Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-74464

ksh consumes a single CPU fully and beeps in loop when pressing the Up Arrow key

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Normal Normal
    • rhel-9.7
    • rhel-9.5
    • ksh
    • None
    • ksh-1.0.6-12.el9
    • Yes
    • Low
    • 4
    • rhel-plumbers
    • ssg_core_services
    • 18
    • 26
    • 3
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • Red Hat Enterprise Linux
    • Plumbers Sprint 2, Plumbers Sprint 3, Plumbers Sprint 4, Plumbers Sprint 5
    • None

      What were you trying to do that didn't work?

      When a ksh user doesn't have any history file, pressing the Up Arrow leads to getting beeps in loop in the terminal and the CPU to be consumed in loop forever.
      This is a regression compared to RHEL8.

      Digging into this, it appears that there was a code change around key handling in RHEL9 in Emacs mode (src/cmd/ksh93/edit/emacs.c). Upstream code doesn't have the issue anymore.

      1. RHEL8 (code ok)
         700                 drawline:
         701                         eol = genlen(out);
         702                         cur = eol;
         703                         draw(ep,UPDATE);
         704                         continue;
         705                 }
        
      2. RHEL9 (code ko)
         633                 case cntl('P') :
         :
         653 #ifdef ESH_NFIRST               
         654                         if (hline <= hismin)
          :
         657 #endif /* ESH_NFIRST */
         658                         {
         659 >>>>                            hline = hismin+1;
         660                                 beep();
         :
         664                         }
         :
         717                 drawline:
         718                         eol = genlen(out);
         719                         cur = eol;
         720                         draw(ep,UPDATE);
         721                         /* skip blank lines when going up/down in history */
         722                         if(c==cntl('N') && hline != histlines && blankline(ep,out))
         723                                 ed_ungetchar(ep->ed,cntl('N'));
         724                         else if(c==cntl('P') && hline != hismin && blankline(ep,out))
         725 >>>>                            ed_ungetchar(ep->ed,cntl('P'));
         726                         continue;
         727                 }
        

      The RHEL9 code is broken when handling Up Arrow (line 633+): when reaching the beginning of the history, the hline is increased by one.
      Later when drawing the line (line 717+), we hit the condition on line 757 because hline != hismin (since hline was increased by one on line 659). This leads to enqueuing a new Up Arrow automatically.

      Important note: the issue got fixed Upstream by commit a1fcad4bf65fe26a3f9a386b63732ab151ce03ec through introducing a new parameter to blankline(). I could confirm the patch fixes the issue. HOWEVER this patch is was not designed for that, it's just a side-effect of it. The original code is buggy by design, the condition on line 724 (hline != hismin) is not correct when having an empty history, since hline got explicitly increased by one.

      Upstream (code ok because of a1fcad4bf65fe26a3f9a386b63732ab151ce03ec side-effect)

       604                 drawline:
       605                         eol = genlen(out);
       606                         cur = eol;
       607                         draw(ep,UPDATE);
       608                         /* skip blank lines when going up/down in history */
       609                         if(c==cntl('N') && hline != histlines && blankline(ep,out,0))
       610                                 ed_ungetchar(ep->ed,cntl('N'));
       611                         else if(c==cntl('P') && hline != hismin && blankline(ep,out,0))
       612                                 ed_ungetchar(ep->ed,cntl('P'));
       613                         continue;
      

      What is the impact of this issue to you?

      CPU consumption + beeps until the user forcibly kills ksh from another shell.

      Please provide the package NVR for which the bug is seen:

      ksh-1.0.6-4.el9_5

      How reproducible is this bug?:

      Always

      Steps to reproduce

      1. Create a ksh user
      2. su as the ksh user
      3. hit Up Arrow key

      Expected results

      1 beep only

      Actual results

      Infinite beeps + CPU consumption

              kvolny Karel Volný
              rhn-support-rmetrich Renaud Métrich
              Vincent Mihalkovic Vincent Mihalkovic
              Karel Volný Karel Volný
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated: