Bug#679377: Segmentation fault when initramfs is booting

[Michael Tokarev <mjt@tls.msk.ru>]

retitle 679377 busybox awk segfaults when called from ash and no PATH set (eg initramfs /init)
tags 679377 + pending
thanks

On 05.07.2012 15:12, Jordi Pujol wrote:
[]
>>> the patch "shell-ash-export-HOME.patch" causes a segmentation fault when
>>> initramfs boots,
>>> I believe that this fault occurs the first time that initramfs looks for
>>> some executable in the initramfs filesystem,

Big thanks to Denys Vlasenko, the issue has been identified.

awk applet, when initializes, converts environment variables
into awk internal variables, and while doing this, it temporary
replaces the equal sign (=) in ther with a null byte (\0).

awk applet is marked as NOEXEC, ie, it is okay to run it directly
from shell just by calling appropriate awk_main() routine, without
executing any external program.

When ash tries to run such applet, it initializes environment
variables first, and calls the applet's main() function.

The patch in question exports PATH variable with its default
value.  But this value is stored in a global CONSTANT variable
(marked as "const").  All other exported variables are
in malloc'ed memory.

Also, when awk is run as a separate command, the kernel sets
environment variables to be completely writable.

So this very case - calling awk applet from ash when no
PATH variable has been set - is the only case when ONE
environment variable - PATH - is not writable.  And when
awk applet initializes and tries to replace "=" with "\0",
it segfaults.

I added a temporary workaround to this patch - making
the default PATH variable to be non-const, ie, writable,
this way awk will be able to write to it.  No other parts
of the code tries to write to it, so it is a safe change.

I can't drop this patch now, since it is too risky change
at this stage in wheezy release.  This rather obscure
case were difficult enough to debug, and I don't want
to introduce another obscure issue in some other component
while wheezy is frozen.

By the way, the same issue can be reproduced much, much
more easily:

 $ env -i /bin/busybox ash -c awk
 Segmentation fault

That was the missing part: no environment variables are
set, including $PATH.

Thanks,

/mjt