[BusyBox] bug#1261: Ash holds some extra file descriptors open

[Steve Wahl]

Package: busybox
Version: 0.60.3
Severity: normal

I have noted that, at least when putting stuff into the background,
ash sometimes keeps some file descriptors open that it shouldn't, or
at least shouldn't need to.

Small script to reproduce this:

( (sleep 5 ; echo "hello") 2>&1 | cat >/dev/tty 2>&1 & ) 2>&1 | cat

In many other shells, bash for instance, you will get a command prompt
back immediately, then hello comes out 5 seconds later.

Under ash, the prompt doesn't come back until the 5 seconds expire.
It appears this is because some parts of the pipeline that's placed in
the background with '&' hold a copy of the original stderr file
descriptor open (as a high numbered file descriptor, like 11 or so).

Originally discovered this using FreeS/WAN 1.97.  For the benefit of
anyone else trying to make Freeswan work with ash, the symptom is that
freswan's startup script doesn't exit, even though it seems to start
everything up fine.  In Freeswan's case, the processes at the
receiving end of the pipes are 'logger' instead of cat, and in place
of the sleep, there is a script that is supposed to keep running until
freeswan is shut down.  So instead of taking 5 extra seconds to
complete, the startup script never finishes.

Other information: Standalone ash on Red Hat 7.2 (ash-0.3.7-2) seems to
have this bug.  Erik Andersen reports that standalone Ash on
Debian/Woody does not have the problem.  A comparisson between the two
may be helpful.

I've personally dived far enough into this to see that one would
probably have to understand the way ash represents command lines
internally after parsing them (the tree of nodes), and how it creates
this tree, in order to fix this bug.

The descriptor that is mistakenly held open appears to be fd 11 or so,
implicating the use of the function redirect() with a REDIR_PUSH
argument.  The obvious simple changes one might try to make in the
evalcommand() function are not enough to fix the problem -- at least
not the ones I tried.  Instead, the place the file descriptor seems to
be left open is in the function evaltree, case NREDIR, with it's
redirect(...,REDIR_PUSH) call.  I think you'd have to figure out how
to determine when it's not correct to use REDIR_PUSH here, or have the
redirections done somewhere else maybe.

Steve Wahl, Brecis Communications