 @@ -1,14 +1,14 @@
-/*	$NetBSD: svc.c,v 1.35 2015/11/06 19:34:13 christos Exp $	*/
+/*	$NetBSD: svc.c,v 1.36 2015/11/07 17:34:33 christos Exp $	*/
 /*
  * Copyright (c) 2010, Oracle America, Inc.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
+ *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials
 @@ -27,27 +27,27 @@
  *   GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  *   INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
  *   WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  *   NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
 #if defined(LIBC_SCCS) && !defined(lint)
 #if 0
 static char *sccsid = "@(#)svc.c 1.44 88/02/08 Copyr 1984 Sun Micro";
 static char *sccsid = "@(#)svc.c	2.4 88/08/11 4.0 RPCSRC";
 #else
-__RCSID("$NetBSD: svc.c,v 1.35 2015/11/06 19:34:13 christos Exp $");
+__RCSID("$NetBSD: svc.c,v 1.36 2015/11/07 17:34:33 christos Exp $");
 #endif
 #endif
 /*
  * svc.c, Server-side remote procedure call interface.
+ *
  * There are two sets of procedures here.  The xprt routines are
  * for handling transport handles.  The svc routines handle the
  * list of service routines.
+ *
  * Copyright (C) 1984, Sun Microsystems, Inc.
  */
 @@ -169,27 +169,28 @@ xprt_register(SVCXPRT *xprt)
+{
 	int sock;
 	_DIAGASSERT(xprt != NULL);
 	rwlock_wrlock(&svc_fd_lock);
 	sock = xprt->xp_fd;
 	if (!xprt_alloc(sock))
 		goto out;
 	__svc_xports[sock] = xprt;
 	if (sock != -1) {
-		svc_fdset_set(sock);
+		if (svc_fdset_set(sock) == -1)
 			return FALSE;
+	}
 	rwlock_unlock(&svc_fd_lock);
 	return (TRUE);
 out:
 	rwlock_unlock(&svc_fd_lock);
 	return (FALSE);
+}
 void
 xprt_unregister(SVCXPRT *xprt)
+{
 	__xprt_do_unregister(xprt, TRUE);
 @@ -212,27 +213,27 @@ __xprt_do_unregister(SVCXPRT *xprt, bool
 	_DIAGASSERT(xprt != NULL);
 	if (dolock)
 		rwlock_wrlock(&svc_fd_lock);
 	sock = xprt->xp_fd;
 	if (sock >= __svc_maxxports || __svc_xports[sock] != xprt)
 		goto out;
 	__svc_xports[sock] = NULL;
 	if (sock == -1)
 		goto out;
 	fdmax = svc_fdset_getmax();
-	if (sock < *fdmax)
+	if (fdmax == NULL || sock < *fdmax)
 		goto clr;
 	for ((*fdmax)--; *fdmax >= 0; (*fdmax)--)
 		if (__svc_xports[*fdmax])
 			break;
 clr:
 	svc_fdset_clr(sock);
 out:
 	if (dolock)
 		rwlock_unlock(&svc_fd_lock);
+}
 /*
 @@ -624,26 +625,28 @@ svcerr_progvers(SVCXPRT *xprt, rpcvers_t
  * However, this function does not know the structure of the cooked
  * credentials, so it make the following assumptions:
  *   a) the structure is contiguous (no pointers), and
  *   b) the cred structure size does not exceed RQCRED_SIZE bytes.
  * In all events, all three parameters are freed upon exit from this routine.
  * The storage is trivially management on the call stack in user land, but
  * is mallocated in kernel land.
  */
 void
 svc_getreq(int rdfds)
+{
 	fd_set *readfds = svc_fdset_copy(NULL);
 	if (readfds == NULL)
 		return;
 	readfds->fds_bits[0] = (unsigned int)rdfds;
 	svc_getreqset(readfds);
 	free(readfds);
+}
 void
 svc_getreqset2(fd_set *readfds, int maxsize)
+{
 	uint32_t mask, *maskp;
 	int sock, bit, fd;
 	_DIAGASSERT(readfds != NULL);
 @@ -761,27 +764,27 @@ svc_getreq_poll(struct pollfd *pfdp, int
 	_DIAGASSERT(pfdp != NULL);
 	for (i = fds_found = 0; fds_found < pollretval; i++) {
 		struct pollfd *p = &pfdp[i];
 		if (p->revents) {
 			/* fd has input waiting */
 			fds_found++;
 			/*
 			 *	We assume that this function is only called
 			 *	via someone select()ing from svc_fdset or
 			 *	pollts()ing from svc_pollset[].  Thus it's safe
 			 *	to handle the POLLNVAL event by simply turning
-			 *	the corresponding bit off in svc_fdset.  The
+			 *	the corresponding bit off in the fdset.  The
 			 *	svc_pollset[] array is derived from svc_fdset
 			 *	and so will also be updated eventually.
+			 *
 			 *	XXX Should we do an xprt_unregister() instead?
 			 */
 			if (p->revents & POLLNVAL) {
 				rwlock_wrlock(&svc_fd_lock);
 				svc_fdset_clr(p->fd);
 				rwlock_unlock(&svc_fd_lock);
 			} else
 				svc_getreq_common(p->fd);
+		}
+	}

 @@ -1,14 +1,14 @@
-/*	$NetBSD: svc_run.c,v 1.23 2015/11/06 19:34:13 christos Exp $	*/
+/*	$NetBSD: svc_run.c,v 1.24 2015/11/07 17:34:33 christos Exp $	*/
 /*
  * Copyright (c) 2010, Oracle America, Inc.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
+ *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials
 @@ -27,27 +27,27 @@
  *   GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  *   INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
  *   WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  *   NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
 #if defined(LIBC_SCCS) && !defined(lint)
 #if 0
 static char *sccsid = "@(#)svc_run.c 1.1 87/10/13 Copyr 1984 Sun Micro";
 static char *sccsid = "@(#)svc_run.c	2.1 88/07/29 4.0 RPCSRC";
 #else
-__RCSID("$NetBSD: svc_run.c,v 1.23 2015/11/06 19:34:13 christos Exp $");
+__RCSID("$NetBSD: svc_run.c,v 1.24 2015/11/07 17:34:33 christos Exp $");
 #endif
 #endif
 /*
  * This is the rpc server side idle loop
  * Wait for input, call server program.
  */
 #include "namespace.h"
 #include "reentrant.h"
 #include <err.h>
 #include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 @@ -59,69 +59,75 @@ __RCSID("$NetBSD: svc_run.c,v 1.23 2015/
 #include "svc_fdset.h"
 #include "rpc_internal.h"
 #ifdef __weak_alias
 __weak_alias(svc_run,_svc_run)
 __weak_alias(svc_exit,_svc_exit)
 #endif
 void
 svc_run(void)
+{
 	fd_set *readfds, *cleanfds;
 	struct timeval timeout;
-	int maxfd, fdsize;
+	int *maxfd, fdsize;
 #ifndef RUMP_RPC
 	int probs = 0;
 #endif
 #ifdef _REENTRANT
 	extern rwlock_t svc_fd_lock;
 #endif
 	readfds = NULL;
 	cleanfds = NULL;
 	fdsize = 0;
 	timeout.tv_sec = 30;
 	timeout.tv_usec = 0;
 	for (;;) {
 		rwlock_rdlock(&svc_fd_lock);
 		if (fdsize != svc_fdset_getsize(0)) {
 			fdsize = svc_fdset_getsize(0);
 			free(readfds);
 			readfds = svc_fdset_copy(svc_fdset_get());
 			free(cleanfds);
 			cleanfds = svc_fdset_copy(svc_fdset_get());
+		}
-		maxfd = *svc_fdset_getmax();
+		maxfd = svc_fdset_getmax();
 		if (maxfd == NULL) {
 			warn("can't get maxfd");
 			continue;
+		}
 		rwlock_unlock(&svc_fd_lock);
-		switch (select(maxfd + 1, readfds, NULL, NULL, &timeout)) {
+		switch (select(*maxfd + 1, readfds, NULL, NULL, &timeout)) {
 		case -1:
 #ifndef RUMP_RPC
 			if ((errno == EINTR || errno == EBADF) && probs < 100) {
 				probs++;
 				continue;
+			}
 #endif
 			if (errno == EINTR) {
 				continue;
+			}
 			warn("%s: select failed", __func__);
 			goto out;
 		case 0:
-			__svc_clean_idle(cleanfds, 30, FALSE);
+			if (cleanfds)
 				__svc_clean_idle(cleanfds, 30, FALSE);
 			continue;
 		default:
-			svc_getreqset2(readfds, fdsize);
+			if (readfds)
 				svc_getreqset2(readfds, fdsize);
 #ifndef RUMP_RPC
 			probs = 0;
 #endif
+		}
+	}
 out:
 	free(readfds);
 	free(cleanfds);
+}
 /*
  *      This function causes svc_run() to exit by telling it that it has no
  *      more work to do.

 @@ -1,14 +1,14 @@
-/*	$NetBSD: svc_vc.c,v 1.31 2015/11/06 19:34:13 christos Exp $	*/
+/*	$NetBSD: svc_vc.c,v 1.32 2015/11/07 17:34:33 christos Exp $	*/
 /*
  * Copyright (c) 2010, Oracle America, Inc.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
+ *
  *     * Redistributions of source code must retain the above copyright
  *       notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
  *       copyright notice, this list of conditions and the following
  *       disclaimer in the documentation and/or other materials
 @@ -27,27 +27,27 @@
  *   GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  *   INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
  *   WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  *   NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  *   OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
 #if defined(LIBC_SCCS) && !defined(lint)
 #if 0
 static char *sccsid = "@(#)svc_tcp.c 1.21 87/08/11 Copyr 1984 Sun Micro";
 static char *sccsid = "@(#)svc_tcp.c	2.2 88/08/01 4.0 RPCSRC";
 #else
-__RCSID("$NetBSD: svc_vc.c,v 1.31 2015/11/06 19:34:13 christos Exp $");
+__RCSID("$NetBSD: svc_vc.c,v 1.32 2015/11/07 17:34:33 christos Exp $");
 #endif
 #endif
 /*
  * svc_vc.c, Server side for Connection Oriented based RPC.
+ *
  * Actually implements two flavors of transporter -
  * a tcp rendezvouser (a listner and connection establisher)
  * and a record/tcp stream.
  */
 #include "namespace.h"
 #include "reentrant.h"
 @@ -319,27 +319,29 @@ rendezvous_request(SVCXPRT *xprt, struct
 	r = (struct cf_rendezvous *)xprt->xp_p1;
 again:
 	len = sizeof addr;
 	if ((sock = accept(xprt->xp_fd, (struct sockaddr *)(void *)&addr,
 	    &len)) < 0) {
 		if (errno == EINTR)
 			goto again;
 		/*
 		 * Clean out the most idle file descriptor when we're
 		 * running out.
 		 */
 		if (errno == EMFILE || errno == ENFILE) {
 			fd_set *cleanfds = svc_fdset_copy(svc_fdset_get());
-			int rv = __svc_clean_idle(cleanfds, 0, FALSE);
+			int rv = 0;
 			if (cleanfds)
 				rv = __svc_clean_idle(cleanfds, 0, FALSE);
 			free(cleanfds);
 			if (rv)
 				goto again;
+		}
 		return FALSE;
+	}
 	/*
 	 * make a new transporter (re-uses xprt)
 	 */
 	newxprt = makefd_xprt(sock, r->sendsize, r->recvsize);
 	if (newxprt == NULL)
 		goto out;
 	newxprt->xp_rtaddr.buf = mem_alloc(len);
 @@ -751,39 +753,46 @@ svc_vc_rendezvous_ops(SVCXPRT *xprt)
 	xprt->xp_ops = &ops;
 	xprt->xp_ops2 = &ops2;
 	mutex_unlock(&ops_lock);
+}
 /*
  * Destroy xprts that have not have had any activity in 'timeout' seconds.
  * If 'cleanblock' is true, blocking connections (the default) are also
  * cleaned. If timeout is 0, the least active connection is picked.
  */
 bool_t
 __svc_clean_idle(fd_set *fds, int timeout, bool_t cleanblock)
+{
-	int i, ncleaned, fdmax;
+	int i, ncleaned, *fdmax;
 	SVCXPRT *xprt, *least_active;
 	struct timeval tv, tdiff, tmax;
 	struct cf_conn *cd;
 	gettimeofday(&tv, NULL);
 	tmax.tv_sec = tmax.tv_usec = 0;
 	least_active = NULL;
 	rwlock_wrlock(&svc_fd_lock);
-	fdmax = *svc_fdset_getmax();
+	fdmax = svc_fdset_getmax();
-	for (i = ncleaned = 0; i <= fdmax; i++) {
+	if (fdmax == NULL)
-		if (!svc_fdset_isset(i))
+		return FALSE;
 	for (i = ncleaned = 0; i <= *fdmax; i++) {
 		switch (svc_fdset_isset(i)) {
 		case 0:
 		case -1:
 			continue;
 		default:
 			break;
+		}
 		xprt = __svc_xports[i];
 		if (xprt == NULL || xprt->xp_ops == NULL ||
 		    xprt->xp_ops->xp_recv != svc_vc_recv)
 			continue;
 		cd = (struct cf_conn *)xprt->xp_p1;
 		if (!cleanblock && !cd->nonblock)
 			continue;
 		if (timeout == 0) {
 			timersub(&tv, &cd->last_recv_time, &tdiff);
 			if (timercmp(&tdiff, &tmax, >)) {