From 9778737d7b2a870ff195f318cceb48b93e661f03 Mon Sep 17 00:00:00 2001
From: akr <akr@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Mon, 13 Jun 2011 14:11:23 +0000
Subject: [PATCH] * ext/socket/unixsocket.c (unix_send_io): race condition
 fixed.   (unix_recv_io): ditto.   fixed by Eric Wong.  [ruby-core:35574]

* test/socket/test_unix.rb: test added for above problem.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@32062 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 ChangeLog                |  8 ++++++++
 ext/socket/unixsocket.c  | 14 ++++++++------
 test/socket/test_unix.rb | 37 +++++++++++++++++++++++++++++++++++++
 3 files changed, 53 insertions(+), 6 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index ae8062cb9c..4ac13ef8ed 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+Mon Jun 13 23:05:01 2011  Tanaka Akira  <akr@fsij.org>
+
+	* ext/socket/unixsocket.c (unix_send_io): race condition fixed.
+	  (unix_recv_io): ditto.
+	  fixed by Eric Wong.  [ruby-core:35574]
+
+	* test/socket/test_unix.rb: test added for above problem.
+
 Mon Jun 13 21:41:05 2011  KOSAKI Motohiro  <kosaki.motohiro@gmail.com>
 
 	* thread_win32.c (native_cond_signal): remove unnecessary rb_bug().
diff --git a/ext/socket/unixsocket.c b/ext/socket/unixsocket.c
index 5a8641acc2..88ffa60fb6 100644
--- a/ext/socket/unixsocket.c
+++ b/ext/socket/unixsocket.c
@@ -248,9 +248,10 @@ unix_send_io(VALUE sock, VALUE val)
 #endif
 
     arg.fd = fptr->fd;
-    rb_thread_fd_writable(arg.fd);
-    if ((int)BLOCKING_REGION_FD(sendmsg_blocking, &arg) == -1)
-	rb_sys_fail("sendmsg(2)");
+    while ((int)BLOCKING_REGION_FD(sendmsg_blocking, &arg) == -1) {
+	if (!rb_io_wait_writable(arg.fd))
+	    rb_sys_fail("sendmsg(2)");
+    }
 
     return Qnil;
 }
@@ -334,9 +335,10 @@ unix_recv_io(int argc, VALUE *argv, VALUE sock)
 #endif
 
     arg.fd = fptr->fd;
-    rb_thread_wait_fd(arg.fd);
-    if ((int)BLOCKING_REGION_FD(recvmsg_blocking, &arg) == -1)
-	rb_sys_fail("recvmsg(2)");
+    while ((int)BLOCKING_REGION_FD(recvmsg_blocking, &arg) == -1) {
+	if (!rb_io_wait_readable(arg.fd))
+	    rb_sys_fail("recvmsg(2)");
+    }
 
 #if FD_PASSING_BY_MSG_CONTROL
     if (arg.msg.msg_controllen < (socklen_t)sizeof(struct cmsghdr)) {
diff --git a/test/socket/test_unix.rb b/test/socket/test_unix.rb
index bde17cf0ab..d5bb30befb 100644
--- a/test/socket/test_unix.rb
+++ b/test/socket/test_unix.rb
@@ -6,6 +6,8 @@ end
 require "test/unit"
 require "tempfile"
 require "tmpdir"
+require "thread"
+require "io/nonblock"
 
 class TestSocket_UNIXSocket < Test::Unit::TestCase
   def test_fd_passing
@@ -102,6 +104,41 @@ class TestSocket_UNIXSocket < Test::Unit::TestCase
     io_ary.each {|io| io.close if !io.closed? }
   end
 
+  def test_fd_passing_race_condition
+    r1, w = IO.pipe
+    s1, s2 = UNIXSocket.pair
+    s1.nonblock = s2.nonblock = true
+    aoe = Thread.abort_on_exception
+    Thread.abort_on_exception = true
+    lock = Mutex.new
+    nr = 0
+    x = 2
+    y = 1000
+    begin
+      s1.send_io(nil)
+    rescue NotImplementedError
+      assert_raise(NotImplementedError) { s2.recv_io }
+    rescue TypeError
+      thrs = x.times.map do
+        Thread.new do
+          y.times do
+            s2.recv_io.close
+            lock.synchronize { nr += 1 }
+          end
+        end
+      end
+      (x * y).times { s1.send_io r1 }
+      thrs.each { |t| t.join }
+      assert_equal x * y, nr
+    ensure
+      Thread.abort_on_exception = aoe
+      s1.close
+      s2.close
+      w.close
+      r1.close
+    end
+  end
+
   def test_sendmsg
     return if !defined?(Socket::SCM_RIGHTS)
     IO.pipe {|r1, w|