openssh bugs - May 2021 - [Bug 3280] stdout resource unavailable error when used with a pipe

https://bugzilla.mindrot.org/show_bug.cgi?id=3280

            Bug ID: 3280
           Summary: stdout resource unavailable error when used with a
                    pipe
           Product: Portable OpenSSH
           Version: 8.5p1
          Hardware: PPC
                OS: AIX
            Status: NEW
          Severity: normal
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: sanumesh at in.ibm.com

Hello

when a script that has ssh and cat is passed onto a pipe command then
there is a error seen as resource unavailable.

Recreation :

# cat tp.sh
#!/usr/bin/ksh93

export LANG=C

{
  ssh localhost hostname
  cat /usr/bin/mksysb
} | sleep 10

execution output :

# ./tp.sh
root at localhost's password:
cat: output error
Resource temporarily unavailable

Possible root cause :

1 ssh calls dup() to copy stdout(fd=1) to fd=5.

2 ssh sets O_NONBLOCK flag to fd=5.

3 ssh calls dup2() to assign /dev/null(fd=7) to fd=1.
then, ssh closes fd=7. so fd=1 -> /dev/null and fd=5 -> ssh's stdout

4- ssh calls unset_nonblock() to try to clear
O_NONBLOCK from fd=1, but it can't because /dev/null has been assigned
to fd=1.

ssh doesn't clear O_NONBLOCK from ssh's stdout which
is fd=5 and ssh closes its stdout(fd=5) without clearing
O_NONBLOCK.

5- The subsequent program "cat", fails to write buffers
to its stdout, because cat's stdout is connected to the
same pipe as ssh, which still has O_NONBLOCK.

When executed in debug mode, we get the following error :
debug3: send packet: type 1
debug1: fd 0 clearing O_NONBLOCK
debug3: fd 1 is not O_NONBLOCK      <<<<<<
debug1: fd 2 clearing O_NONBLOCK
Transferred: sent 1940, received 2424 bytes, in 0.0 seconds
Bytes per second: sent 48522.2, received 60627.8
debug1: Exit status 0
cat: output error
Resource temporarily unavailable


Note: This error is not seen in 7.5p1. If the step 3 mentioned above is
commented, then no issue is seen.

Please advice on how this can be fixed ?

Thanks

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3280

sanumesh at in.ibm.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 OS|AIX                         |All
           Severity|normal                      |major
           Priority|P5                          |P2
           Hardware|PPC                         |All

--- Comment #1 from sanumesh at in.ibm.com ---
Notes :

- This issue occurs on even Linux, and all other platform as well.

- This issue is not specific to ksh93 alone, it occurs on sh/bash as
well

- This issue is not specific to mksysb, failure is seen in cat with any
files whose size is over several hundred KB

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3280

--- Comment #2 from sanumesh at in.ibm.com ---
Created attachment 3510
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3510&action=edit
ssh related patch

maintain a global variable and dup the STDOUT to it, before dup2 of
stdout to /dev/null

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3280

--- Comment #3 from sanumesh at in.ibm.com ---
Created attachment 3511
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3511&action=edit
clientloop related patch

assign back the stored fd to stdout before restoring blocking io

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3280

sanumesh at in.ibm.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|major                       |critical
           Priority|P2                          |P1

--- Comment #4 from sanumesh at in.ibm.com ---
Hello

raising the severity to 1 since it is related to user data integrity
checks. In some of the scenarios, the output of cat gets truncated with
no errors. 
Please have a look at the attached patch and let me know if any further
clarifications is required.
Thanks

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3280

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3510|0                           |1
        is obsolete|                            |
   Attachment #3511|0                           |1
        is obsolete|                            |
                 CC|                            |djm at mindrot.org,
                   |                            |dtucker at dtucker.net
   Attachment #3519|                            |ok?(dtucker at dtucker.net)
              Flags|                            |

--- Comment #5 from Damien Miller <djm at mindrot.org> ---
Created attachment 3519
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3519&action=edit
restore non-blocking status for stdio file descriptors

I don't think your patches cover all the cases, particularly the
session-multiplexing and stdio forwarding ones. AFAIk this one does.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3280

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #3519|ok?(dtucker at dtucker.net)    |ok+
              Flags|                            |

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3280

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dbelyavs at redhat.com

--- Comment #6 from Damien Miller <djm at mindrot.org> ---
*** Bug 3310 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3280

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Blocks|                            |3302
             Status|NEW                         |RESOLVED

--- Comment #7 from Damien Miller <djm at mindrot.org> ---
Fix committed as 7be4ac81366


Referenced Bugs:

https://bugzilla.mindrot.org/show_bug.cgi?id=3302
[Bug 3302] Tracking bug for openssh-8.7
-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.

https://bugzilla.mindrot.org/show_bug.cgi?id=3280

Damien Miller <djm at mindrot.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #8 from Damien Miller <djm at mindrot.org> ---
closing bugs resolved before openssh-8.9

-- 
You are receiving this mail because:
You are watching someone on the CC list of the bug.
You are watching the assignee of the bug.