valyala/fasthttp · error

cannot mark listening socket close-on-exec: %w

Error message

cannot mark listening socket close-on-exec: %w

What it means

On z/OS s390x, the socket was created but the subsequent unix.FcntlInt(fd, F_SETFD, FD_CLOEXEC) call to mark it close-on-exec failed. The library closes the fd and returns this error. Without CLOEXEC, the listening fd would leak into exec'd child processes, which the library treats as a hard failure.

Source

Thrown at tcplisten/socket_zos_s390x.go:19

//go:build zos && s390x

package tcplisten

import (
	"fmt"

	"golang.org/x/sys/unix"
)

func newSocketCloexec(domain, typ, proto int) (int, error) {
	fd, err := unix.Socket(domain, typ, proto)
	if err != nil {
		return -1, fmt.Errorf("cannot create listening socket: %w", err)
	}
	_, err = unix.FcntlInt(uintptr(fd), unix.F_SETFD, unix.FD_CLOEXEC)
	if err != nil {
		unix.Close(fd) //nolint:errcheck
		return -1, fmt.Errorf("cannot mark listening socket close-on-exec: %w", err)
	}
	_, err = unix.FcntlInt(uintptr(fd), unix.F_SETFL, unix.O_NONBLOCK)
	if err != nil {
		unix.Close(fd) //nolint:errcheck
		return -1, fmt.Errorf("cannot mark listening socket nonblocking: %w", err)
	}
	return fd, nil
}

View on GitHub (pinned to c96f600972)

Solutions

1. Check the wrapped errno; EBADF suggests fd exhaustion/races, EPERM suggests security restrictions
2. Ensure RLIMIT_NOFILE/MAXFILEPROC is high enough so fd creation is stable
3. Verify BPX security profiles permit fcntl operations on sockets
4. Update Go/x-sys versions for z/OS fcntl fixes

null

null

ln, err := cfg.NewListener("tcp", addr)
if err != nil {
    if strings.Contains(err.Error(), "cannot mark listening socket close-on-exec") {
        var errno syscall.Errno
        if errors.As(err, &errno) {
            log.Printf("F_SETFD FD_CLOEXEC failed: %v — check security profiles and fd stability", errno)
        }
        return err
    }
}

When it happens

Trigger: Calling NewListener on z/OS s390x when fcntl(F_SETFD, FD_CLOEXEC) on the fresh socket fd returns an error (e.g. EBADF if the fd is invalid, EPERM under restrictive security settings).

Common situations: Restricted z/OS security environments disallowing fcntl on socket descriptors; kernel-level anomalies after fd exhaustion race conditions where the fd was closed concurrently.

Related errors

• cannot mark listening socket nonblocking: %w
• cannot create listening socket: %w
• cannot make non-blocked listening socket: %w
• cannot create listening unblocked socket: %w
• unexpected convert socket fd int to uintptr: %w

AI-assisted analysis of valyala/fasthttp@c96f600972 (2026-08-31). Data as JSON: /api/errors/ebfbbc6ae7920904. Report an issue: GitHub.