From owner-freebsd-bugs  Mon Jul  5 18:20: 8 1999
Delivered-To: freebsd-bugs@freebsd.org
Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21])
	by hub.freebsd.org (Postfix) with ESMTP id A69891538F
	for <freebsd-bugs@FreeBSD.org>; Mon,  5 Jul 1999 18:20:03 -0700 (PDT)
	(envelope-from gnats@FreeBSD.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.9.3/8.9.2) id SAA54091;
	Mon, 5 Jul 1999 18:20:03 -0700 (PDT)
	(envelope-from gnats@FreeBSD.org)
Received: from hot.ee.lbl.gov (hot.ee.lbl.gov [131.243.1.42])
	by hub.freebsd.org (Postfix) with ESMTP id 3B3741539A
	for <FreeBSD-gnats-submit@freebsd.org>; Mon,  5 Jul 1999 18:18:09 -0700 (PDT)
	(envelope-from leres@hot.ee.lbl.gov)
Received: (from leres@localhost)
	by hot.ee.lbl.gov (8.9.2/8.9.2) id SAA03813;
	Mon, 5 Jul 1999 18:18:09 -0700 (PDT)
Message-Id: <199907060118.SAA03813@hot.ee.lbl.gov>
Date: Mon, 05 Jul 1999 18:18:08 PDT
From: Craig Leres <leres@ee.lbl.gov>
To: FreeBSD-gnats-submit@freebsd.org
Cc: leres@ee.lbl.gov (Craig Leres)
X-Send-Pr-Version: 3.2
Subject: bin/12528: [PATCH] tip's "tipout" child doesn't always exit
Sender: owner-freebsd-bugs@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org


>Number:         12528
>Category:       bin
>Synopsis:       [PATCH] tip's "tipout" child doesn't always exit
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Jul  5 18:20:02 PDT 1999
>Closed-Date:
>Last-Modified:
>Originator:     Craig Leres
>Release:        FreeBSD 3.2-RELEASE i386
>Organization:
Lawrence Berkeley National Laboratory
>Environment:
>Description:

	If the user exists abruptly, tip's "tipout" child can hang
	around forever. Since the lock file doesn't get cleaned up,
	this prevents other users from accessing the target device.

>How-To-Repeat:

	Here's how I found this:

	    - slogin to a host
	    - tip to a device
	    - terminate slogin with the "~." sequence
	    - notice that the 2nd tip process still exists
	    - notice that the lockfile still exists
	
	I used truss on the 2nd process. Before terminating we have:

	    syscall sigprocmask(0x3,0x0)
		    returns 18528 (0x4860)
	    syscall read(0x3,0xbfbfd26c,0x400)
		    returns 7 (0x7)
	    syscall sigprocmask(0x1,0x4860)
		    returns 0 (0x0)
	    syscall write(1,0xbfbfd26c,7)
		    returns 7 (0x7)
	    syscall sigprocmask(0x3,0x0)
		    returns 18528 (0x4860)

	After exiting from slogin:

	    syscall read(0x3,0xbfbfd26c,0x400)
		    returns 1 (0x1)
	    syscall sigprocmask(0x1,0x4860)
		    returns 0 (0x0)
	    syscall write(1,0xbfbfd26c,1)
		    errno 5 'Input/output error'
	    syscall sigprocmask(0x3,0x0)
		    returns 18528 (0x4860)
	    syscall read(0x3,0xbfbfd26c,0x400)
		    returns 1 (0x1)
	    syscall sigprocmask(0x1,0x4860)
		    returns 0 (0x0)
	    syscall write(1,0xbfbfd26c,1)
		    errno 5 'Input/output error'
	    syscall sigprocmask(0x3,0x0)
		    returns 18528 (0x4860)
	    syscall read(0x3,0xbfbfd26c,0x400)
		    returns 7 (0x7)
	    syscall sigprocmask(0x1,0x4860)
		    returns 0 (0x0)

	This repeats until all the characters from the device are
	processed and then the process becomes dormant.

>Fix:
	
	The tipout child needs to exit if write() fails with EIO. But
	if the device does not output any characters, we won't get to
	this exit so the parent should also arrange for the child to be
	killed when it exits.

RCS file: RCS/tip.c,v
retrieving revision 1.1
diff -c -r1.1 tip.c
*** /tmp/,RCSt1G48409	Mon Jul  5 18:13:45 1999
--- tip.c	Mon Jul  5 18:13:13 1999
***************
*** 80,85 ****
--- 80,86 ----
  
  void	intprompt();
  void	timeout();
+ void	killchild();
  void	cleanup();
  void	tipdone();
  char	*sname();
***************
*** 285,290 ****
--- 286,300 ----
  }
  
  void
+ killchild()
+ {
+ 	if (pid != 0) {
+ 		kill(pid, SIGTERM);
+ 		pid = 0;
+ 	}
+ }
+ 
+ void
  cleanup()
  {
  
***************
*** 425,430 ****
--- 435,442 ----
  {
  	int i;
  	char gch, bol = 1;
+ 
+ 	atexit(killchild);
  
  	/*
  	 * Kinda klugey here...
RCS file: RCS/tipout.c,v
retrieving revision 1.1
diff -c -r1.1 tipout.c
*** /tmp/,RCSt1E48414	Mon Jul  5 18:13:46 1999
--- tipout.c	Mon Jul  5 17:49:07 1999
***************
*** 160,166 ****
  		omask = sigblock(ALLSIGS);
  		for (cp = buf; cp < buf + cnt; cp++)
  			*cp &= 0177;
! 		write(1, buf, cnt);
  		if (boolean(value(SCRIPT)) && fscript != NULL) {
  			if (!boolean(value(BEAUTIFY))) {
  				fwrite(buf, 1, cnt, fscript);
--- 160,167 ----
  		omask = sigblock(ALLSIGS);
  		for (cp = buf; cp < buf + cnt; cp++)
  			*cp &= 0177;
! 		if (write(1, buf, cnt) < 0)
! 			exit(1);
  		if (boolean(value(SCRIPT)) && fscript != NULL) {
  			if (!boolean(value(BEAUTIFY))) {
  				fwrite(buf, 1, cnt, fscript);

>Release-Note:
>Audit-Trail:
>Unformatted:


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message