Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1018063 > unrolled thread

Bug#965072: ksh93: posix_spawn-related exec format error

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#965072: ksh93: posix_spawn-related exec format error Thorsten Glaser <tg@mirbsd.de> - 2020-07-15 17:10 +0200
    Bug#965072: Attempting to reproduce Anuradha Weeraman <anuradha@debian.org> - 2020-07-15 19:30 +0200
      Bug#965072: Attempting to reproduce Anuradha Weeraman <anuradha@debian.org> - 2020-07-17 01:30 +0200
        Bug#965072: Attempting to reproduce Anuradha Weeraman <anuradha@debian.org> - 2020-07-17 02:00 +0200
    Bug#965072: Upstream resolution Anuradha Weeraman <anuradha@debian.org> - 2020-07-22 17:30 +0200

#1018063 — Bug#965072: ksh93: posix_spawn-related exec format error

Package: ksh
Version: 93u+20120801-3.1
Severity: important

(stretch-i386)tglase@tglase:~ $ ksh93
ksh93$ cat TODO | while read line; do ls; done
ls: ls: cannot execute [Exec format error]
[…]

We got this as bugreport in #ksh on IRC, and I can reproduce it, so
forwarding here:

22:43 -!- CrystalMath [~coderain@reactos/developer/theflash] has joined #ksh
22:43 < CrystalMath> hi all
22:43 < CrystalMath> sometimes, with ksh93, i get a strange NOEXEC error
22:43 < CrystalMath> err, ENOEXEC, i mean
23:03 < CrystalMath> looking at ksh through strace, it seems that it happens when setpgid() fails with -EPERM
23:03 < CrystalMath> possibly a race condition
23:35 < CrystalMath> seems to be a bug in posix_spawn()
23:35 < CrystalMath> i'll try a newer version of ksh93
23:41 < CrystalMath> nope, the latest version still fails
23:42 < CrystalMath> how did people miss such a glaring bug?
23:46 < twkm> i don't think i've ever seen such.  is this for a something with resource constraints?
23:47 < CrystalMath> no
23:48 < CrystalMath> regular normal computer
23:48 < CrystalMath> posix_spawn()'s strange failure appears to be -EPERM
23:48 < CrystalMath> i suspect a pid-related race condition
23:49 < twkm> so not a container, jail, or nproc (ulimit -u) set low?
23:49 < CrystalMath> ulimit -u is 61777
23:49 < CrystalMath> not a container, jail, nor chroot
23:53 < CrystalMath> just cat any file into while read line; do ls; done
23:53 < CrystalMath> ls: ls: cannot execute [Exec format error]
23:55 < CrystalMath> hmmmmm
23:55 < CrystalMath> can't seem to replicate in slackware
23:55 < CrystalMath> only happens in debian
23:55 < twkm> failing disk.
23:55 < CrystalMath> can't be
23:55 < twkm> not ksh at any rate.  that's the kernel whining.
23:55 < CrystalMath> it is ksh
23:55 < twkm> it's merely reported by ksh.
23:56 < CrystalMath> i traced it with strace
23:56 < CrystalMath> what happens
23:56 < CrystalMath> is that posix_spawn() fails
23:56 < CrystalMath> and ksh tries to interpret it as a script
23:56 < CrystalMath> but it's an ELF file
23:56 < CrystalMath> the weird part is the failure of posix_spawn() which i cannot explain
23:57 < CrystalMath> inside a slackware chroot i have, the bug does not occur, which is why i will look closely 
                     at the version number now
23:57 < CrystalMath> both report: sh (AT&T Research) 93u+ 2012-08-01
23:59 < CrystalMath> how do i tell ksh not to load my ~/.kshrc?
Day changed to 15 Jul 2020
00:00 < twkm> if the kernel reports it can't exec the script ksh will attempt to interpret it.
00:01 < CrystalMath> but the error was EPERM
00:02 < twkm> picking the system i happen to be on at the moment:
00:02 < twkm>        EPERM  The filesystem is mounted nosuid, the user is not the superuser,
00:02 < twkm>               and the file has the set-user-ID or set-group-ID bit set.
00:02 < twkm>        EPERM  The  process  is being traced, the user is not the superuser and
00:02 < twkm>               the file has the set-user-ID or set-group-ID bit set.
00:03 < CrystalMath> 24899 setpgid(0, 24898)                 = -1 EPERM (Operation not permitted)
00:03 < CrystalMath> this is the strange failure
00:03 < CrystalMath> whenever this happens, down the line, ksh seems to try to interpret it as a script
00:04 < twkm> because [repeat:] if the kernel reports it can't exec the script ksh will attempt to interpret it.
00:04 < CrystalMath> there was no call to execve()
00:04 < twkm> your systems docs for why setpgid returned eperm are germane.
00:05 < twkm> no exec because something getting ready for the exec failed.
00:12 < CrystalMath> i changed the code of ksh to use something other than posix_spawn()
00:14 < CrystalMath> rebuilding now
00:14 < CrystalMath> it has several options in the code but it prefers posix_spawn() if it's available, if 
                     removed that part with #if 0
00:20 < CrystalMath> that fixed it!
00:20 < CrystalMath> the modified version i made does not have the probelm
00:20 < CrystalMath> *problem
00:20 < CrystalMath> i have no idea why posix_spawn() is broken on my system
00:21 < CrystalMath> after quite of bit of hammering ksh, not a single exec format error!
00:21 < CrystalMath> before it was very common
00:35 < CrystalMath> either way i conclude that this bug was not in ksh but in glibc
00:36 < CrystalMath> because the call to posix_spawn() was correct, but didn't work as expected
14:26 < mirabilos> can reproduce on Debian
14:26 < mirabilos> also on stock ksh93u but not ksh93v
14:26 < mirabilos> ksh93t just stops itself
14:27 < mirabilos> $ ksh93t
14:27 < mirabilos> $ cat TODO | while read line; do ls; done
14:27 < mirabilos> [2] + Stopped (tty output) \ksh93t

This happens in stretch, buster and sid *AT LEAST*.

So, this might be a bug in ksh93 and/or one in glibc. If it’s just one
in glibc, I’d suggest cloning this bug and reassigning it against glibc
while treating the bug against ksh93 as a request to change building it
to avoid posix_spawn. Reassigning also means figuring out some testcase
that triggers the posix_spawn failure which may be tricky.

-- System Information:
Debian Release: 9.12
  APT prefers oldstable-updates
  APT policy: (500, 'oldstable-updates'), (500, 'oldstable')
Architecture: i386 (i686)

Kernel: Linux 5.7.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=C, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=C (charmap=UTF-8)
Shell: /bin/sh linked to /bin/lksh
Init: sysvinit (via /sbin/init)

Versions of packages ksh depends on:
ii  binfmt-support  2.1.6-2
ii  libc6           2.24-11+deb9u4

ksh recommends no packages.

ksh suggests no packages.

-- no debconf information

[toc] | [next] | [standalone]

#1018082 — Bug#965072: Attempting to reproduce

Thanks for reporting the issue, Thorsten.

I'm attempting to reproduce the issue on stretch, in a container:

# cat repro.sh
#!/bin/ksh
cat TODO | while read line; do ls; done
# cat TODO
1
2
3
4
# ksh --version
  version         sh (AT&T Research) 93u+ 2012-08-01
# dpkg -l | grep ksh
  ii  ksh                     93u+20120801-3.1      amd64        Real,
  AT&T version of the Korn shell
# ./repro.sh
  TODO  repro.sh
  TODO  repro.sh
  TODO  repro.sh
  TODO  repro.sh

Same with the latest on sid.

Did you have to do anything apart from the above to reproduce on your
end?

Anuradha

[toc] | [prev] | [next] | [standalone]

#1018258 — Bug#965072: Attempting to reproduce

Just FYI, was able to re-create when running on a loopback mounted with noexec.

[toc] | [prev] | [next] | [standalone]

#1018261 — Bug#965072: Attempting to reproduce

Datapoint:

$ cat TODO | while read line; do ls; done
ls: ls: cannot execute [Exec format error]
ls: ls: cannot execute [Exec format error]
ls: ls: cannot execute [Exec format error]
ls: ls: cannot execute [Exec format error]

$ ksh -c "cat TODO | while read line; do ls; done"
fs.img  repro.sh  TODO
fs.img  repro.sh  TODO
fs.img  repro.sh  TODO
fs.img  repro.sh  TODO

[toc] | [prev] | [next] | [standalone]

#1018909 — Bug#965072: Upstream resolution

Conversation and resolution upstream on this issue:

https://github.com/ksh93/ksh/issues/79

Resolution will be cherry-picked for next release.

Anuradha

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web