Segfault on recursive trap/kill

Path	csiph.com!goblin1!goblin.stu.neva.ru!usenet.stanford.edu!not-for-mail
From	Mike Gerwitz <mtg@gnu.org>
Newsgroups	gnu.bash.bug
Subject	Segfault on recursive trap/kill
Date	Fri, 05 Oct 2018 21:33:17 -0400
Lines	61
Approved	bug-bash@gnu.org
Message-ID	<mailman.1745.1538804926.1284.bug-bash@gnu.org> (permalink)
NNTP-Posting-Host	lists.gnu.org
Mime-Version	1.0
Content-Type	multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature"
X-Trace	usenet.stanford.edu 1538804927 30327 208.118.235.17 (6 Oct 2018 05:48:47 GMT)
X-Complaints-To	action@cs.stanford.edu
To	bug-bash@gnu.org
Envelope-to	bug-bash@gnu.org
User-Agent	Gnus/5.13 (Gnus v5.13) Emacs/25.3 (gnu/linux)
OpenPGP	id=22175B02E626BC98D7C0C2E5F22BB8158EE30EAB
X-detected-operating-system	by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
X-Received-From	2001:4830:134:3::e
X-Mailman-Approved-At	Sat, 06 Oct 2018 01:48:45 -0400
X-BeenThere	bug-bash@gnu.org
X-Mailman-Version	2.1.21
Precedence	list
List-Id	Bug reports for the GNU Bourne Again SHell <bug-bash.gnu.org>
List-Unsubscribe	<https://lists.gnu.org/mailman/options/bug-bash>, <mailto:bug-bash-request@gnu.org?subject=unsubscribe>
List-Archive	<http://lists.gnu.org/archive/html/bug-bash/>
List-Post	<mailto:bug-bash@gnu.org>
List-Help	<mailto:bug-bash-request@gnu.org?subject=help>
List-Subscribe	<https://lists.gnu.org/mailman/listinfo/bug-bash>, <mailto:bug-bash-request@gnu.org?subject=subscribe>
Xref	csiph.com gnu.bash.bug:14688

Show key headers only | View raw

[Multipart message — attachments visible in raw view] - view raw

The following code will cause a segfault on bash-4.4.19(1) on
GNU Guix.  I reproduced the issue on an old Ubuntu 14.04 LTS running
bash-4.3.11(1) as well as a Trisquel system running the same version.

  bash -c 'trap "kill 0" TERM; kill 0'

Also segfaults when replacing `0' with `$$', and presumably in any other
situation that would trigger the trap recursively.

I don't have the debug symbols, but here's the backtrace:

  #0  0x00007ffff6f7ad77 in kill () at ../sysdeps/unix/syscall-template.S:78
  #1  0x0000000000446513 in kill_pid ()
  #2  0x00000000004817a6 in kill_builtin ()
  #3  0x000000000043248d in execute_builtin.isra ()
  #4  0x0000000000434924 in execute_simple_command ()
  #5  0x0000000000435c2f in execute_command_internal ()
  #6  0x00000000004357e6 in execute_command_internal ()
  #7  0x000000000047d88f in parse_and_execute ()
  #8  0x000000000041be48 in run_one_command ()
  #9  0x000000000041da19 in main ()

I don't have a strong opinion on what the expected behavior ought to be
in this situation; I certainly didn't intend to discover this issue. :)

For context: I discovered this when my trap tried to kill a subprocess,
but the integer variable storing the pid of that process was not
properly set.

-- 
Mike Gerwitz
Free Software Hacker+Activist | GNU Maintainer & Volunteer
GPG: D6E9 B930 028A 6C38 F43B  2388 FEF6 3574 5E6F 6D05
https://mikegerwitz.com

Back to gnu.bash.bug | Previous | Next | Find similar | Unroll thread

Thread

Segfault on recursive trap/kill Mike Gerwitz <mtg@gnu.org> - 2018-10-05 21:33 -0400

csiph-web