A dup of a timerfd, signalfd, inotify or netlink fd has no state behind it
维护者通常 3 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 52/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- c, linux
调研方向
Start with duplicate_guest_fd in src/syscall/fs.c, then read the side-table lookup and cleanup paths for timerfd, signalfd, inotify, and netlink. Compare the alias mapping and reference-counting approach in eventfd_dup_fd and pidfd_dup_ref/pidfd_map. Done means aliases share the original state until the last descriptor closes, and the listed operations work through either fd.
由索引模型根据 Issue 内容生成。
描述
dup(2) returns a second fd for the same open file description, so on Linux every operation works through either fd and the object lives until the last one is closed. Under elfuse a dup of a timerfd, signalfd, inotify or netlink fd is an fd of the right type with no state behind it.
duplicate_guest_fd (src/syscall/fs.c) copies these four types through the generic path: a new slot of the same type on a dup of the host fd, with the type's cleanup callback. Each type keeps its state in a side table whose entries record one guest fd number, the one the create call returned, and timerfd_find, signalfd_find, inotify_find and nl_find match on that number. A lookup by the alias's number finds no entry.
Single-threaded, on 9f12c41 and on Linux 6.12 (the qemu reference VM):
int fd = timerfd_create(CLOCK_MONOTONIC, TFD_NONBLOCK);
int alias = dup(fd);
struct itimerspec its = {.it_value = {.tv_nsec = 50 * 1000 * 1000}};
/* Linux elfuse */
timerfd_settime(alias, 0, &its, NULL); /* 0 EBADF */
timerfd_settime(fd, 0, &its, NULL); /* 0 0 */
timerfd_gettime(alias, &cur); /* 0 EBADF */
poll(&(struct pollfd){alias, POLLIN}, 1, 500);
/* 1, POLLIN 1, POLLIN */
read(alias, &n, 8); /* 8 EBADF */
read(fd, &n, 8); /* EAGAIN 8 */
close(fd);
timerfd_settime(alias, 0, &its, NULL); /* 0 EBADF */
The alias shares the host kqueue, so poll reports it readable, and the read that follows fails. A loop that polls the alias and reads on POLLIN does not block again.
The other three fail the same way through the alias, with the original open or closed, where Linux 6.12 succeeds in both:
- signalfd:
signalfd(alias, &mask, 0)returnsEINVAL. - inotify:
inotify_add_watch(alias, ...)returnsEBADF. - netlink:
getsockname(alias, ...)returnsEBADF.
Closing the original frees the entry, and the alias stays as it was. Closing the alias leaves the original working: the cleanup callback matches the entry by fd generation and the alias has none.
eventfd and pidfd are the shape a fix takes. eventfd_dup_fd and pidfd_dup_ref with pidfd_map (#408) map each alias to the source's entry and count the references, and the entry is released with the last one. usbdev is separate: duplicate_guest_fd refuses the dup with EBADF, under a TODO(stage 3) in the same function.
- 主要语言
- C
- 星标
- 273
- 派生
- 29
- 平均合并
- 2 天 10 小时
- 30 天内合并 PR
- 17
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
sysprog21/elfuse 的其他 Issue
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 3 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 75/100
维护者通常 3 天内回复
-
难度 4/5 3-5 天 新手友好度 30/100
维护者通常 3 天内回复
-
难度 4/5 3-5 天 新手友好度 35/100
维护者通常 3 天内回复
-
难度 4/5 3-5 天 新手友好度 35/100
维护者通常 3 天内回复
相似的 Issue
-
mewencode: base256[] and base128[] are indexed out of bounds by a non-ASCII octet可能已有人在做 @kazu-yamamoto 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
kazu-yamamoto/Mew#276 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 91/100
FujiNetWIFI/fujinet-firmware#2045 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 84/100
维护者通常 1 天内回复
-
[Performance]: Qwen-Image-2.1 CPU-only on i5-10500H (6C AVX2, 32 GB): 512x512 in 7.7 min at 8 steps未关闭
难度 1/5 1 小时以内 新手友好度 84/100
维护者通常 1 天内回复
-
area:gates area:gfx found-by:critic kind:gate-defect
难度 2/5 1-3 小时 新手友好度 78/100
InauguralSystems/EigenScript#1825 ·
维护者通常 1 天内回复