Another reproducer is like this:
# telnet localhost | cat
(login)
# yes
y
y
y
...
(segfault)

qe triage:
reproducer is +- clear
but what should be new behavior? error message and end? warning and continue (2x cmd like cat, the first is killed ? )

# lets expect 22 is running sshd

telnet localhost 22 | cat &
kill -9 `pidof cat`

OLD: telnet crashed as coredumpctl list dump telnet
NEW: whats expected here ? telnet ends with error message?

Hi Petr,

I think that I would like to achieve the same behaviour that you get when you kill the server side. For instance if you run telnet without the pipeline and then kill the login process from another terminal, you get this:
# telnet localhost
Trying ::1...
Connected to localhost.
Escape character is '^]'.

Kernel 4.18.0-240.10.el8.x86_64 on an x86_64
ci-vm-10-0-137-223 login: Connection closed by foreign host.

I am working on this but still I am unsure how to fix this correctly.

Scoped, as per discussion with Michal, setting ITM to 10.

I can see few potential ways of reproducing this so there shouldn't be any issue with providing reliable test.

So I get the gist of the problem here. Before the signal handler for SIGPIPE is set, sigsetjmp(peerdied, 1) is set on line 2509 in commands.c. When SIGPIPE is delivered by the system, function deadpeer is the handler and it calls the siglongjmp(peerdier, -1) so it should jump right after the sigsetjmp. The problem is that there is a buffer that tries to flush itself out before ending. But the other end is still broken so the SIGPIPE is raised again. That goes into a loop, calling the handler over and over.

The problem here might probably be in the signal() system call. It does not restore the default behaviour after signal has been raised. The sigsetjmp function is called before setting up the signal for SIGPIPE so I thought that the default behaviour for SIGPIPE should be restored when the jump is performed but it is not. I think that the solution should be to simply revert the handling to default directly in the handler so that if telnet tries to empty some buffer after the pipe is gone, it should die on the default SIGPIPE behaviour.

Created attachment 1728798 [details]
Possible patch

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (telnet bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:1799

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days