+section: rts

+synopsis:

+  Fix a hang when a program is started with a standard file descriptor closed

+description:

+  A process started with stdout or stderr closed -- ``prog >&-`` from a shell

+  does exactly that -- left that descriptor number free for the runtime to

+  take for its own use.  The ``Handle`` for the stream, built later when the

+  program first wrote to it, then took over a descriptor belonging to the

+  runtime: the program wrote its output into the runtime's own plumbing and

+  hung, with no error reported anywhere.  The runtime now opens ``/dev/null``

+  onto whichever of the descriptors 0, 1 and 2 are closed when it starts, so

+  such a stream is connected to ``/dev/null`` instead.

+mrs: !16710

+issues: #24450

+  On weakly-ordered architectures such as AArch64, programs

+#if !defined(mingw32_HOST_OS)

+#include <errno.h>

+#include <fcntl.h>

+#endif

+#if !defined(mingw32_HOST_OS)

+static void sanitiseStandardFds(void);

+#endif

+

+#if !defined(mingw32_HOST_OS)

+/* See Note [Standard file descriptors must be open]. */

+static void sanitiseStandardFds(void)

+{

+    // The access mode each descriptor would have had, had the process been

+    // started with it open.

+    static const int access_mode[3] = { O_RDONLY, O_WRONLY, O_WRONLY };

+

+    for (int fd = 0; fd <= 2; fd++) {

+        if (fcntl(fd, F_GETFD) != -1 || errno != EBADF) {

+            continue;           // already open

+        }

+

+        int nullfd;

+        do {

+            nullfd = open("/dev/null", access_mode[fd]);

+        } while (nullfd == -1 && errno == EINTR);

+

+        if (nullfd == -1) {

+            // No /dev/null to be had.  There is nothing better to do than

+            // carry on; the hazard the Note describes is then still there,

+            // but refusing to start would be worse.

+            return;

+        }

+        if (nullfd != fd) {

+            // open() hands out the lowest free descriptor, so this cannot

+            // happen unless something in this process is opening descriptors

+            // concurrently.  Do not shuffle its descriptor around.

+            close(nullfd);

+            return;

+        }

+    }

+}

+

+/*

+ * Note [Standard file descriptors must be open]

+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ * A process may be started with any of file descriptors 0, 1 and 2 closed --

+ * from a shell, `prog >&-` does exactly that.  Nothing then reserves those

+ * numbers, and open(), pipe() and socket() hand out the lowest free

+ * descriptor, so the next descriptor the runtime creates for itself takes one

+ * of them: the ticker's pipe, or a capability's IO manager control pipe.

+ *

+ * Nothing warns anybody.  'GHC.Internal.IO.StdHandles.stdout' is a CAF, so it

+ * is built the first time the program writes to stdout, which is long after

+ * that has happened, and it builds a 'Handle' over descriptor 1 -- which now

+ * belongs to the runtime.  The program then writes its output into the

+ * runtime's own plumbing, and at exit closes it.

+ *

+ * What this looks like from the outside is a hang, because the descriptor the

+ * Handle has taken over is the read end of a pipe.  It is a perfectly good

+ * descriptor, so nothing reports an error: poll() for POLLOUT on it simply

+ * never says yes, epoll_ctl() accepts a registration for it, and the thread

+ * waiting to write blocks for ever.  See #24450, where this is `prog >&-`

+ * hanging after main has finished.

+ *

+ * Closing those descriptors is legal, so the runtime cannot refuse them; and

+ * moving only the descriptors the runtime opens would not help, since the

+ * first file the program itself opens would land on the free number instead.

+ * The fix is to leave no free number: open /dev/null onto whichever of 0, 1

+ * and 2 are closed, before the runtime creates any descriptor of its own.

+ * Other runtimes do the same, and for the same reason.

+ *

+ * A program run this way therefore finds stdout connected to /dev/null rather

+ * than failing with EBADF on the first write.  That is the price of the fix,

+ * and it is the behaviour such a program would get from most other language

+ * runtimes.

+ *

+ * Each substitute is opened for the access the descriptor would normally have:

+ * read-only for 0, write-only for 1 and 2.  Opening all three for both would

+ * make the substitute something a real stdin or stdout is not, and writing to

+ * 'stdin' or reading from 'stdout' would then quietly succeed instead of

+ * failing with EBADF.

+ */

+#endif

+

+#if !defined(mingw32_HOST_OS)

+    /* Before anything here opens a file descriptor of its own.

+       See Note [Standard file descriptors must be open]. */

+    sanitiseStandardFds();

+#endif

+

+{-# LANGUAGE ScopedTypeVariables #-}

+-- A process may be started with stdout closed -- `prog >&-` from a shell does

+-- exactly that.  Nothing then reserves descriptor 1, so the next descriptor

+-- the runtime opens for itself takes it, and the 'Handle' for stdout, built

+-- later when the program first writes, takes over a descriptor belonging to

+-- the runtime.  The write then goes into the runtime's own plumbing, and what

+-- this looks like from the outside is a hang.  See #24450 and

+-- Note [Standard file descriptors must be open] in rts/RtsStartup.c.

+--

+-- This test is run with its stdin and stdout closed, so what it has to say

+-- goes to stderr.  The four writes are the reproducer from the ticket and must

+-- simply finish.  The lines after them are what tell the two outcomes apart:

+-- the descriptors the runtime opens for itself are pipes, so finding a pipe on

+-- descriptor 0 or 1 means it was handed to the runtime.

+module Main (main) where

+

+import Control.Exception (IOException, try)

+import System.IO

+import System.Posix.Files (getFdStatus, isCharacterDevice, isNamedPipe)

+import System.Posix.Types (Fd (..))

+

+main :: IO ()

+main = do

+    hPutChar stderr 'A'     -- unbuffered

+    hPutChar stdout 'X'     -- buffered; this is the one that used to hang

+    hPutChar stderr 'Z'     -- unbuffered

+    hPutChar stderr '\n'    -- unbuffered

+    mapM_ (\fd -> hPutStrLn stderr =<< describeFd fd) [0, 1]

+

+describeFd :: Fd -> IO String

+describeFd fd = do

+    r <- try (getFdStatus fd)

+    return $ "fd " ++ show fd ++ ": " ++ case r of

+      Left (_ :: IOException) -> "closed"

+      Right st

+        -- What the fix arranges: /dev/null, opened onto the free number

+        -- before the runtime could take it.

+        | isCharacterDevice st -> "character device"

+        -- What #24450 is: the runtime's ticker or control pipe.

+        | isNamedPipe st       -> "pipe"

+        | otherwise            -> "something else"

+AZ

+fd 0: character device

+fd 1: character device

+# Run with stdin and stdout closed -- that is what leaves those descriptors

+# free for the runtime to take, which is the whole of #24450.  What the test

+# has to say therefore goes to stderr and is checked against T24450.stderr.

+test('T24450',

+     [ when(opsys('mingw32'), skip) # POSIX only

+     , js_skip # JS backend has its own runtime

+     # The wrapper below would close the stdout of the wasm runtime rather

+     # than that of the program running under it, which tests nothing.

+     , when(arch('wasm32'), skip)

+     , cmd_wrapper(lambda c: c + ' <&- >&-')

+     ], compile_and_run, [''])

+