Use O_CLOEXEC to avoid race conditions by embhorn · Pull Request #10162 · wolfSSL/wolfssl

embhorn · 2026-04-08T12:29:07Z

Description

Use the "close-on-exec" flag at file creation time to harden multithread use cases against race conditions.

Fixes #9753

Testing

build testing

Checklist

added tests
updated/added doxygen
updated appropriate READMEs
Updated manual and documentation

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Hardens file-descriptor creation against FD leaks across fork()+exec() in multithreaded programs by using close-on-exec flags (e.g., O_CLOEXEC, SOCK_CLOEXEC, EFD_CLOEXEC) at creation time where possible.

Changes:

Introduces portable WC_*_CLOEXEC macros that fall back to no-ops on unsupported platforms.
Applies WC_CLOEXEC / WC_SOCK_CLOEXEC / WC_EFD_CLOEXEC to various open(), socket(), and eventfd() call sites.
Uses accept4(..., SOCK_CLOEXEC) for AF_ALG where available and passes close-on-exec flag to perf_event_open.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
wolfssl/wolfcrypt/wc_port.h	Adds portable close-on-exec flag macros for FD-creating syscalls.
wolfcrypt/src/random.c	Opens RNG-related device FDs with `O_CLOEXEC` where available.
wolfcrypt/src/port/intel/quickassist_mem.c	Opens QAT memory device with `O_CLOEXEC`.
wolfcrypt/src/port/devcrypto/wc_devcrypto.c	Opens `/dev/crypto` with `O_CLOEXEC`.
wolfcrypt/src/port/caam/wolfcaam_qnx.c	Opens CAAM device with `O_CLOEXEC`.
wolfcrypt/src/port/af_alg/wc_afalg.c	Uses `accept4(..., SOCK_CLOEXEC)` when available; creates AF_ALG sockets with `SOCK_CLOEXEC`.
wolfcrypt/src/port/af_alg/afalg_hash.c	Uses `accept4(..., SOCK_CLOEXEC)` when available for duplicated AF_ALG FDs.
wolfcrypt/benchmark/benchmark.c	Adds `PERF_FLAG_FD_CLOEXEC` to `perf_event_open` flags.
src/wolfio.c	Creates TCP sockets with `SOCK_CLOEXEC`; sets `FD_CLOEXEC` after `accept()`.
src/ssl.c	Creates EGD AF_UNIX socket with `SOCK_CLOEXEC`.
src/crl.c	Uses CLOEXEC flags for `eventfd`/`inotify`/`open()` in CRL monitor paths.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

dgarske

🐺 Skoll Code Review

Overall recommendation: REQUEST_CHANGES
Findings: 5 total — 4 posted, 1 skipped

Posted findings

[Low] crl.c kqueue path: F_SETFD without read-modify-write — src/crl.c:1719
[Low] wolfio.c: defined(SOCK_CLOEXEC) guard in accept4 path is tautologically true — src/wolfio.c:1642-1643
[Medium] afalg_hash.c: accept4 used without _GNU_SOURCE but guarded by system SOCK_CLOEXEC — wolfcrypt/src/port/af_alg/afalg_hash.c:226-232
[High] wolfio.c: _GNU_SOURCE placement may conflict if libwolfssl_sources.h pulls in system headers — src/wolfio.c:31-36

Skipped findings

[Medium] wc_afalg.c: SOCK_CLOEXEC fallback defeats accept4 guard — missing _GNU_SOURCE

Review generated by Skoll via openclaw

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #10162

Scan targets checked: wolfcrypt-api_misuse, wolfcrypt-bugs, wolfcrypt-compliance, wolfcrypt-concurrency, wolfcrypt-consttime, wolfcrypt-defaults, wolfcrypt-mutation, wolfcrypt-port, wolfcrypt-port-bugs, wolfcrypt-portability, wolfcrypt-proptest, wolfcrypt-src, wolfcrypt-zeroize, wolfssl-bugs, wolfssl-compliance, wolfssl-consttime, wolfssl-defaults, wolfssl-mutation, wolfssl-proptest, wolfssl-src, wolfssl-zeroize

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #10162

Scan targets checked: wolfcrypt-api_misuse, wolfcrypt-bugs, wolfcrypt-compliance, wolfcrypt-concurrency, wolfcrypt-consttime, wolfcrypt-defaults, wolfcrypt-mutation, wolfcrypt-port, wolfcrypt-port-bugs, wolfcrypt-portability, wolfcrypt-proptest, wolfcrypt-src, wolfcrypt-zeroize, wolfssl-bugs, wolfssl-compliance, wolfssl-consttime, wolfssl-defaults, wolfssl-mutation, wolfssl-proptest, wolfssl-src, wolfssl-zeroize

No new issues found in the changed files. ✅

dgarske

@douzzer please look these over as well.

douzzer

Would be a lot cleaner+nicer to take the wc_open_cloexec() added in random.c, move it to wc_port.c, make it a WOLFSSL_LOCAL, and use it everywhere consistently.

While you're at it, it would make sense to add other syscall wrappers for calls used over and over with CLOEXEC -- probably accept(), probably others.

Copilot

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-17T15:24:13Z

+    WOLFSSL_LOCAL void wc_set_cloexec(int fd);
+    WOLFSSL_LOCAL int wc_open_cloexec(const char* path, int flags);
+    WOLFSSL_LOCAL int wc_socket_cloexec(int domain, int type, int protocol);
+    WOLFSSL_LOCAL int wc_accept_cloexec(int sockfd, void* addr, void* addrlen);
+#else
+    /* Platforms without POSIX close-on-exec semantics (Windows, OS/2 OW,
+     * Linux kernel module, Zephyr, etc.): pass through to plain syscalls
+     * where the underlying headers are available in the caller. */
+    #define wc_set_cloexec(fd) ((void)(fd))
+    #define wc_open_cloexec(path, flags) open((path), (flags))
+    #define wc_socket_cloexec(domain, type, protocol) \
+        socket((domain), (type), (protocol))
+    #define wc_accept_cloexec(sockfd, addr, addrlen) \
+        accept((sockfd), (addr), (addrlen))


wc_open_cloexec(const char* path, int flags) cannot correctly represent open() calls that require a third mode_t argument (e.g., when flags contains O_CREAT). Additionally, the non-POSIX passthrough macro always expands to a 2-argument open(path, flags). Consider changing wc_open_cloexec to accept an optional mode (e.g., a variadic interface that forwards mode when needed, or a separate wc_open_cloexec_mode(path, flags, mode)), so the helper is safe for all open() use cases.

Copilot · 2026-04-17T15:24:14Z

+int wc_accept_cloexec(int sockfd, void* addr, void* addrlen)
+{
+    int fd;
+#if defined(__linux__) || defined(__ANDROID__)
+    fd = accept4(sockfd, (struct sockaddr*)addr, (socklen_t*)addrlen,
+                 SOCK_CLOEXEC);
+    if (fd >= 0)
+        return fd;
+    if (errno != ENOSYS && errno != EINVAL)
+        return fd;
+#endif
+    fd = accept(sockfd, (struct sockaddr*)addr, (socklen_t*)addrlen);


Using void* for addr/addrlen removes type checking and forces casts at every callsite/implementation, which can hide real signature mismatches across platforms. Prefer a typed signature (e.g., struct sockaddr* and socklen_t* for the POSIX implementation) and, where Windows differs, provide a platform-specific overload via macro/inline wrapper using the platform socket-length type. This will also help prevent incorrect casts like the one currently needed in wolfio.c.

Suggested change

int wc_accept_cloexec(int sockfd, void* addr, void* addrlen)

{

int fd;

#if defined(__linux__) || defined(__ANDROID__)

fd = accept4(sockfd, (struct sockaddr*)addr, (socklen_t*)addrlen,

SOCK_CLOEXEC);

if (fd >= 0)

return fd;

if (errno != ENOSYS && errno != EINVAL)

return fd;

#endif

fd = accept(sockfd, (struct sockaddr*)addr, (socklen_t*)addrlen);

int wc_accept_cloexec(int sockfd, struct sockaddr* addr, socklen_t* addrlen)

{

int fd;

#if defined(__linux__) || defined(__ANDROID__)

fd = accept4(sockfd, addr, addrlen, SOCK_CLOEXEC);

if (fd >= 0)

return fd;

if (errno != ENOSYS && errno != EINVAL)

return fd;

#endif

fd = accept(sockfd, addr, addrlen);

github-actions · 2026-04-17T16:33:33Z

MemBrowse Memory Report

No memory changes detected for:

gcc-arm-cortex-m4- gcc-arm-cortex-m4-baremetal- gcc-arm-cortex-m4-min-ecc- gcc-arm-cortex-m4-tls12

embhorn self-assigned this Apr 8, 2026

embhorn added the Not For This Release Not for release 5.9.1 label Apr 8, 2026

Copilot AI review requested due to automatic review settings April 8, 2026 12:29

Copilot started reviewing on behalf of embhorn April 8, 2026 12:35 View session

Copilot AI reviewed Apr 8, 2026

View reviewed changes

Comment thread wolfcrypt/benchmark/benchmark.c

Comment thread src/wolfio.c Outdated

Comment thread src/wolfio.c Outdated

Comment thread wolfcrypt/src/port/af_alg/wc_afalg.c Outdated

Copilot AI review requested due to automatic review settings April 8, 2026 13:31

Copilot started reviewing on behalf of embhorn April 8, 2026 13:36 View session

Copilot AI reviewed Apr 8, 2026

View reviewed changes

Comment thread wolfssl/wolfcrypt/wc_port.h Outdated

Comment thread wolfcrypt/benchmark/benchmark.c Outdated

Comment thread src/wolfio.c Outdated

Comment thread src/wolfio.c Outdated

Comment thread src/crl.c

embhorn assigned wolfSSL-Bot and unassigned embhorn Apr 9, 2026

dgarske requested changes Apr 9, 2026

View reviewed changes

Comment thread src/crl.c Outdated

Comment thread src/wolfio.c Outdated

Comment thread wolfcrypt/src/port/af_alg/afalg_hash.c Outdated

Comment thread src/wolfio.c Outdated

dgarske assigned embhorn Apr 9, 2026

Copilot AI review requested due to automatic review settings April 10, 2026 18:33

Copilot started reviewing on behalf of embhorn April 10, 2026 18:35 View session

This comment was marked as outdated.

Sign in to view

embhorn removed the Not For This Release Not for release 5.9.1 label Apr 10, 2026

Copilot AI review requested due to automatic review settings April 13, 2026 19:34

embhorn force-pushed the gh9753 branch from 8820776 to b730887 Compare April 13, 2026 19:34

Copilot started reviewing on behalf of embhorn April 13, 2026 19:35 View session

This comment was marked as outdated.

Sign in to view

embhorn requested a review from wolfSSL-Fenrir-bot April 13, 2026 21:13

embhorn force-pushed the gh9753 branch from b730887 to 72e3af9 Compare April 14, 2026 12:33

embhorn requested review from wolfSSL-Fenrir-bot and removed request for wolfSSL-Fenrir-bot April 14, 2026 12:33

wolfSSL-Fenrir-bot reviewed Apr 14, 2026

View reviewed changes

Comment thread wolfcrypt/src/port/caam/wolfcaam_qnx.c Outdated

Comment thread src/wolfio.c

Comment thread src/ssl.c

embhorn requested review from Copilot and wolfSSL-Fenrir-bot April 14, 2026 13:08

Copilot started reviewing on behalf of embhorn April 14, 2026 13:08 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

Comment thread src/wolfio.c Outdated

Comment thread src/ssl.c Outdated

Comment thread wolfcrypt/src/port/devcrypto/wc_devcrypto.c Outdated

Comment thread wolfcrypt/src/port/intel/quickassist_mem.c Outdated

Comment thread wolfcrypt/src/port/caam/wolfcaam_qnx.c Outdated

wolfSSL-Fenrir-bot reviewed Apr 14, 2026

View reviewed changes

embhorn removed their assignment Apr 14, 2026

SparkiDev previously approved these changes Apr 14, 2026

View reviewed changes

SparkiDev assigned dgarske Apr 14, 2026

dgarske previously approved these changes Apr 16, 2026

View reviewed changes

dgarske assigned douzzer and unassigned dgarske Apr 16, 2026

dgarske requested a review from douzzer April 16, 2026 22:48

douzzer requested changes Apr 16, 2026

View reviewed changes

douzzer assigned embhorn and unassigned douzzer Apr 16, 2026

embhorn dismissed stale reviews from dgarske and SparkiDev via 7aab6e5 April 17, 2026 14:38

Copilot AI review requested due to automatic review settings April 17, 2026 15:15

Copilot started reviewing on behalf of embhorn April 17, 2026 15:21 View session

Copilot AI reviewed Apr 17, 2026

View reviewed changes

embhorn force-pushed the gh9753 branch from 8844a1f to 356bb59 Compare April 17, 2026 15:28

Use O_CLOEXEC to avoid race conditions

e26ab42

embhorn force-pushed the gh9753 branch from cfe3037 to e26ab42 Compare April 17, 2026 16:14

Conversation

embhorn commented Apr 8, 2026

Description

Testing

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dgarske left a comment

Choose a reason for hiding this comment

🐺 Skoll Code Review

Posted findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #10162

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #10162

Uh oh!

dgarske left a comment

Choose a reason for hiding this comment

Uh oh!

douzzer left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Apr 17, 2026

MemBrowse Memory Report

Uh oh!

Reviewers

Assignees

Labels

Projects