kern/46077: fstat() returns EINVAL on dup'd connected socket

[mnunberg%haskalah.org@localhost]

>Number:         46077
>Category:       kern
>Synopsis:       fstat() returns EINVAL on dup'd connected socket
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Feb 23 03:25:03 +0000 2012
>Originator:     M. Nunberg
>Release:        NetBSD  5.1.2 NetBSD 5.1.2 (GENERIC)
>Organization:
>Environment:
NetBSD  5.1.2 NetBSD 5.1.2 (GENERIC) #0: Thu Feb  2 17:22:10 UTC 2012  
builds%b6.netbsd.org@localhost:/home/builds/ab/netbsd-5-1-2-RELEASE/i386/201202021012Z-obj/home/builds/ab/netbsd-5-1-2-RELEASE/src/sys/arch/i386/compile/GENERIC
 i386
>Description:
fstat will sometimes return EINVAL on a dup'd connected socket when the socket 
connection is not yet established, e.g. EINPROGRESS

I am running this under KVM in Linux, if this makes a difference.
The machine has been upgraded from an older release using the upgrade from the 
ISO (upgraded from 5.1.1).
>How-To-Repeat:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <fcntl.h>
#include <assert.h>
#include <errno.h>

int main(void)
{
    struct stat sb;
    struct sockaddr_in saddr;
    uint32_t ipaddr;
    int flags;
    int s;
    int dupsock;

    assert( (s = socket(PF_INET, SOCK_STREAM, 0)) >= 0 );
    assert( (flags = fcntl(s, F_GETFL)) != -1 );
    assert( fcntl(s, F_SETFL, flags | O_NONBLOCK) != -1 );

    memset(&saddr, 0, sizeof(saddr));
    assert( inet_pton(AF_INET, "127.0.0.1", &ipaddr) );

    saddr.sin_addr.s_addr = ipaddr;
    saddr.sin_port = htons(42);
    saddr.sin_family = AF_INET;

    assert( connect(s, (struct sockaddr*)&saddr, sizeof(saddr)) == -1 &&
            errno == EINPROGRESS );

    /* Now let's try fstat() */

    if (fstat(s, &sb) == -1) {
        printf("Error: %s\n", strerror(errno));
        abort();
    }
    exit(0);
}

>Fix:
I do not have a a fix per se, however I think I may have found the line where 
this error is being set.

http://nxr.netbsd.org/source/xref/src/sys/netinet/tcp_usrreq.c#269