Skip to content

Fix double-close of _serverFd in SocketServer teardown - #585

Merged
bsergean merged 1 commit into
machinezone:masterfrom
zardus:fix-serverfd-double-close
Jun 24, 2026
Merged

bsergean merged 1 commit into
machinezone:masterfrom
zardus:fix-serverfd-double-close

Conversation

@zardus

@zardus zardus commented Jun 12, 2026

Copy link
Copy Markdown
Contributor

Hi, I'm using IXWebSocket in https://github.com/openglad/openglad, and ran into an issue when using this in a multithreaded setting.

It seems that SocketServer::stop() closes _serverFd but never clears it, and stop() runs again from both ~WebSocketServer() and ~SocketServer(), so every teardown closes the same fd number two or three times. If another thread opens a descriptor between those closes, the kernel reuses the number and the stale close destroys it. I was hitting intermittent process aborts ("Unexpected error 9 on netlink descriptor", glibc's getaddrinfo netlink probe) whenever a DNS lookup in another thread raced a server teardown.

This PR sets _serverFd to -1 after closing it (including in error paths), like what seems to happen to _sockfd currently elsewhere in the code. This seems to have fixed it for me.

@bsergean

Copy link
Copy Markdown
Collaborator

Do you think you can merge master in your branch, I think I fixed the build issue. with uwp, then we'll reckick the PR checks.

SocketServer::stop() closed _serverFd but never cleared it, and stop()
runs again from both ~WebSocketServer() and ~SocketServer(), so every
teardown closed the same fd number two or three times. If another
thread opens a descriptor between those closes, the kernel reuses the
number and the stale close destroys it — observed as intermittent
process aborts ("Unexpected error 9 on netlink descriptor", glibc's
getaddrinfo netlink probe) when a DNS lookup raced a server teardown.

Close the fd once and set it to -1, in stop() and in the listen()
error paths.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@zardus

zardus commented Jun 18, 2026

Copy link
Copy Markdown
Contributor Author

Done!

@bsergean
bsergean merged commit 3230490 into machinezone:master Jun 24, 2026
7 checks passed
@zardus
zardus deleted the fix-serverfd-double-close branch June 25, 2026 04:35
bsergean added a commit that referenced this pull request Jun 25, 2026
Release of accumulated fixes since v12.0.0: DNS lookup crash/offline
resolution (#589), OpenSSL IP-address cert validation (#588),
case-insensitive Upgrade header (#584), server fd double-close (#585),
fragment buffering optimization (#562), and the install include-dir fix (#582).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
kahrendt added a commit to Sendspin/sendspin-cpp that referenced this pull request Oct 6, 2026
…173)

## What

Three lifecycle tests asserted a state another thread could still
change. Each now waits on what it asserts, or reads a value only the
test thread writes:

- `TwoPeersAtOnceSettleOnThePreferredOne` and
`TwoServerRaceResolvedByPreference` asserted `is_connected()` as soon as
the winner's server information appeared. `refresh_published_state()`
lowers the connected flag as soon as no operational connection remains,
and publishes the winner's server information on install. Only the end
of the tick raises the flag again. The two-peers test now waits for both
together. The race test waits for `is_connected()` after the incumbent's
close, so a stale flag from the incumbent cannot satisfy it.
- `DestroyingARunningClientWithAReturnedLocalItemIsClean` asserted the
player quota was nonzero right after handing a chunk over. The idle sync
task discards that chunk and empties the quota on its own thread, so the
assertion could run too late. The hand-over is now proven from two
things the sync thread cannot change: the host ring's `items_waiting_`
shows the chunk was copied into the ring, and the consumer's drop log
shows it was not dropped after the copy. `tests/CMakeLists.txt` names
the new private reach.

## Why

Under full CPU load, 300 repeats each on `main` (failed runs, TSan /
ASan): two-peers 13 / 6, race 17 / 20, destroy 163 / 43. CI runs
serially and rarely hits these, but a loaded runner will. No
ThreadSanitizer reports in any run: the races are in the tests, not the
library.

## Review notes

- Same load, this branch: 0 failures in 300 repeats of all three under
TSan and ASan. Full suite 693/693 under both, run serially.
- Mutants:
- Never publishing the connected flag hangs both connection tests into
the suite watchdog, the intended structural failure for a wait.
- The destroy test fails, each time at the assertion for that path, when
the hand-over is never attempted, dropped before the copy (too long), or
dropped after it (over quota).
- Checked and left alone: every other `is_connected()` assertion. Most
follow a connection that was already up.
`PostRehandshakeInadmissibleActivateDrops` and
`TogglingUnpairedAccessBringsTheUnpairedSessionInLine` assert it false
after a close; they passed 1000 and 567 repeats under the same load.
- Not in this PR: a separate host-only abort under load, glibc's
"Unexpected error 9 on netlink descriptor". IXWebSocket v11.4.5 closes
the server's listen fd up to three times on stop. Fixed upstream in
machinezone/IXWebSocket#585, which is not yet in a release.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01TVRGCEo9dwfwss5LhHu4cf

---
_Generated by [Claude
Code](https://claude.ai/code/session_01TVRGCEo9dwfwss5LhHu4cf)_


---
_Generated by [Claude Code](https://claude.ai/code)_

---------

Co-authored-by: Claude <noreply@anthropic.com>
kahrendt added a commit to Sendspin/sendspin-cpp that referenced this pull request Oct 6, 2026
## What

Bumps the host build's IXWebSocket from v11.4.5 to v12.0.1. ESP builds
don't use IXWebSocket and are unaffected.

## Why

v11.4.5 can close the server's listen fd up to three times on stop.
Under load this caused glibc's "Unexpected error 9 on netlink
descriptor" abort, noted in #173. v12.0.1 includes the fix
(machinezone/IXWebSocket#585), and also #589, which avoids the
`AI_ADDRCONFIG` netlink path during DNS lookups.

## Review notes

- No API changes affect us. The new `WebSocketServer` arguments for ping
interval and send timeout default to `-1` (off), which matches the old
behavior.
- Upstream's `IX_WEBSOCKET_VERSION` header still reads 11.4.6. The
fetched tree is tag v12.0.1.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants