fget_cap() tries to do a cheaper snapshot of a file descriptor without
holding the file descriptor lock. This snapshot does not do a deep copy
of the ioctls capability array, but instead uses a different return value
to inform the caller to retry the copy with the lock held. However,
filecaps_copy() was returning 1 to indicate that a retry was required,
and fget_cap() was checking for 0 (actually '!filecaps_copy()'). As
a result, fget_cap() did not do a deep copy of the ioctls array and
just reused the original pointer. This cause multiple file descriptor
entries to think they owned the same pointer and eventually resulted in
duplicate frees.
The only code path that I'm aware of that triggers this is to create a
listen socket that has a restricted list of ioctls and then call accept()
which calls fget_cap() with a valid filecaps structure from getsock_cap().
To fix, change the return value of filecaps_copy() to return true if it
succeeds in copying the caps and false if it fails because the lock is
required. I find this more intuitive than fixing the caller in this case.
While here, change the return type from 'int' to 'bool'.
Finally, make filecaps_copy() more robust in the failure case by not
copying any of the source filecaps structure over. This avoids the
possibility of leaking a pointer into a structure if a similar future
caller doesn't properly handle the return value from filecaps_copy().
I also added a test case that panics before this change and now passes.