linux-kernel - Re: epoll and closed file descriptors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.00.0909161656150.3124@makko.or.mcafeemobile.com>
Date:	Wed, 16 Sep 2009 17:07:56 -0700 (PDT)
From:	Davide Libenzi <davidel@...ilserver.org>
To:	Gilad Benjamini <gilad@...ornetworks.com>
cc:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: epoll and closed file descriptors

On Wed, 16 Sep 2009, Gilad Benjamini wrote:

> I am running repeatedly into a scenario  where epoll notifies userland of
> events on a closed file descriptor.
> I am running a single thread application, on a single CPU machine so
> multiple threads isn't the issue. 
> 
> A sample set of events that I have seen
> - File descriptor (13) for a socket is closed
> - epoll_wait returns with no events.
> - Several epoll related calls happen
> - More than 20 seconds after the "close", epoll_wait finds an event on fd 13
> with EPOLLIN|EPOLLERR|EPOLLHUP.
> - epoll_wait continues to report this event

Epoll removes the fd from its container, when the last instance of the 
underlying kernel file pointer is released (or when you explicitly 
remove it with epoll_ctl(EPOLL_CTL_DEL)).
If you continue to get the event, it means that someone else has an 
instance of the socket (that, looking at the events, saw a shutdown) open, 
by hence keeping the kernel object alive.
If you don't want to see the events, just remove the socket from the epoll 
set before closing.
Or, you remove the socket the first time you see an EPOLLHUP.

- Davide

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/