Re: [Qemu-devel] [PATCH] Don't leak file descriptors

[Jamie Lokier <jamie@shareable.org>]

Jamie Lokier wrote:
> Blue Swirl wrote:
> > On Mon, Nov 16, 2009 at 2:47 PM, Kevin Wolf <kwolf@redhat.com> wrote:
> > > Am 13.11.2009 22:05, schrieb Blue Swirl:
> > >> On Fri, Nov 13, 2009 at 5:17 PM, Kevin Wolf <kwolf@redhat.com> wrote:
> > >>> We're leaking file descriptors to child processes. Set FD_CLOEXEC on file
> > >>> descriptors that don't need to be passed to children to stop this misbehaviour.
> > >>
> > >>> -        c = accept(s, (struct sockaddr *)&addr, &addrlen);
> > >>> +        c = qemu_accept(s, (struct sockaddr *)&addr, &addrlen);
> > >>
> > >> Would it be possible to improve the interface so that no casts are
> > >> needed for the calling code?
> > >
> > > How exactly would you do that? The only way I see to do it would be
> > > using void*, but I'm not sure if this really is an improvement.
> > 
> > Instead of sockaddr_in vs. sockaddr and the lame casts in between, we
> > could have QSockAddr which magically works. Or if we only ever use
> > sockaddr_in, just use that.
> 
> int qemu_accept(int s, union __attribute__((__transparent_union__)) {
>                                struct sockaddr *sa;
>                                struct sockaddr_in *sin;
>                                struct sockaddr_in6 *sin6;
>                 } addr, socklen_t len);
> 
> #define qemu_accept(s, addr) qemu_accept(s, addr, sizeof(*addr))
> 
> Seems to work. :-)

The transparent_union is what Glibc uses for accept(), by the way,
when _GNU_SOURCE is defined.  That's why the old code using
accept() compiled without warnings despite the type mismatch.

Grep for __SOCKADDR_ARG in Glibc's /usr/include/sys/socket.h.

-- Jamie