[pseudo] [PATCH 0/3] closefrom/close_range: protect every pseudo fd, then drop one

[Babanpreet Singh <bbnpreetsingh@gmail.com>]

This is the follow-up from the close_range v2 thread [1], in
the order Richard suggested and Mark agreed with there: protect the
whole set of descriptors first, then remove pseudo_prefix_dir_fd on
top as a separately revertable commit. This has been built on top of v2.

While writing a probe to demonstrate the missing protection I noticed
something: the sweeps can close a descriptor that is already on the
protect list. The startfd computation uses >, so a protected
descriptor exactly equal to the running startfd is stepped around by
neither the by-hand loop nor the kernel sweep. My understanding is
that the default layout reliably produces that case: pseudo moves its
own descriptors up with F_DUPFD from PSEUDO_MIN_FD, so the local
state fd and connect_fd end up on consecutive numbers and connect_fd
lands exactly on the computed startfd. If I am reading the history
right, this means every closefrom(3) under pseudo has quietly closed
the server connection since 21ff2fb in 2021, and it went unnoticed
because the client transparently reconnects on the next operation.
Patch 1 addresses that. Patches 2 and 3 are the protection and removal we
discussed on the thread.

To convince myself I tested with a probe that locates pseudo's descriptors
via /proc/self/fd, sweeps with close_range(3, ~0U, 0) or closefrom(3),
and checks what survived. On the v2 baseline:

  pwd lock fd (lckpwdf held) : fd 3  closed by sweep
  PSEUDO_PREFIX dir fd       : fd 20 closed by sweep
  server socket fd           : fd 22 closed by sweep

After patch 1 the socket survives, after patch 2 everything survives,
and after patch 3 the prefix descriptor no longer exists to need
protecting.

[1] https://lore.kernel.org/yocto-patches/20260716055633.7-1-bbnpreetsingh@gmail.com/

Babanpreet Singh (3):
  pseudo_client: step fully past pseudo's own fds when computing startfd
  pseudo_client: step around all of pseudo's own fds in
    closefrom/close_range
  pseudo_client: remove the unused pseudo_prefix_dir_fd

 doc/program_flow |  1 -
 pseudo.h         |  1 +
 pseudo_client.c  | 90 ++++++++++++++----------------------------------
 pseudo_client.h  |  1 -
 4 files changed, 27 insertions(+), 66 deletions(-)

-- 
2.43.0