Bug 781498 - ksh shell forking during variable assignment fails to close the file descriptors in the child process prior to exec
Summary: ksh shell forking during variable assignment fails to close the file descript...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ksh
Version: 6.2
Hardware: All
OS: Linux
high
high
Target Milestone: rc
: 6.4
Assignee: Michal Hlavinka
QA Contact: qe-baseos-tools-bugs
URL:
Whiteboard:
Depends On:
Blocks: 812930
TreeView+ depends on / blocked
 
Reported: 2012-01-13 15:48 UTC by Ken Booth
Modified: 2018-11-27 20:06 UTC (History)
9 users (show)

Fixed In Version: ksh-20100621-14.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 812930 (view as bug list)
Environment:
Last Closed: 2012-06-20 14:47:13 UTC
Target Upstream Version:


Attachments (Terms of Use)
patch to fix this (517 bytes, patch)
2012-02-27 14:05 UTC, Michal Hlavinka
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Knowledge Base (Legacy) 68576 0 None None None Never
Red Hat Product Errata RHBA-2012:0952 0 normal SHIPPED_LIVE ksh bug fix update 2012-06-19 20:59:36 UTC

Description Ken Booth 2012-01-13 15:48:00 UTC
Description of problem:


Version-Release number of selected component (if applicable):
ksh-20100621-12.el6_2.1.x86_64

How reproducible:
Always

Steps to Reproduce:
1. su -
2. ksh
3. A=${pvs)
  
Actual results:
File descriptor 11 (/tmp/sf3e.p59 (deleted)) leaked on pvs invocation. Parent PID 22694: ksh


Expected results:
(no warnings)

Additional info:
This is not reproducible on RHEL5.7
So far I have only reproduced it using execution of the LVM command through a variable assignment as per the syntax above.

Further analysis of an strace shows the following ...

ksh on rhel57 (ksh-20100202-1.el5_6.6) does the following, dupping FD#10 to FD#1 and then closing FD#10 after a clone of pid 13008.

13007 fstat(1, {st_mode=S_IFSOCK|0200, st_size=0, ...}) = 0
13007 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x2b1db3dcefe0) = 13008
13007 fstat(5, {st_mode=S_IFSOCK|0400, st_size=0, ...}) = 0
13007 fstat(5, {st_mode=S_IFSOCK|0400, st_size=0, ...}) = 0
13007 close(1)                          = 0
13007 close(1)                          = -1 EBADF (Bad file descriptor)
13007 fcntl(10, F_DUPFD, 1)             = 1
13007 close(10)                         = 0

but ksh on rhel61 (ksh-20100621-6.el6.x86_64) does the following, dupping FD#1 to FD#11 then forking and dupping FD#11 to FD#1 and closing FD#11 after the fork.

10957 rt_sigprocmask(SIG_BLOCK, [HUP INT QUIT PIPE], [], 8) = 0
10957 vfork()                           = 10964
10957 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
10964 rt_sigprocmask(SIG_SETMASK, [],  <unfinished ...>
10957 close(1 <unfinished ...>
10964 <... rt_sigprocmask resumed> NULL, 8) = 0
10957 <... close resumed> )             = 0
10957 fcntl(11, F_DUPFD, 1)             = 1
10964 execve("/sbin/lvs", ["lvs"], [/* 31 vars */] <unfinished ...>
10957 close(11)                         = 0

So it looks like because RHEL5.7 uses clone, we are able to close FD#10 after a clone because

       "Unlike fork(2), these calls allow the child process to share parts of its  execution
        context with the calling process, such  as  the  memory  space,  the table  of  file
        descriptors, and the table of signal handlers."

but because RHEL6.1 uses vfork we cannot close FD#11 after the fork.

So this looks like a bug introduced in the new version of ksh.

Comment 3 Michal Hlavinka 2012-02-27 14:05:10 UTC
Created attachment 566049 [details]
patch to fix this

Comment 6 errata-xmlrpc 2012-06-20 14:47:13 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0952.html


Note You need to log in before you can comment on or make changes to this bug.