segfault on 'echo $(< /dev/kmsg )' in zsh-5.0.2 and git

segfault on 'echo $(< /dev/kmsg )' in zsh-5.0.2 and git

[Marien Zwart]

Hello zsh-workers,

On zsh-5.0.2 as well as current git
(40a881569fed17177fbd73079dd4d3849517567c), the following segfaults on
my linux 3.10, glibc 2.17 system:

echo $(< /dev/kmsg )

Tracing through it in gdb, I've found that's because the fdopen(in,
"r") call in readoutput returned NULL (and then it predictably
segfaults somewhere in the subsequent fgetc). Sticking a NULL check
and zerr("fdopen: %e", errno); after the fdopen gets me "zsh: fdopen:
invalid argument", and returning NULL after that at least doesn't make
zsh immediately topple over. But I have no idea how safe that is
(there's no other error return in readoutput), and it needs some
tidying up such as closing the fd, so I'll leave properly patching
this to someone else.

That's assuming fdopen failing is considered possible. In this case,
it happens because /dev/kmsg supports seek but not with whence
SEEK_CUR, for which it fails with EINVAL (lseek(2) says "whence is not
valid" is one condition resulting in EINVAL), and glibc accepts that
seek failing with ESPIPE but not other reasons. Depending on which
manpage you read fdopen() may fail if fcntl fails, which it may do for
various reasons. So if it's not too hard it'd be nice for zsh to
survive fdopen failing, although there's something to be said for
fdopen (glibc) or the fd (linux kernel) being broken for this specific
crash (on /dev/kmsg).

-- 
Marien Zwart (marienz on freenode).

Re: segfault on 'echo $(< /dev/kmsg )' in zsh-5.0.2 and git

[Axel Beckert]

Hi,

On Tue, Aug 13, 2013 at 08:53:12PM +1000, Marien Zwart wrote:
> On zsh-5.0.2 as well as current git
> (40a881569fed17177fbd73079dd4d3849517567c), the following segfaults on
> my linux 3.10, glibc 2.17 system:
> 
> echo $(< /dev/kmsg )

I can confirm that on Debian Unstable, zsh 5.0.2, glibc 2.17 and Linux
kernel 3.10 on 32 bit x86 (Debian architecture "i386").

		Kind regards, Axel
-- 
/~\  Plain Text Ribbon Campaign                   | Axel Beckert
\ /  Say No to HTML in E-Mail and News            | abe@deuxchevaux.org  (Mail)
 X   See http://www.asciiribbon.org/              | abe@noone.org (Mail+Jabber)
/ \  I love long mails: http://email.is-not-s.ms/ | http://noone.org/abe/ (Web)

Re: segfault on 'echo $(< /dev/kmsg )' in zsh-5.0.2 and git

[Christian Neukirchen]

Marien Zwart <marien.zwart@gmail.com> writes:

> So if it's not too hard it'd be nice for zsh to
> survive fdopen failing, although there's something to be said for
> fdopen (glibc) or the fd (linux kernel) being broken for this specific
> crash (on /dev/kmsg).

Interestingly, GNU head fails too:

% head -c1 </dev/kmsg   
head: error reading 'standard input': Invalid argument

strace shows:
read(0, 0x7fffe2ee6d70, 1)              = -1 EINVAL (Invalid argument)

It seems /dev/kmsg only allows to read for at least one line in thefile:

% head -n1 /dev/kmsg | wc -c          
42
% head -c41 </dev/kmsg       
head: error reading 'standard input': Invalid argument
% head -c42 </dev/kmsg 
6,0,0,-;Initializing cgroup subsys cpuset

-- 
Christian Neukirchen  <chneukirchen@gmail.com>  http://chneukirchen.org