Changes from review

Author: embhorn

.wolfssl_known_macro_extras

@@ -315,6 +315,7 @@ ID_TRNG
 IGNORE_KEY_EXTENSIONS
 IGNORE_NETSCAPE_CERT_TYPE
 INCLUDE_uxTaskGetStackHighWaterMark
+IN_CLOEXEC
 INTEGRITY
 INTIMEVER
 IOTSAFE_NO_GETDATA
@@ -468,6 +469,7 @@ NO_WOLFSSL_XILINX_TAG_MALLOC
 NRF52
 NRF52_SERIES
 NRF_ERROR_MODULE_ALREADY_INITIALIZED
+O_CLOEXEC
 OLD_HELLO_ALLOWED
 OPENSSL_EXTRA_BSD
 OPENSSL_EXTRA_NO_ASN1
@@ -519,6 +521,7 @@ SL_SE_KEY_TYPE_ECC_X25519
 SL_SE_KEY_TYPE_ECC_X448
 SL_SE_PRF_HMAC_SHA1
 SNIFFER_SINGLE_SESSION_CACHE
+SOCK_CLOEXEC
 SOFTDEVICE_PRESENT
 SO_NOSIGPIPE
 SO_REUSEPORT

src/wolfio.c

@@ -24,6 +24,12 @@
 #define WOLFSSL_STRERROR_BUFFER_SIZE 256
 #endif
 
+/* Enable GNU extensions for accept4() on Linux/glibc. Must be defined
+ * before any system headers are included. */
+#if !defined(_WIN32) && !defined(_GNU_SOURCE)
+    #define _GNU_SOURCE 1
+#endif
+
 #include <wolfssl/wolfcrypt/libwolfssl_sources.h>
 
 #ifndef WOLFCRYPT_ONLY
@@ -1623,10 +1629,19 @@ int wolfIO_TcpBind(SOCKET_T* sockfd, word16 port)
 #ifdef HAVE_SOCKADDR
 int wolfIO_TcpAccept(SOCKET_T sockfd, SOCKADDR* peer_addr, XSOCKLENT* peer_len)
 {
-    int fd = (int)accept(sockfd, peer_addr, peer_len);
+    int fd;
+#if !defined(USE_WINDOWS_API) && defined(SOCK_CLOEXEC) && \
+    (defined(__linux__) || defined(__ANDROID__))
+    fd = (int)accept4(sockfd, peer_addr, peer_len, SOCK_CLOEXEC);
+#else
+    fd = (int)accept(sockfd, peer_addr, peer_len);
 #if defined(FD_CLOEXEC) && !defined(USE_WINDOWS_API)
-    if (fd >= 0)
-        (void)fcntl(fd, F_SETFD, FD_CLOEXEC);
+    if (fd >= 0) {
+        int fdFlags = fcntl(fd, F_GETFD);
+        if (fdFlags >= 0)
+            (void)fcntl(fd, F_SETFD, fdFlags | FD_CLOEXEC);
+    }
+#endif
 #endif
     return fd;
 }

wolfcrypt/benchmark/benchmark.c

@@ -1584,11 +1584,22 @@ static const char* bench_result_words3[][5] = {
     static THREAD_LS_T int cycles = -1;
     static THREAD_LS_T struct perf_event_attr atr;
 
+    /* Try with PERF_FLAG_FD_CLOEXEC first; on older kernels (< 3.14) this
+     * fails with EINVAL, so fall back to flags=0 and set FD_CLOEXEC via
+     * fcntl() as a best-effort. */
     #define INIT_CYCLE_COUNTER do {                                            \
         atr.type   = PERF_TYPE_HARDWARE;                                       \
         atr.config = PERF_COUNT_HW_CPU_CYCLES;                                 \
-        cycles = (int)syscall(__NR_perf_event_open, &atr, 0, -1, -1,            \
-                             PERF_FLAG_FD_CLOEXEC);                            \
+        cycles = (int)syscall(__NR_perf_event_open, &atr, 0, -1, -1,           \
+                              PERF_FLAG_FD_CLOEXEC);                           \
+        if (cycles < 0 && errno == EINVAL) {                                   \
+            cycles = (int)syscall(__NR_perf_event_open, &atr, 0, -1, -1, 0);   \
+            if (cycles >= 0) {                                                 \
+                int _fdFlags = fcntl(cycles, F_GETFD);                         \
+                if (_fdFlags >= 0)                                             \
+                    (void)fcntl(cycles, F_SETFD, _fdFlags | FD_CLOEXEC);       \
+            }                                                                  \
+        }                                                                      \
     } while (0);
 
     #define BEGIN_CYCLES read(cycles, &begin_cycles, sizeof(begin_cycles));

wolfcrypt/src/port/af_alg/afalg_hash.c

@@ -224,11 +224,11 @@ static int AfalgHashCopy(wolfssl_AFALG_Hash* src, wolfssl_AFALG_Hash* dst)
 #endif
 
 #if defined(__linux__) && defined(SOCK_CLOEXEC)
-    dst->rdFd = accept4(src->rdFd, NULL, 0, SOCK_CLOEXEC);
-    dst->alFd = accept4(src->alFd, NULL, 0, SOCK_CLOEXEC);
+    dst->rdFd = accept4(src->rdFd, NULL, NULL, SOCK_CLOEXEC);
+    dst->alFd = accept4(src->alFd, NULL, NULL, SOCK_CLOEXEC);
 #else
-    dst->rdFd = accept(src->rdFd, NULL, 0);
-    dst->alFd = accept(src->alFd, NULL, 0);
+    dst->rdFd = accept(src->rdFd, NULL, NULL);
+    dst->alFd = accept(src->alFd, NULL, NULL);
 #endif
 
     if (dst->rdFd == WC_SOCK_NOTSET || dst->alFd == WC_SOCK_NOTSET) {

wolfcrypt/src/port/af_alg/wc_afalg.c

@@ -57,9 +57,9 @@ int wc_Afalg_Accept(struct sockaddr_alg* in, int inSz, int sock)
     }
 
 #if defined(__linux__) && defined(SOCK_CLOEXEC)
-    return accept4(sock, NULL, 0, SOCK_CLOEXEC);
+    return accept4(sock, NULL, NULL, SOCK_CLOEXEC);
 #else
-    return accept(sock, NULL, 0);
+    return accept(sock, NULL, NULL);
 #endif
 }