object lives until the last one is closed. Under elfuse a dup of a timerfd, signalfd, inotify or netlink fd is an fd of the right type with no state behind it.

duplicate_guest_fd (src/syscall/fs.c) copies these four types through the generic path: a new slot of the same type on a dup of the host fd, with the type's cleanup callback. Each type keeps its state in a side table whose entries record one guest fd number, the one the create call returned, and timerfd_find, signalfd_find, inotify_find and nl_find match on that number. A lookup by the alias's number finds no entry.

Single-threaded, on 9f12c41 and on Linux 6.12 (the qemu reference VM):

int fd = timerfd_create(CLOCK_MONOTONIC, TFD_NONBLOCK);
int alias = dup(fd);
struct itimerspec its = {.it_value = {.tv_nsec = 50 * 1000 * 1000}};

                                       /* Linux      elfuse */
timerfd_settime(alias, 0, &its, NULL); /* 0          EBADF  */
timerfd_settime(fd, 0, &its, NULL);    /* 0          0      */
timerfd_gettime(alias, &cur);          /* 0          EBADF  */
poll(&(struct pollfd){alias, POLLIN}, 1, 500);
                                       /* 1, POLLIN  1, POLLIN */
read(alias, &n, 8);                    /* 8          EBADF  */
read(fd, &n, 8);                       /* EAGAIN     8      */
close(fd);
timerfd_settime(alias, 0, &its, NULL); /* 0          EBADF  */

The alias shares the host kqueue, so poll reports it readable, and the read that follows fails. A loop that polls the alias and reads on POLLIN does not block again.

The other three fail the same way through the alias, with the original open or closed, where Linux 6.12 succeeds in both:

  • signalfd: signalfd(alias, &mask, 0) returns EINVAL.
  • inotify: inotify_add_watch(alias, ...) returns EBADF.
  • netlink: getsockname(alias, ...) returns EBADF.

Closing the original frees the entry, and the alias stays as it was. Closing the alias leaves the original working: the cleanup callback matches the entry by fd generation and the alias has none.

eventfd and pidfd are the shape a fix takes. eventfd_dup_fd and pidfd_dup_ref with pidfd_map (#408) map each alias to the source's entry and count the references, and the entry is released with the last one. usbdev is separate: duplicate_guest_fd refuses the dup with EBADF, under a TODO(stage 3) in the same function.

Dominant language
C
Stars
271
Forks
28
Avg merge
2d 18h
Merged PRs (30d)
19

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from sysprog21/elfuse

All issues in sysprog21/elfuse

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.