Skip to content

usockets: drain + back off on accept() EMFILE instead of spinning #32705

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
robobun wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

usockets: drain + back off on accept() EMFILE instead of spinning #32705

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ad51466
usockets: drain+back off on accept() EMFILE instead of spinning
robobun Jul 27, 2026
501e8cc
trim doc comment
robobun Jul 27, 2026
402e15c
cfg-gate the ulimit -n hint in Bun__warnAcceptEMFILE
robobun Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions packages/bun-usockets/src/context.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -379,6 +379,7 @@ static void us_internal_init_listen_socket(struct us_listen_socket_t *ls,
ls->socket_ext_size = socket_ext_size;
ls->deferred_accept = 0;
ls->accept_paused = (options & LIBUS_SOCKET_OPEN_PAUSED) && !ssl_ctx;
ls->emfile_paused = 0;

/* Link into the group so close_all() / test-isolation can find it. */
ls->next = group->head_listen_sockets;
Expand Down Expand Up @@ -482,6 +483,12 @@ void us_listen_socket_close(struct us_listen_socket_t *ls) {
if (!us_socket_is_closed(s)) {
struct us_socket_group_t *group = ls->accept_group;
struct us_loop_t *loop = s->group->loop;
#ifdef LIBUS_USE_LIBUV
if (ls->emfile_paused) {
ls->emfile_paused = 0;
us_internal_disable_sweep_timer(loop);
}
#endif
us_poll_stop((struct us_poll_t *) s, loop);
bsd_close_socket(us_poll_fd((struct us_poll_t *) s));

Expand Down
2 changes: 2 additions & 0 deletions packages/bun-usockets/src/eventing/epoll_kqueue.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -464,6 +464,7 @@ void us_loop_run(struct us_loop_t *loop) {

us_internal_dispatch_ready_polls(loop);
us_internal_drain_ready_polls(loop);
us_internal_accept_rearm_if_due(loop);
us_internal_sweep_if_due(loop);

/* Emit post callback */
Expand Down Expand Up @@ -556,6 +557,7 @@ void us_loop_run_bun_tick(struct us_loop_t *loop, const struct timespec* timeout

us_internal_dispatch_ready_polls(loop);
us_internal_drain_ready_polls(loop);
us_internal_accept_rearm_if_due(loop);
us_internal_sweep_if_due(loop);

/* Emit post callback */
Expand Down
6 changes: 6 additions & 0 deletions packages/bun-usockets/src/internal/internal.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,7 +180,9 @@ void us_internal_disable_sweep_timer(struct us_loop_t *loop);
uint64_t us_internal_monotonic_ns(void);
long long us_internal_sweep_timeout_ns(struct us_loop_t *loop);
void us_internal_sweep_if_due(struct us_loop_t *loop);
void us_internal_accept_rearm_if_due(struct us_loop_t *loop);
#endif
void us_internal_accept_emfile(struct us_listen_socket_t *ls, struct us_loop_t *loop);
void us_internal_free_closed_sockets(us_loop_r loop);
void us_internal_loop_link_group(struct us_loop_t *loop, struct us_socket_group_t *group);
void us_internal_loop_unlink_group(struct us_loop_t *loop, struct us_socket_group_t *group);
Expand Down Expand Up @@ -497,6 +499,10 @@ struct us_listen_socket_t {
unsigned char deferred_accept;
/* LIBUS_SOCKET_OPEN_PAUSED: accepted sockets start without read interest. */
unsigned char accept_paused;
/* accept() hit EMFILE/ENFILE and the reserve-fd drain could not clear the
* backlog: the listener poll is watching no events (a level-triggered
* readable would spin the loop). Cleared when the backoff re-arms it. */
unsigned char emfile_paused;
};

void us_internal_socket_group_link_connecting_socket(us_socket_group_r group, struct us_connecting_socket_t *c);
Expand Down
7 changes: 7 additions & 0 deletions packages/bun-usockets/src/internal/loop_data.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,13 @@ struct us_internal_loop_data_t {
/* Absolute monotonic ns of the next sweep, or -1. Folded into the poll
* timeout — no timerfd, no EVFILT_TIMER. */
long long sweep_next_tick_ns;
/* Absolute monotonic ns at which to re-arm listeners paused on EMFILE, or
* -1. Folded into the poll timeout like sweep_next_tick_ns. */
long long accept_rearm_next_tick_ns;
/* Spare fd (open("/dev/null")) the accept path borrows under EMFILE: close,
* accept()+close() to drain the backlog so the level-triggered readable
* clears, reopen. -1 if the open failed or the reopen lost the race. */
int accept_reserve_fd;
#endif
int sweep_timer_count;
struct us_internal_async *wakeup_async;
Expand Down
137 changes: 128 additions & 9 deletions packages/bun-usockets/src/loop.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,34 @@ extern const size_t Bun__lock__size;
#endif

extern void Bun__internal_ensureDateHeaderTimerIsEnabled(struct us_loop_t *loop);
extern void Bun__warnAcceptEMFILE(int err);

/* accept() returned an error that means "out of file descriptors" (per-process
* or system-wide). The listener poll is level-triggered, so leaving it armed
* would spin the loop re-failing accept() at full speed. */
static int us_internal_is_emfile(int err) {
#ifdef _WIN32
return err == WSAEMFILE || err == WSAENOBUFS;
#else
return err == EMFILE || err == ENFILE;
Comment on lines +55 to +59

@claude claude Bot Oct 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟣 pre-existing, not blocking: Linux servers whose accept() fails with ENOBUFS or ENOMEM still peg a core, the same spin this change claims to remove for EMFILE. us_internal_is_emfile at loop.c:59 only matches EMFILE and ENFILE, so the gate at loop.c:705 sends those errors back to the level-triggered poll with the connection still queued, and the Windows arm at loop.c:57 does include WSAENOBUFS, so the two platforms disagree on the same error. Fix: make the backoff cover every accept() errno that leaves the pending connection in the queue (ENOBUFS, ENOMEM alongside EMFILE/ENFILE), routing them to the pause/re-arm path rather than only the two names, so the spin is fixed as a class rather than for one errno.
A small fix can ride a push you are already making; otherwise a short reply is enough.

Why this was flagged

Trigger: accept4() on Linux returns ENOBUFS or ENOMEM (socket buffer / kernel memory exhaustion, documented in accept(2)) while a connection is pending; reached from us_internal_dispatch_ready_poll loop.c:703-706 on every Bun.serve listener. The new predicate us_internal_is_emfile at loop.c:59 returns 0 for those errnos, so us_internal_accept_emfile is never called, the listener keeps EPOLLIN level-triggered readable, and epoll_pwait2 returns immediately on every tick exactly as the PR's strace shows for EMFILE. The base branch spun on every accept error too, but this PR's purpose is to end that spin and it adds a per-errno gate that leaves siblings unhandled; the Windows branch at loop.c:57 treats WSAENOBUFS as a backoff case, so the omission is a platform-parity gap in the same function. Population: memory-constrained containers under connection bursts. Remedy: extend the predicate to ENOBUFS/ENOMEM (or invert it to 'not EAGAIN/EWOULDBLOCK/ECONNABORTED/EINTR') so any persistent accept failure backs off.

Verification: On Linux accept4() fails with ENOMEM while a connection is still queued in the backlog. packages/bun-usockets/src/loop.c:56-62 us_internal_is_emfile returns true only for err == EMFILE || err == ENFILE, and the only backoff gate is loop.c:703-707. For ENOMEM/ENOBUFS no drain happens and epoll_pwait2 returns immediately every tick. The base branch already spins on these errnos by the same route.

#endif
}

/* Re-arm every listener that was paused on EMFILE. Runs from the backoff
* deadline (POSIX) or the sweep timer (libuv). Returns how many were resumed. */
static int us_internal_resume_emfile_paused_listeners(struct us_loop_t *loop) {
int resumed = 0;
for (struct us_socket_group_t *g = loop->data.head; g; g = g->next) {
for (struct us_listen_socket_t *ls = g->head_listen_sockets; ls; ls = ls->next) {
if (ls->emfile_paused) {
ls->emfile_paused = 0;
us_poll_change((struct us_poll_t *) ls, loop, LIBUS_SOCKET_READABLE);
resumed++;
}
}
}
return resumed;
}

#ifdef LIBUS_USE_LIBUV

Expand All @@ -70,6 +98,21 @@ void us_internal_disable_sweep_timer(struct us_loop_t *loop) {
}
}

/* Windows: no reserve-fd trick (sockets are a separate table from file
* handles). Pause the listener poll and let the sweep timer re-arm it. */
void us_internal_accept_emfile(struct us_listen_socket_t *ls, struct us_loop_t *loop) {
Bun__warnAcceptEMFILE(LIBUS_ERR);
if (ls->emfile_paused) return;
us_poll_change((struct us_poll_t *) ls, loop, 0);
ls->emfile_paused = 1;
us_internal_enable_sweep_timer(loop);
}
Comment on lines +103 to +109

@claude claude Bot Oct 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 (optional) Windows servers that hit a transient WSAEMFILE/WSAENOBUFS now stop accepting for up to 4 seconds, where the base branch resumed as soon as a handle freed. The libuv arm of us_internal_accept_emfile at loop.c:103-109 unpolls the listener and relies on sweep_timer_cb to re-arm it, but that timer fires on the LIBUS_TIMEOUT_GRANULARITY cadence (4s, libusockets.h:100), so queued clients wait 0-4s even after handles are available. Fix: re-arm paused listeners on the same ~200ms backoff as POSIX on every backend, e.g. a dedicated one-shot us_create_timer with LIBUS_ACCEPT_REARM_NS, instead of piggybacking on the 4s sweep timer. [also at: packages/bun-usockets/src/loop.c:108 - On Windows a listener that hits WSAEMFILE/WSAENOBUFS stops accepting for up to 4 seconds, not the ~200 ms the PR describes.]

Why this was flagged

On Windows, bsd_accept_socket fails with WSAENOBUFS or WSAEMFILE (us_internal_is_emfile at loop.c:55-61) during a burst, reached from us_internal_dispatch_ready_poll at loop.c:701-705. The libuv us_internal_accept_emfile at loop.c:103-109 calls us_poll_change(ls, loop, 0) and us_internal_enable_sweep_timer. us_internal_enable_sweep_timer at loop.c:86-92 arms sweep_timer with period LIBUS_TIMEOUT_GRANULARITY * 1000 = 4000 ms (libusockets.h:100), and if sweep_timer_count was already >0 the existing 4s cadence is untouched. The only re-arm is us_internal_accept_rearm_libuv called from sweep_timer_cb at loop.c:551, so the listener stays unpolled until the next sweep tick, anywhere from 0 to 4 s later. The base branch kept the listener polled and accepted the queued connection on the very next loop iteration after a handle freed, so clients that arrived during a short handle shortage now see several seconds of connect latency instead of milliseconds. POSIX uses LIBUS_ACCEPT_REARM_NS (200 ms) at loop.c:169, so this is platform-parity only on paper.

Verification: Trigger: on Windows (LIBUS_USE_LIBUV), bsd_accept_socket fails with WSAEMFILE or WSAENOBUFS while the backlog is non-empty. The only path that re-arms a libuv-paused listener is sweep_timer_cb (loop.c:551-553), with period 4000 ms (libusockets.h:100). On base the listener stayed polled and accepted the instant a handle freed; after this change Windows clients wait 0-4 s after recovery.


static void us_internal_accept_rearm_libuv(struct us_loop_t *loop) {
int resumed = us_internal_resume_emfile_paused_listeners(loop);
while (resumed--) us_internal_disable_sweep_timer(loop);
}

#else

#define LIBUS_TIMEOUT_GRANULARITY_NS ((long long) LIBUS_TIMEOUT_GRANULARITY * 1000000000LL)
Expand All @@ -96,12 +139,17 @@ void us_internal_disable_sweep_timer(struct us_loop_t *loop) {
}

long long us_internal_sweep_timeout_ns(struct us_loop_t *loop) {
if (loop->data.sweep_next_tick_ns < 0) {
long long deadline = loop->data.sweep_next_tick_ns;
long long rearm = loop->data.accept_rearm_next_tick_ns;
if (rearm >= 0 && (deadline < 0 || rearm < deadline)) {
deadline = rearm;
}
if (deadline < 0) {
return -1;
}
/* Its own reading, deliberately: this bounds the poll so the sweep is not
* starved, and a caller's older reading would round the deadline up. */
long long diff = loop->data.sweep_next_tick_ns - (long long) us_internal_monotonic_ns();
long long diff = deadline - (long long) us_internal_monotonic_ns();
return diff > 0 ? diff : 0;
}

Expand All @@ -118,6 +166,67 @@ void us_internal_sweep_if_due(struct us_loop_t *loop) {
us_internal_timer_sweep(loop);
}

#define LIBUS_ACCEPT_REARM_NS (200LL * 1000000LL)

static int us_internal_open_accept_reserve_fd(void) {
int fd;
do {
fd = open("/dev/null", O_RDONLY | O_CLOEXEC);
} while (fd == -1 && errno == EINTR);
return fd;
}

/* accept() hit EMFILE/ENFILE. First try the libuv uv__emfile_trick: close the
* reserved fd, accept() as many queued connections as that one slot allows and
* close each immediately so the peer sees a clean refusal instead of a
* connection that never answers. Draining the backlog clears the
* level-triggered readable. If the drain exhausts before the backlog does (or
* the reserve is spent), fall back to unpolling the listener and scheduling a
* re-arm via accept_rearm_next_tick_ns so the loop idles instead of spinning. */
void us_internal_accept_emfile(struct us_listen_socket_t *ls, struct us_loop_t *loop) {
int err = LIBUS_ERR;
Bun__warnAcceptEMFILE(err);

if (err == EMFILE && loop->data.accept_reserve_fd != -1) {
close(loop->data.accept_reserve_fd);
loop->data.accept_reserve_fd = -1;
struct bsd_addr_t addr;
LIBUS_SOCKET_DESCRIPTOR fd;
while ((fd = bsd_accept_socket(us_poll_fd((struct us_poll_t *) ls), &addr)) != LIBUS_SOCKET_ERROR) {
bsd_close_socket(fd);
}
Comment on lines +195 to +197

@claude claude Bot Oct 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 (optional) An fd-exhausted server under a connection flood now stalls every existing connection and timer, where the base branch returned to the event loop on each failed accept(). The drain loop at loop.c:195-197 runs inside one dispatch until accept() errors; as long as new connections arrive faster than accept()+close() completes, us_internal_dispatch_ready_poll never returns, so no other poll, JS timer, or response on the fds that are actually held gets serviced. Fix: bound the drain to a fixed number of accept()+close() iterations per dispatch and fall through to the timed pause at loop.c:207-213 when the bound is hit; apply the same bound to any future libuv drain.

Why this was flagged

Trigger: a Bun.serve at RLIMIT_NOFILE (an attacker can get it there by holding connections open) receiving a sustained connect rate that exceeds the per-iteration cost of accept4()+close() on the listener; arrives through us_internal_dispatch_ready_poll at loop.c:702-706 into us_internal_accept_emfile. On the base branch the loop body was one failed accept() then return to epoll_pwait2, so other ready polls, Bun timers and the held connections' reads/writes were still dispatched every iteration (the spin cost CPU but not progress). After this change loop.c:195-197 is while (accept != ERROR) close(fd) with no iteration cap and no return to the loop; the only exit is accept() failing, which a flood prevents. us_internal_drain_ready_polls (epoll_kqueue.c:412) caps its re-poll at 48 iterations for exactly this starvation reason, but the new drain sits below that cap and is unbounded. Existing clients on the held fds observe their responses freeze; the one-shot warning gives no indication.

Verification: packages/bun-usockets/src/loop.c:195-197 is while ((fd = bsd_accept_socket(us_poll_fd((struct us_poll_t *) ls), &addr)) != LIBUS_SOCKET_ERROR) { bsd_close_socket(fd); } with no iteration cap, invoked from us_internal_dispatch_ready_poll at loop.c:704-708. On the base, the EMFILE branch was a single failed accept followed by return to epoll, so the starvation is new on this path.

int drain_err = LIBUS_ERR;
loop->data.accept_reserve_fd = us_internal_open_accept_reserve_fd();
if (!us_internal_is_emfile(drain_err)) {
/* Backlog drained to EAGAIN (or some other terminal error); the
* level-triggered readable is clear, no backoff needed. */
return;
}
}

if (ls->emfile_paused) return;
us_poll_change((struct us_poll_t *) ls, loop, 0);
ls->emfile_paused = 1;
long long deadline = (long long) us_internal_monotonic_ns() + LIBUS_ACCEPT_REARM_NS;
if (loop->data.accept_rearm_next_tick_ns < 0 || deadline < loop->data.accept_rearm_next_tick_ns) {
loop->data.accept_rearm_next_tick_ns = deadline;
Comment on lines +206 to +212

@claude claude Bot Oct 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 The timed backoff that actually stops the spin when the reserve-fd trick cannot help, and the whole Windows/libuv path, ship with no test, so a break there merges green. The new test only reaches the drain branch at loop.c:190-203 (reserve fd still held, EMFILE); the unpoll + accept_rearm_next_tick_ns re-arm at loop.c:206-212 and us_internal_accept_emfile at loop.c:103-109 never run under test. Fix: add a case that forces the fallback, e.g. socketFaultInjection.set({ syscall: "accept", action: "errno", errno: , repeat: -1 }) from bun:internal-for-testing, assert low CPU while armed and that a client connects after fault.clear(), and run it on Windows too (no ulimit needed). [also at: packages/bun-usockets/src/loop.c:213 - nit: The timed-backoff fallback and its re-arm path are not exercised by any test, so a regression there would land silently. serve-listen-emfile.test.ts only reaches the reserve-fd drain (loop.c:190-204), which returns before loop.c:207; the pause at loop.c:208-213, us_internal_accept_rearm_if_due, and the libuv sweep-timer branch could be deleted and the suite still passes.; test/js/bun/http/serve-listen-emfile.test.ts:97 - Maintainers get no test for the pause/re-arm half of this fix, so a regression there (listener never resumed) merges green.]

Why this was flagged

test/js/bun/http/serve-listen-emfile.test.ts:14 is skipIf(!isPosix) and exhausts fds with openSync while the loop's reserve fd is still open, so in the child the first EMFILE takes the drain branch at loop.c:190-203, bsd_accept_socket succeeds once, and drain_err is EAGAIN, returning before loop.c:206. Nothing exercises us_poll_change(ls, loop, 0) at loop.c:208, the deadline at loop.c:210-213, us_internal_accept_rearm_if_due at loop.c:216-228, or the libuv arm at loop.c:103-114 and sweep_timer_cb at loop.c:550-553. Deleting the rearm call at epoll_kqueue.c:467/560 leaves every paused listener dead forever and no test fails. On base there is no such code; after merging, a regression in the fallback silently turns a spinning server into one that never accepts again (ENFILE, reserve open failure, or any Windows WSAEMFILE).

Verification: In test/js/bun/http/serve-listen-emfile.test.ts:14 (test.skipIf(!isPosix)), the reserve fd is still held when the single backlog connection triggers EMFILE, so us_internal_accept_emfile takes loop.c:190, bsd_accept_socket succeeds once and the function returns at loop.c:202, before loop.c:205-212. Deleting lines 205-212 or 215-227 leaves the suite green. The libuv path (loop.c:102-113, 551) is skipped entirely.

}
}

void us_internal_accept_rearm_if_due(struct us_loop_t *loop) {
if (loop->data.accept_rearm_next_tick_ns < 0) {
return;
}
if ((long long) us_internal_monotonic_ns() < loop->data.accept_rearm_next_tick_ns) {
return;
}
loop->data.accept_rearm_next_tick_ns = -1;
if (loop->data.accept_reserve_fd == -1) {
loop->data.accept_reserve_fd = us_internal_open_accept_reserve_fd();
}
us_internal_resume_emfile_paused_listeners(loop);
Comment on lines +223 to +227

@claude claude Bot Oct 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 (optional) A server whose listener was paused on EMFILE can silently stop accepting forever if the re-arm's epoll/kqueue registration fails, whereas the base branch never unregisters the listener. us_internal_accept_rearm_if_due at loop.c:223 clears accept_rearm_next_tick_ns and loop.c:70-71 clears emfile_paused before us_poll_change, whose return code is discarded. On kqueue the pause deleted the EVFILT_READ knote (kqueue_change EV_DELETE, epoll_kqueue.c:629), so the re-arm is a fresh EV_ADD that can fail with ENOMEM under exactly the resource pressure that caused the pause. Fix: check the us_poll_change rc on every re-arm site (POSIX loop.c:71 and the libuv arm loop.c:112) and, on failure, keep emfile_paused set and re-schedule the deadline so the listener is retried instead of abandoned.

Why this was flagged

Trigger: a POSIX listener enters the pause path at loop.c:211-218 (reserve fd absent or ENFILE), then 200 ms later us_internal_accept_rearm_if_due runs from us_loop_run_bun_tick (epoll_kqueue.c:560). It sets accept_rearm_next_tick_ns = -1 at loop.c:223, then us_internal_resume_emfile_paused_listeners sets ls->emfile_paused = 0 at loop.c:70 and calls us_poll_change at loop.c:71, ignoring its return. On kqueue the pause ran kqueue_change(old=READABLE,new=0,keep=0) which is EV_DELETE (epoll_kqueue.c:629), so the re-arm is a new EV_ADD that kevent can reject with ENOMEM. After the failure no state records the listener as paused and no deadline is pending, so nothing ever re-arms it: the server keeps running, the port stays bound, and every new connection sits in the backlog until it times out, with no error. The base branch never removes the listener's read interest, so it cannot reach this state. Remedy: on a non-zero rc keep emfile_paused and re-schedule the deadline.

Verification: The re-arm clears accept_rearm_next_tick_ns = -1 first (loop.c:223), then sets ls->emfile_paused = 0 (loop.c:70) and calls us_poll_change(READABLE) (loop.c:71) discarding the result. If the EV_ADD fails, nothing records it, so the listener is never re-registered and silently accepts nothing until close. Base branch never deletes the listener knote, so this is a new failure mode.

}

#endif


Expand All @@ -129,6 +238,8 @@ int us_internal_loop_data_init(struct us_loop_t *loop, void (*wakeup_cb)(struct
loop->data.sweep_timer = us_create_timer(loop, 1, 0);
#else
loop->data.sweep_next_tick_ns = -1;
loop->data.accept_rearm_next_tick_ns = -1;
loop->data.accept_reserve_fd = us_internal_open_accept_reserve_fd();
#endif
loop->data.sweep_timer_count = 0;
loop->data.recv_buf = us_malloc(LIBUS_RECV_BUFFER_LENGTH + LIBUS_RECV_BUFFER_PADDING * 2);
Expand Down Expand Up @@ -167,6 +278,11 @@ void us_internal_loop_data_free(struct us_loop_t *loop) {
#ifdef LIBUS_USE_LIBUV
us_timer_close(loop->data.sweep_timer, 0);
if (loop->data.quic_timer) us_timer_close(loop->data.quic_timer, 0);
#else
if (loop->data.accept_reserve_fd != -1) {
close(loop->data.accept_reserve_fd);
loop->data.accept_reserve_fd = -1;
}
#endif
us_internal_async_close(loop->data.wakeup_async);
}
Expand Down Expand Up @@ -432,6 +548,7 @@ void us_internal_free_closed_sockets(struct us_loop_t *loop) {

#ifdef LIBUS_USE_LIBUV
void sweep_timer_cb(struct us_internal_callback_t *cb) {
us_internal_accept_rearm_libuv(cb->loop);
us_internal_timer_sweep(cb->loop);
}
#endif
Expand Down Expand Up @@ -519,13 +636,7 @@ void us_internal_dispatch_ready_poll(struct us_poll_t *p, int error, int eof, in
struct bsd_addr_t addr;

LIBUS_SOCKET_DESCRIPTOR client_fd = bsd_accept_socket(us_poll_fd(p), &addr);
if (client_fd == LIBUS_SOCKET_ERROR) {
/* Todo: start timer here */

} else {

/* Todo: stop timer if any */

if (client_fd != LIBUS_SOCKET_ERROR) {
do {
struct us_poll_t *accepted_p = us_create_poll(loop, 0, sizeof(struct us_socket_t) - sizeof(struct us_poll_t) + listen_socket->socket_ext_size);
us_poll_init(accepted_p, client_fd, POLL_TYPE_SOCKET);
Expand Down Expand Up @@ -587,6 +698,14 @@ void us_internal_dispatch_ready_poll(struct us_poll_t *p, int error, int eof, in

} while ((client_fd = bsd_accept_socket(us_poll_fd(p), &addr)) != LIBUS_SOCKET_ERROR);
}
/* EAGAIN is normal (backlog drained). EMFILE/ENFILE with a
* connection still pending would spin the level-triggered
* poll; drain it with the reserve fd and/or back off. */
if (client_fd == LIBUS_SOCKET_ERROR
&& !us_socket_is_closed(&listen_socket->s)
&& us_internal_is_emfile(LIBUS_ERR)) {
us_internal_accept_emfile(listen_socket, loop);
}
}
break;
}
Expand Down
27 changes: 27 additions & 0 deletions src/runtime/server/server_body.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3531,6 +3531,33 @@ bun_jsc::impl_js_class_via_generated!(DebugHTTPServer => crate::generated_classe
bun_jsc::impl_js_class_via_generated!(DebugHTTPSServer => crate::generated_classes::js_DebugHTTPSServer, no_constructor);

// ─── Exported fns ────────────────────────────────────────────────────────────

/// One-shot stderr warning from bun-usockets `us_internal_accept_emfile`.
#[unsafe(no_mangle)]
pub(super) extern "C" fn Bun__warnAcceptEMFILE(err: c_int) {
static WARNED: core::sync::atomic::AtomicBool = core::sync::atomic::AtomicBool::new(false);
if WARNED.swap(true, core::sync::atomic::Ordering::Relaxed) {
return;
}
if crate::cli::Command::get().debug.silent {
return;
}
let name = bun_errno::SystemErrno::init(i64::from(err))
.map(<&'static str>::from)
.unwrap_or("EMFILE");
#[cfg(not(windows))]
bun_core::pretty_errorln!(
"<r><yellow>warn<r><d>:<r> accept() failed with <b>{}<r>; out of file descriptors, refusing queued connections. Raise <d><cyan>`ulimit -n`<r> if this is unexpected.",
name,
);
#[cfg(windows)]
bun_core::pretty_errorln!(
"<r><yellow>warn<r><d>:<r> accept() failed with <b>{}<r>; out of socket handles, refusing queued connections.",
name,
);
Output::flush();
Comment thread
robobun marked this conversation as resolved.
}

fn server_set_on_client_error(
global: &JSGlobalObject,
server: JSValue,
Expand Down
4 changes: 4 additions & 0 deletions src/uws_sys/InternalLoopData.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,10 @@ pub struct InternalLoopData {
pub sweep_timer: *mut Timer,
#[cfg(not(windows))]
pub sweep_next_tick_ns: i64,
#[cfg(not(windows))]
pub accept_rearm_next_tick_ns: i64,
#[cfg(not(windows))]
pub accept_reserve_fd: c_int,
pub sweep_timer_count: i32,
pub wakeup_async: *mut us_internal_async,
pub head: *mut SocketGroup,
Expand Down
Loading
Loading