ash: fix a bug where redirection fds were not closed afterwards.

 optimize close+fcntl(DUPFD) into dup2. add testsuites.

function                                             old     new   delta
copyfd                                                47      68     +21
argstr                                              1311    1298     -13
popredir                                             148     131     -17
redirect                                            1139    1107     -32
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 1/3 up/down: 21/-62)            Total: -41 bytes

6 files changed, 53 insertions, 39 deletions

diff --git a/shell/ash.c b/shell/ash.c
index 22575ffbc..ec3bd0927 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -4846,12 +4846,21 @@ openredirect(union node *redir)
  * if the source file descriptor is closed, EMPTY if there are no unused
  * file descriptors left.
  */
+/* 0x800..00: bit to set in "to" to request dup2 instead of fcntl(F_DUPFD).
+ * old code was doing close(to) prior to copyfd() to achieve the same */
+#define COPYFD_EXACT ((int)~INT_MAX)
 static int
 copyfd(int from, int to)
 {
 	int newfd;
 
-	newfd = fcntl(from, F_DUPFD, to);
+	if (to & COPYFD_EXACT) {
+		to &= ~COPYFD_EXACT;
+		/*if (from != to)*/
+			newfd = dup2(from, to);
+	} else {
+		newfd = fcntl(from, F_DUPFD, to);
+	}
 	if (newfd < 0) {
 		if (errno == EMFILE)
 			return EMPTY;
@@ -4947,11 +4956,7 @@ redirect(union node *redir, int flags)
 				/* Descriptor wasn't open before redirect.
 				 * Mark it for close in the future */
 				if (need_to_remember(sv, fd)) {
-					if (fd == 2)
-						copied_fd2 = CLOSED; /// do we need this?
-					sv->two_fd[sv_pos].orig = fd;
-					sv->two_fd[sv_pos].copy = CLOSED;
-					sv_pos++;
+					goto remember_to_close;
 				}
 				continue;
 			}
@@ -4959,6 +4964,10 @@ redirect(union node *redir, int flags)
 		if (need_to_remember(sv, fd)) {
 			/* Copy old descriptor */
 			i = fcntl(fd, F_DUPFD, 10);
+/* You'd expect copy to be CLOEXECed. Currently these extra "saved" fds
+ * are closed in popredir() in the child, preventing them from leaking
+ * into child. (popredir() also cleans up the mess in case of failures)
+ */
 			if (i == -1) {
 				i = errno;
 				if (i != EBADF) {
@@ -4969,31 +4978,25 @@ redirect(union node *redir, int flags)
 					ash_msg_and_raise_error("%d: %m", fd);
 					/* NOTREACHED */
 				}
-				/* EBADF: it is not open - ok */
-			} else {
-				/* fd is open, save its copy */
-/* You'd expect copy to be CLOEXECed. Currently these extra "saved" fds
- * are closed in popredir() in the child, preventing them from leaking
- * into child. (popredir() also cleans up the mess in case of failures)
- */
-				if (fd == 2)
-					copied_fd2 = i;
-				sv->two_fd[sv_pos].orig = fd;
-				sv->two_fd[sv_pos].copy = i;
-				sv_pos++;
-				close(fd);
-			}
-		} else {
-			close(fd);
+				/* EBADF: it is not open - good, remember to close it */
+ remember_to_close:
+				i = CLOSED;
+			} /* else: fd is open, save its copy */
+			if (fd == 2)
+				copied_fd2 = i;
+			sv->two_fd[sv_pos].orig = fd;
+			sv->two_fd[sv_pos].copy = i;
+			sv_pos++;
 		}
-		/* At this point fd is closed */
 		if (newfd < 0) {
 			/* NTOFD/NFROMFD: copy redir->ndup.dupfd to fd */
-			if (redir->ndup.dupfd >= 0) {   /* if not ">&-" */
-				copyfd(redir->ndup.dupfd, fd);
+			if (redir->ndup.dupfd < 0) { /* "NN>&-" */
+				close(fd);
+			} else {
+				copyfd(redir->ndup.dupfd, fd | COPYFD_EXACT);
 			}
-		} else { /* move newfd to fd */
-			copyfd(newfd, fd);
+		} else if (fd != newfd) { /* move newfd to fd */
+			copyfd(newfd, fd | COPYFD_EXACT);
 			close(newfd);
 		}
 	} while ((redir = redir->nfile.next) != NULL);
@@ -5025,8 +5028,8 @@ popredir(int drop)
 		}
 		if (rp->two_fd[i].copy != EMPTY) {
 			if (!drop) {
-				close(fd);
-				copyfd(rp->two_fd[i].copy, fd);
+				/*close(fd);*/
+				copyfd(rp->two_fd[i].copy, fd | COPYFD_EXACT);
 			}
 			close(rp->two_fd[i].copy);
 		}
@@ -5064,7 +5067,8 @@ redirectsafe(union node *redir, int flags)
 	struct jmploc jmploc;
 
 	SAVE_INT(saveint);
-	err = setjmp(jmploc.loc) * 2;
+	/* "echo 9>/dev/null; echo >&9; echo result: $?" - result should be 1, not 2! */
+	err = setjmp(jmploc.loc); // huh?? was = setjmp(jmploc.loc) * 2;
 	if (!err) {
 		exception_handler = &jmploc;
 		redirect(redir, flags);
@@ -5443,8 +5447,8 @@ evalbackcmd(union node *n, struct backcmd *result)
 			FORCE_INT_ON;
 			close(pip[0]);
 			if (pip[1] != 1) {
-				close(1);
-				copyfd(pip[1], 1);
+				/*close(1);*/
+				copyfd(pip[1], 1 | COPYFD_EXACT);
 				close(pip[1]);
 			}
 			eflag = 0;
@@ -10691,11 +10695,7 @@ readtoken1(int firstc, int syntax, char *eofmark, int striptabs)
 	len = out - (char *)stackblock();
 	out = stackblock();
 	if (eofmark == NULL) {
-		if ((c == '>' || c == '<')
-		 && quotef == 0
-		// && len <= 2 // THIS LIMITS fd to 1 char: N>file, but no NN>file!
-		// && (*out == '\0' || isdigit(*out))
-		) {
+		if ((c == '>' || c == '<') && quotef == 0) {
 			int maxlen = 9 + 1; /* max 9 digit fd#: 999999999 */
 			char *np = out;
 			while (--maxlen && isdigit(*np))
diff --git a/shell/ash_test/ash-redir/redir2.right b/shell/ash_test/ash-redir/redir2.right
new file mode 100644
index 000000000..d86bac9de
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir2.right
@@ -0,0 +1 @@
+OK
diff --git a/shell/ash_test/ash-redir/redir2.tests b/shell/ash_test/ash-redir/redir2.tests
new file mode 100755
index 000000000..61ccea30c
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir2.tests
@@ -0,0 +1,5 @@
+# ash once couldn't redirect above fd#9
+exec 1>/dev/null
+(echo LOST1 >&22) 22>&1
+(echo LOST2 >&22) 22>&1
+(echo OK >&22) 22>&2
diff --git a/shell/ash_test/ash-redir/redir3.right b/shell/ash_test/ash-redir/redir3.right
new file mode 100644
index 000000000..fd641a8ea
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir3.right
@@ -0,0 +1,3 @@
+TEST
+./redir3.tests: line 4: 9: Bad file descriptor
+Output to fd#9: 1
diff --git a/shell/ash_test/ash-redir/redir3.tests b/shell/ash_test/ash-redir/redir3.tests
new file mode 100755
index 000000000..f50a7674c
--- /dev/null
+++ b/shell/ash_test/ash-redir/redir3.tests
@@ -0,0 +1,5 @@
+# redirects to closed descriptors should not leave these descriptors"
+# open afterwards
+echo TEST 9>/dev/null
+echo MUST ERROR OUT >&9
+echo "Output to fd#9: $?"
diff --git a/shell/ash_test/run-all b/shell/ash_test/run-all
index b0a6d1088..4d0f39a41 100755
--- a/shell/ash_test/run-all
+++ b/shell/ash_test/run-all
@@ -3,8 +3,8 @@
 TOPDIR=$PWD
 
 test -x ash || {
-    echo "No ./ash?! Perhaps you want to run 'ln -s ../../busybox ash'"
-    exit
+    echo "No ./ash - creating a link to ../../busybox"
+    ln -s ../../busybox ash
 }
 test -x printenv || gcc -O2 -o printenv printenv.c || exit $?
 test -x recho    || gcc -O2 -o recho    recho.c    || exit $?