PK69465: Using nmap opens bfagent processes which don't close and use 100% CPU

APAR status

• Closed as program error.

Error description

• The nmap utility is a free port scanning software. The command
  used by the client and myself to reproduce the issue is:
  nmap -sSV -F -iL <host list file>
  
  The program scans the target computers. The bfagent processes
  start and never exit after the scanning software is done, or
  killed. They also consume 100% of the CPU bringing the agent
  machine down.
  
  The agent should be able to close after the scan is done and not
  consume as much CPU cycles as it is.
  
  Workaround:
  Prevent nmap from scanning the agent ports.
  nmap -sSV -p 1-5554,5556-65535 -iL <host list file>
  

Local fix

Problem summary

• The port scanner was submitting binary data to the agent.
  The buffering logic in the agent was not designed for
  robustness against invalid input.  This should now be
  corrected.
  

Problem conclusion

• The I/O loop in the agent code base became confused if
  received a short read and the previously read data did not
  terminate on a line boundary.  The agent's io code base was
  making the assumption that on a short read it should return
  the number of characters it has so far instead of an error
  code, but the code that was using it did not expect this
  behavior.  Short reads now result in an error return,
  instead, which will cause the agent to exit instead of
  continuing to try to read.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BUILD FORGE EE

• Fixed component ID

  5724S2701

Applicable component levels

• R701 PSN

     UP