[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#699288: Segmentation fault in "kill %string"



Control: tags -1 - moreinfo unreproducible
Control: severity -1 important

Oops. I can reproduce it even using the most recent ksh:

% LANG=C strace ksh -c "kill %a"
execve("/usr/bin/ksh", ["ksh", "-c", "kill %a"], 0x7ffdbbef64e0 /* 61 vars */)
= 0
brk(NULL)                               = 0x560e5b333000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or
directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=166801, ...}) = 0
mmap(NULL, 166801, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f70348b6000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0000\21\0\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=14592, ...}) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7f70348b4000
mmap(NULL, 16656, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f70348af000
mmap(0x7f70348b0000, 4096, PROT_READ|PROT_EXEC,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0x7f70348b0000
mmap(0x7f70348b1000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3,
0x2000) = 0x7f70348b1000
mmap(0x7f70348b2000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f70348b2000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libutil.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\22\0\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=14720, ...}) = 0
mmap(NULL, 16656, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f70348aa000
mmap(0x7f70348ab000, 4096, PROT_READ|PROT_EXEC,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0x7f70348ab000
mmap(0x7f70348ac000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3,
0x2000) = 0x7f70348ac000
mmap(0x7f70348ad000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f70348ad000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libm.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3,
"\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\361\0\0\0\0\0\0"..., 832)
= 832
fstat(3, {st_mode=S_IFREG|0644, st_size=1325424, ...}) = 0
mmap(NULL, 1327360, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) =
0x7f7034765000
mmap(0x7f7034774000, 634880, PROT_READ|PROT_EXEC,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xf000) = 0x7f7034774000
mmap(0x7f703480f000, 626688, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE,
3, 0xaa000) = 0x7f703480f000
mmap(0x7f70348a8000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x142000) = 0x7f70348a8000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320l\2\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1820104, ...}) = 0
mmap(NULL, 1832568, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) =
0x7f70345a5000
mprotect(0x7f70345ca000, 1642496, PROT_NONE) = 0
mmap(0x7f70345ca000, 1339392, PROT_READ|PROT_EXEC,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x25000) = 0x7f70345ca000
mmap(0x7f7034711000, 299008, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE,
3, 0x16c000) = 0x7f7034711000
mmap(0x7f703475b000, 24576, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b5000) = 0x7f703475b000
mmap(0x7f7034761000, 13944, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f7034761000
close(3)                                = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7f70345a3000
arch_prctl(ARCH_SET_FS, 0x7f70345a3b80) = 0
mprotect(0x7f703475b000, 12288, PROT_READ) = 0
mprotect(0x7f70348a8000, 4096, PROT_READ) = 0
mprotect(0x7f70348ad000, 4096, PROT_READ) = 0
mprotect(0x7f70348b2000, 4096, PROT_READ) = 0
mprotect(0x560e59b7c000, 65536, PROT_READ) = 0
mprotect(0x7f7034906000, 4096, PROT_READ) = 0
munmap(0x7f70348b6000, 166801)          = 0
mmap(NULL, 98304, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7f70348c7000
rt_sigaction(SIGSEGV, {sa_handler=0x560e59af8020, sa_mask=[],
sa_flags=SA_RESTORER|SA_INTERRUPT, sa_restorer=0x7f70345df100},
{sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGSEGV, {sa_handler=SIG_DFL, sa_mask=[],
sa_flags=SA_RESTORER|SA_INTERRUPT, sa_restorer=0x7f70345df100},
{sa_handler=0x560e59af8020, sa_mask=[], sa_flags=SA_RESTORER|SA_INTERRUPT,
sa_restorer=0x7f70345df100}, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [SEGV], NULL, 8) = 0
getpid()                                = 6853
getppid()                               = 6850
getuid()                                = 1000
geteuid()                               = 1000
getgid()                                = 1000
getegid()                               = 1000
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024,
rlim_max=RLIM64_INFINITY}) = 0
prlimit64(0, RLIMIT_NPROC, NULL, {rlim_cur=63565, rlim_max=63565}) = 0
openat(AT_FDCWD, "/proc/sys/kernel/ngroups_max", O_RDONLY) = 3
read(3, "65536\n", 31)                  = 6
close(3)                                = 0
umask(000)                              = 022
umask(022)                              = 000
fcntl(0, F_GETFL)                       = 0x2 (flags O_RDWR)
stat("/dev/null", {st_mode=S_IFCHR|0666, st_rdev=makedev(0x1, 0x3), ...}) = 0
ioctl(0, TCGETS, {B38400 opost isig icanon echo ...}) = 0
lseek(0, 0, SEEK_CUR)                   = -1 ESPIPE (Illegal seek)
fstat(0, {st_mode=S_IFCHR|0600, st_rdev=makedev(0x88, 0x1), ...}) = 0
fstat(0, {st_mode=S_IFCHR|0600, st_rdev=makedev(0x88, 0x1), ...}) = 0
stat("/dev/null", {st_mode=S_IFCHR|0666, st_rdev=makedev(0x1, 0x3), ...}) = 0
fstat(0, {st_mode=S_IFCHR|0600, st_rdev=makedev(0x88, 0x1), ...}) = 0
fcntl(1, F_GETFL)                       = 0x2 (flags O_RDWR)
ioctl(1, TCGETS, {B38400 opost isig icanon echo ...}) = 0
lseek(1, 0, SEEK_CUR)                   = -1 ESPIPE (Illegal seek)
fstat(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(0x88, 0x1), ...}) = 0
fstat(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(0x88, 0x1), ...}) = 0
brk(NULL)                               = 0x560e5b333000
mmap(NULL, 98304, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7f703458b000
rt_sigaction(SIGSEGV, {sa_handler=0x560e59af8020, sa_mask=[],
sa_flags=SA_RESTORER|SA_INTERRUPT, sa_restorer=0x7f70345df100},
{sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER|SA_INTERRUPT,
sa_restorer=0x7f70345df100}, 8) = 0
rt_sigaction(SIGSEGV, {sa_handler=SIG_DFL, sa_mask=[],
sa_flags=SA_RESTORER|SA_INTERRUPT, sa_restorer=0x7f70345df100},
{sa_handler=0x560e59af8020, sa_mask=[], sa_flags=SA_RESTORER|SA_INTERRUPT,
sa_restorer=0x7f70345df100}, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [SEGV], NULL, 8) = 0
mmap(NULL, 98304, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7f7034573000
rt_sigaction(SIGSEGV, {sa_handler=0x560e59af8020, sa_mask=[],
sa_flags=SA_RESTORER|SA_INTERRUPT, sa_restorer=0x7f70345df100},
{sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER|SA_INTERRUPT,
sa_restorer=0x7f70345df100}, 8) = 0
rt_sigaction(SIGSEGV, {sa_handler=SIG_DFL, sa_mask=[],
sa_flags=SA_RESTORER|SA_INTERRUPT, sa_restorer=0x7f70345df100},
{sa_handler=0x560e59af8020, sa_mask=[], sa_flags=SA_RESTORER|SA_INTERRUPT,
sa_restorer=0x7f70345df100}, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [SEGV], NULL, 8) = 0
fstat(2, {st_mode=S_IFCHR|0600, st_rdev=makedev(0x88, 0x1), ...}) = 0
ioctl(2, TCGETS, {B38400 opost isig icanon echo ...}) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
readlink("/proc/self/exe", "/usr/bin/ksh93", 4097) = 14
brk(0x560e5b354000)                     = 0x560e5b354000
openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=3246832, ...}) = 0
mmap(NULL, 3246832, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f703425a000
close(3)                                = 0
stat("/home/hosiet", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
stat(".", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
rt_sigaction(SIGCHLD, {sa_handler=0x560e59a453f0, sa_mask=[],
sa_flags=SA_RESTORER|SA_INTERRUPT, sa_restorer=0x7f70345df100},
{sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x10} ---
+++ killed by SIGSEGV +++
[1]    6850 segmentation fault  LANG=C strace ksh -c "kill %a"

Thanks,
Boyuan Yang

Attachment: signature.asc
Description: This is a digitally signed message part


Reply to: