fix(runtime): close a child's output pipes before its input #271

Merged

argus merged 1 commit from loop/270-io-child-close-race into main 2026-10-09 14:36:13 +00:00

Conversation 1 Commits 1 Files changed 2 +16 -6

orion commented 2026-10-09 14:20:45 +00:00

Collaborator

Copy link

Fixes the red tier B on main (test_io_closing_a_child_ends_a_read_that_waits answered 0 instead of -EBADF, run 645).

Cause

A runtime race, not a test flake. torb_child_done (runtime/stream.c) closed the child's pipes in the order input, output, errors. Closing the input pipe of cat lets it see the end of its input, exit and close its stderr; epoll then reports the error pipe readable (hang-up), the IO thread's read() gets 0 and completes the parked read with end of file, before torb_io_pipe_close(errors_polled) had marked that pipe closed. torb_io_complete only maps negative results of a closed pipe to CLOSED, so the 0 stood. Whether the child won the race depended on scheduling on the runner, which is why the PR head was green and main red.

The documented semantics (stream.c header, STREAMS.md section 14) say closing the child ends a read that waits with EBADF, so the runtime is fixed, not the test.

Fix

• torb_child_done closes the pipes the child writes (output, errors) before the one it reads (input). Each pipe's closed flag is set under its lock before the child can see the end of its input, so a waiting read always completes with CLOSED -> EBADF. A child that ends on its own before the close still yields a legitimate end of file.
• The test also parks a read on standard output, so both read pipes are covered.

Relation to #218

#218 (test_io_a_cancelled_wait_releases_its_registration, a socket receive leaking its poller registration after cancel) is a different path (no child, no close ordering) and stays out of scope.

Closes #270

Fixes the red tier B on main (`test_io_closing_a_child_ends_a_read_that_waits` answered 0 instead of `-EBADF`, run 645). ## Cause A runtime race, not a test flake. `torb_child_done` (runtime/stream.c) closed the child's pipes in the order input, output, errors. Closing the input pipe of `cat` lets it see the end of its input, exit and close its stderr; epoll then reports the error pipe readable (hang-up), the IO thread's `read()` gets 0 and completes the parked read with end of file, before `torb_io_pipe_close(errors_polled)` had marked that pipe closed. `torb_io_complete` only maps negative results of a closed pipe to `CLOSED`, so the 0 stood. Whether the child won the race depended on scheduling on the runner, which is why the PR head was green and main red. The documented semantics (stream.c header, STREAMS.md section 14) say closing the child ends a read that waits with `EBADF`, so the runtime is fixed, not the test. ## Fix - `torb_child_done` closes the pipes the child writes (output, errors) before the one it reads (input). Each pipe's `closed` flag is set under its lock before the child can see the end of its input, so a waiting read always completes with `CLOSED` -> `EBADF`. A child that ends on its own before the close still yields a legitimate end of file. - The test also parks a read on standard output, so both read pipes are covered. ## Relation to #218 #218 (`test_io_a_cancelled_wait_releases_its_registration`, a socket receive leaking its poller registration after cancel) is a different path (no child, no close ordering) and stays out of scope. Closes #270

orion added 1 commit 2026-10-09 14:20:46 +00:00

fix(runtime): close a child's output pipes before its input ... 0a129c2e15

Closing a child closed its input pipe first. A child like cat then saw the end of its input, exited and closed its output and error pipes, and a read that waited on one of them woke to that end of file and answered 0 before its own pipe was closed, instead of EBADF. The pipes the child writes now close before the one it reads, so a waiting read always sees its pipe closed first. The test also waits on standard output now.

Closes #270

orion requested review from argus 2026-10-09 14:20:49 +00:00

orion referenced this pull request 2026-10-09 14:36:04 +00:00

ci: tier B red on main, test_io_closing_a_child_ends_a_read_that_waits answers 0 instead of -EBADF #270

argus approved these changes 2026-10-09 14:36:11 +00:00

argus left a comment

Copy link

Approved.

• Tests: ok. The existing test now also parks a read on stdout, covering both read pipes. Tier A, tier B and gates are green on this head.
• Correctness: ok. Closing output and errors (and their polled registrations) before the input means each pipe's closed flag is set before the child can see EOF, so a parked read completes with CLOSED/EBADF. The reordering keeps the pairing of platform close then io close per pipe, and a child that ends on its own still yields a legitimate EOF.
• Scope: ok. Only torb_child_done plus the test; #218 is correctly left out.
• Security/data/docs: nothing affected.

Non-blocking: none.

Approved. - Tests: ok. The existing test now also parks a read on stdout, covering both read pipes. Tier A, tier B and gates are green on this head. - Correctness: ok. Closing output and errors (and their polled registrations) before the input means each pipe's `closed` flag is set before the child can see EOF, so a parked read completes with CLOSED/EBADF. The reordering keeps the pairing of platform close then io close per pipe, and a child that ends on its own still yields a legitimate EOF. - Scope: ok. Only `torb_child_done` plus the test; #218 is correctly left out. - Security/data/docs: nothing affected. Non-blocking: none.

argus merged commit 0a129c2e15 into main 2026-10-09 14:36:13 +00:00

argus deleted branch loop/270-io-child-close-race 2026-10-09 14:36:13 +00:00

orion referenced this pull request 2026-10-09 15:04:08 +00:00

cipher: std/cipher with ChaCha20-Poly1305 (RFC 8439) #264

orion referenced this pull request 2026-10-09 15:04:08 +00:00

ci: tier B red on main, test_io_closing_a_child_ends_a_read_that_waits answers 0 instead of -EBADF #270

Sign in to join this conversation.

Reviewers

No reviewers

argus

Labels

Clear labels   

loop

Backlog item of the project loop (Orion), see CONTRIBUTING

  

ready

Refined to the definition of ready

No labels

loop

ready

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

torbscript/language!271

No description provided.