[krbdev.mit.edu #3059] spurious EBADF in krshd

[The RT System itself via RT]

>From krb5-bugs-incoming-bounces at PCH.mit.edu  Sat May 14 19:27:04 2005
Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by krbdev.mit.edu (8.9.3p2) with ESMTP
	id TAA11230; Sat, 14 May 2005 19:27:04 -0400 (EDT)
Received: from pch.mit.edu (pch.mit.edu [127.0.0.1])
	by pch.mit.edu (8.12.8p2/8.12.8) with ESMTP id j4ENQWWn007627
	for <krb5-send-pr at krbdev.mit.edu>; Sat, 14 May 2005 19:26:32 -0400
Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU
	[18.7.21.83])
	by pch.mit.edu (8.12.8p2/8.12.8) with ESMTP id j4DMv8Wn021485
	for <krb5-bugs-incoming at PCH.mit.edu>; Fri, 13 May 2005 18:57:08 -0400
Received: from mx1.redhat.com (mx1.redhat.com [66.187.233.31])
	j4DMv25E028799
	for <krb5-bugs at mit.edu>; Fri, 13 May 2005 18:57:02 -0400 (EDT)
Received: from int-mx1.corp.redhat.com (int-mx1.corp.redhat.com
	[172.16.52.254])
	by mx1.redhat.com (8.12.11/8.12.11) with ESMTP id j4DMv1XX026658
	for <krb5-bugs at mit.edu>; Fri, 13 May 2005 18:57:01 -0400
Received: from devserv.devel.redhat.com (devserv.devel.redhat.com
	[172.16.58.1])
	by int-mx1.corp.redhat.com (8.11.6/8.11.6) with ESMTP id j4DMv1O28024
	for <krb5-bugs at mit.edu>; Fri, 13 May 2005 18:57:01 -0400
Received: from blade.boston.redhat.com (blade.boston.redhat.com
	[172.16.80.50])j4DMv1JK023772
	for <krb5-bugs at mit.edu>; Fri, 13 May 2005 18:57:01 -0400
Received: from blade.boston.redhat.com (localhost.localdomain [127.0.0.1])
	j4DMv0HN022990
	for <krb5-bugs at mit.edu>; Fri, 13 May 2005 18:57:01 -0400
Received: (from nalin at localhost)
	by blade.boston.redhat.com (8.13.4/8.13.4/Submit) id j4DMv0T4022989;
	Fri, 13 May 2005 18:57:00 -0400
Date: Fri, 13 May 2005 18:57:00 -0400
Message-Id: <200505132257.j4DMv0T4022989 at blade.boston.redhat.com>
To: krb5-bugs at mit.edu
From: Nalin Dahyabhai <nalin at redhat.com>
X-send-pr-version: 3.99
X-Spam-Score: -4.9
X-Spam-Flag: NO
X-Scanned-By: MIMEDefang 2.42
X-Mailman-Approved-At: Sat, 14 May 2005 19:26:31 -0400
Subject: spurious EBADF in krshd
X-BeenThere: krb5-bugs-incoming at mailman.mit.edu
X-Mailman-Version: 2.1
Precedence: list
Reply-To: Nalin Dahyabhai <nalin at redhat.com>
Sender: krb5-bugs-incoming-bounces at PCH.mit.edu
Errors-To: krb5-bugs-incoming-bounces at PCH.mit.edu

>Submitter-Id:	net
>Originator:	Unnamed developer at Lehman Brothers
>Organization:
>Confidential:	no
>Synopsis:	spurious EBADF in krshd
>Severity:	non-critical
>Priority:	low
>Category:	krb5-appl
>Class:		sw-bug
>Release:	1.4.1
>Environment:
System: Linux blade.boston.redhat.com 2.6.11-1.1267_FC4smp #1 SMP Mon Apr 25 19:38:16 EDT 2005 i686 athlon i386 GNU/Linux
Architecture: i686

>Description:
	When krshd.c closes px[1], the write end of the running shell's
	stdin stream, it does not remove the descriptor from write_to, the
	list of descriptors which are checked for writability.  The next
	call to select() will return EBADF and krshd will exit prematurely.
>How-To-Repeat:
	Use rsh to run a command (such as "ls") which prints output, and
	redirect input from /dev/null:
	    rsh -x myhost ls < /dev/null
>Fix:
	Call FD_CLR(px[1], &write_to) after any call to close(px[1]):

--- src/appl/bsd/krshd.c	2005-05-13 18:49:58.000000000 -0400
+++ src/appl/bsd/krshd.c	2005-05-13 18:49:53.000000000 -0400
@@ -1296,6 +1296,7 @@
 		    cc = rcmd_stream_read(f, buf, sizeof(buf), 0);
 		    if (cc <= 0) {
 			(void) close(px[1]);
+			FD_CLR(px[1], write_to);
 			FD_CLR(f, &readfrom);
 		    } else {
 		        int wcc;
@@ -1304,6 +1305,7 @@
 			  /* pipe closed, don't read any more */
 			  /* might check for EPIPE */
 			  (void) close(px[1]);
+			  FD_CLR(px[1], write_to);
 			  FD_CLR(f, &readfrom);
 			} else if (wcc != cc) {
 			  syslog(LOG_INFO, "only wrote %d/%d to child",