Bug 1217926

Summary: [abrt] mksh: vfptreef(): mksh killed by SIGSEGV
Product: [Fedora] Fedora Reporter: jd1008
Component: mkshAssignee: Robert Scheck <redhat-bugzilla>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 21CC: jd1008, mhlavink, redhat-bugzilla, tg
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/d85149c617b632e1be5d5c20f94e98e1ebcdb5c5
Whiteboard: abrt_hash:73fb1aa80b282f099e0e14db539a9f184e6210ad
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-05-09 21:03:16 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: exploitable
none
File: limits
none
File: maps
none
File: open_fds
none
File: proc_pid_status none

Description jd1008 2015-05-03 02:30:05 UTC
Description of problem:
In a terminal, I issued the command mksh
and I sourced ~/.profile and then I issued the command
cd /tmp. It took it a long time to come back, so
I interrupted it and it crashed.

Version-Release number of selected component:
mksh-50e-1.fc21

Additional info:
reporter:       libreport-2.3.0
backtrace_rating: 4
cmdline:        mksh
crash_function: vfptreef
executable:     /usr/bin/mksh
kernel:         3.19.5-200.fc21.x86_64
runlevel:       N 5
type:           CCpp
uid:            1008
var_log_messages: [System Logs]:\n-- Logs begin at Thu 2014-10-09 18:31:17 MDT, end at Sat 2015-05-02 20:22:23 MDT. --

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 vfptreef at tree.c:450
 #1 fptreef at tree.c:427
 #2 ptree at tree.c:101
 #3 vfptreef at tree.c:478
 #4 snptreef at tree.c:441
 #5 vistree at tree.c:765
 #6 exchild at jobs.c:499
 #7 execute at exec.c:75
 #8 comsub at eval.c:1407
 #9 expand at eval.c:331

Comment 1 jd1008 2015-05-03 02:30:21 UTC
Created attachment 1021258 [details]
File: backtrace

Comment 2 jd1008 2015-05-03 02:30:22 UTC
Created attachment 1021259 [details]
File: cgroup

Comment 3 jd1008 2015-05-03 02:30:24 UTC
Created attachment 1021260 [details]
File: core_backtrace

Comment 4 jd1008 2015-05-03 02:30:25 UTC
Created attachment 1021261 [details]
File: dso_list

Comment 5 jd1008 2015-05-03 02:30:25 UTC
Created attachment 1021262 [details]
File: environ

Comment 6 jd1008 2015-05-03 02:30:26 UTC
Created attachment 1021263 [details]
File: exploitable

Comment 7 jd1008 2015-05-03 02:30:27 UTC
Created attachment 1021264 [details]
File: limits

Comment 8 jd1008 2015-05-03 02:30:27 UTC
Created attachment 1021265 [details]
File: maps

Comment 9 jd1008 2015-05-03 02:30:28 UTC
Created attachment 1021266 [details]
File: open_fds

Comment 10 jd1008 2015-05-03 02:30:29 UTC
Created attachment 1021267 [details]
File: proc_pid_status

Comment 11 Robert Scheck 2015-05-03 11:11:38 UTC
Hello, thank you for your report. Is this reproducible with mksh-50f-1.fc21,
which is already available as an update in the repository?

Comment 12 jd1008 2015-05-03 18:07:29 UTC
$ rpm -q mksh
mksh-50f-1.fc21.x86_64

It still hangs when I cd /tmp
but when I interrupt it, it no longer crashes.

As you might have seen from the files uploaded by abrt,
I use functions() in my env.
My alias for cd is a function dchg()
which in turn calls upon 2 other functions.

This has been working for my since 1989 !!!!
I normally use ksh-20120801-23.fc21.x86_64

I simply wanted to try and see how mksh faired.

I was disappointed :)

Comment 13 Thorsten Glaser 2015-05-03 20:11:40 UTC
Hi, mksh upstream here.

Can I please have your ~/.profile with the relevant definitions? My suspection here is that you call something recursively (i.e. miss a 'command' before a function/builtin or don’t escape an alias/builtin ambiguosity). Of course you may have found an actual bug, but recursive calls are hard to catch, so we can’t say immediately.

Comment 14 jd1008 2015-05-03 22:08:38 UTC
As I already stated above, I have absolutely no problem
with the ksh package ksh-20120801-23.fc21.x86_64

My .profile for ksh has served me flawlessly since 1989.

Only mksh has problems with it.

No recursion, nothing.

case $0 in
*ksh*)
cd /home/jd
unset ENV
PATH=/bin:/usr/bin:/usr/local/bin:/opt/schily/bin/:/opt/master-pdf-editor/bin:

LOCALE=C
METAHOME=/usr/lib/metadata_extractor
JAVA_HOME=/usr/lib/jvm/jre-1.9.0-openjdk.x86_64

unset -f command_not_found_handle

MANPATH=/opt/schily/share/man:/usr/local/man:/usr/local/lib/perl5/man:/usr/local/interviews/man:/usr/share/man:/usr/X11R6/man:/usr/X11R6/src/xc/doc/man:/usr/X11R6/src/xc/doc/hardcopy/man

QTDIR3=/usr/lib64/qt-3.3
QTDIR4=/usr/lib64/qt4

BLOCKSIZE=K
EDITOR=vi
VISUAL=$EDITOR
FCEDIT=$EDITOR
HOST=`hostname|sed 's,\..*$,,'`
TITLE='[__'`toupper $HOST`'__]'
MAIL=/var/mail/$LOGNAME
MAILCHECK=1
PAGER=more
LISTER=more
TMOUT=0
MORE=-c
HISTMAX=65536
HISTSIZE=65536
SAVEHISTSIZE=65536
HISTFILE=$HOME/.history_ksh
SAVEHISTFILE=$HOME/.savehist
SHELL=/bin/ksh
# DISPLAY=:0
VIEWER=$HOME/bin/viewer
XMCDLIB=/usr/lib/xmcd
LOCALE="en_US"

QT_PLUGIN_PATH=/usr/lib/qt4/plugins

export  PATH MANPATH BLOCKSIZE EDITOR VISUAL FCEDIT HOST TITLE \
        MAIL MAILCHECK PAGER LISTER TMOUT MORE PRINTER HISTSIZE \
        SAVEHISTSIZE HISTFILE SAVEHISTFILE SHELL DISPLAY SHELL \
        DISPLAY VIEWER XMCDLIB LOCALE \
        METAHOME JAVA_HOME QTDIR3 QTDIR4 QT_PLUGIN_PATH

PS1="{!-$USER@$HOST}$ "
set complete ^I^I
set filec ^I
unalias cd
typeset -i dirstatic dirdynamic d_num DIRMAX
typeset d_path d_mess d_tag
dirs[0]=$HOME
dirtags[0]='PD'
dirstatic=1
dirdynamic=256
export  dirstatic dirdynamic dirtags d_num d_path d_mess d_tag DIRMAX

FPATH=${HOME}/.funs
autoload `/bin/ls /home/jd/.funs`
if [ $? -eq 0 ]; then
        echo Functions will be autoloaded
        dinit
        dload
        alias cd=dchg
else
        echo Old ksh - loading functions manually
# Default status function for printing current working dir
        status ()
        {
            echo \(wd now `pwd`\)
        }
        cd $HOME/.funs
        . ./dinit
        . ./*
        dinit
        dload
        cd $HOME
fi

Comment 15 Thorsten Glaser 2015-05-04 08:40:28 UTC
The definition of the dchg function is missing.

Comment 16 Thorsten Glaser 2015-05-09 11:56:59 UTC
Hello jd1008, could you please provide the missing information?

Comment 17 jd1008 2015-05-09 18:30:15 UTC
In ~/.profile I first initialze these:
unalias cd
typeset -i dirstatic dirdynamic d_num DIRMAX
typeset d_path d_mess d_tag
dirs[0]=$HOME
dirtags[0]='PD'
dirstatic=1
dirdynamic=256
export  dirstatic dirdynamic dirtags d_num d_path d_mess d_tag DIRMAX

The functions are then "sourced" in .profile as you see in my previous response.

#
# Directory functions, see dhlp() for more info.
#

typeset -fx dchg

function dchg
{
        typeset -i n m f

        unalias cd

        case $1 in
        '')
                d_path="${dirs[0]}"
                d_num=0
                ;;
        *)
                dargs "$@"
                case $d_num in
                -1)
                        case $d_mess in
                        '')
                                ;;
                        *)
                                print cd: $d_mess
                                alias cd=dchg
                                set +x
                                return 1
                                ;;
                        esac
                        ;;
                -2)
                        alias cd=dchg
                        set +x
                        return 0
                        ;;
                *)
                        d_path="${dirs[d_num]}"
                        ;;
                esac
                ;;
        esac

        unalias cd
        dirs[0]=$PWD
        # eval "cd ${d_path}"
        # echo "--------------------------------------"
        unalias cd
        cd "$d_path"
        n="${#dirs[*]}"
        n=n-1
        m=0
        f=0
        while(($n>=$dirstatic))
        do
                case "${dirs[n]}" in
                "${dirs[0]}")
                        f=1
                        break
                        ;;
                esac
                n=n-1
        done
        set +x
        status
        if((f==0))
        then
                f="${#dirs[*]}"
                if ((f<dirdynamic))
                then
                        dirs[f]="${dirs[0]}"
                        alias cd=dchg
                        set +x
                        return 0
                fi
                n=dirstatic
        fi
        m=n+1
        while ((m<f))
        do
                dirs[n]="${dirs[m]}"
                case "${dirs[n]}" in
                '')
                        ;;
                *)
                        n=n+1
                        ;;
                esac
                m=m+1
        done
        dirs[n]="${dirs[0]}"
        alias cd=dchg
        set +x
}

#
# Directory functions, see dhlp() for more info.
#

typeset -fx dargs

function dargs
{
# set -x
    typeset opt
    typeset integer n
    integer n

    d_mess=
    case $1 in
    '--')
                read opt?'Number || tag || path = '
                ;;
    '-l')
                d_num=-2
        return
                ;;
    '-a')
                shift
                d_num=-2
                return
                ;;
    '-r')
                shift
                d_num=-2
                return
                ;;
    '-h')
                d_num=-2
                return
                ;;
    *)
                opt=$1
                ;;
    esac

    case $opt in
    [0-9]*)
                d_num=$opt
                ;;
    *)
        if [ -d "$opt" ]; then
                d_num=-1
                d_path=`cd "$opt"; echo $PWD`
                return
        fi
        f=0
        # n=${#dirs[*]}
        n=0
        while [ $n -le ${#dirs[*]} ]
        do
                # n=`expr $n+1`
                n+=1
                case "${dirtags[n]}" in
                $opt)
                        d_num=n
                        d_tag=$opt
                        f=1
                        break
                        ;;
                esac
        done
        case $f in
        0)
                # n=${#dirs[*]}
                n=0
                while [ $n -le ${#dirs[*]} ]
                do
                        # n=$n-1
                        n+=1
                        case "${dirs[n]}" in
                        *$opt*)
                                d_num=n
                                d_path=$opt
                                f=1
                                break
                                ;;
                        esac
                done
                ;;
        esac
        case $f in
        0)
                d_mess="$opt: tag, path fragment or directory path not found."
                d_num=-1
                return
                ;;
        esac
                ;;
    esac
}

Comment 18 Thorsten Glaser 2015-05-09 20:12:43 UTC
OK, there we have the problem. “alias” works in the parser, i.e. it changes the function definition:

	tg@blau:~ $ function foo {
	> bar
	> }
	tg@blau:~ $ typeset -f foo
	function foo {
		bar
	}
	tg@blau:~ $ alias bar=baz
	tg@blau:~ $ function foo {
	> bar
	> }
	tg@blau:~ $ typeset -f foo
	function foo {
		baz
	}
	tg@blau:~ $ unalias bar
	tg@blau:~ $ typeset -f foo
	function foo {
		baz
	}

As you can see, the “unalias” does not affect the already-defined function.

I *strongly* recommend you to use a function cd instead of aliasing cd, if you need to do things like that. I can help you with that, if required. (The dot.mkshrc file we ship *does* contain a “cd” function, to implement the “pushd”, “popd” and “dirs” commands known from Berkeley csh.)

@RedHat: this is a user error, feel free to deal with the bug as per your policy on them thus.

Comment 19 jd1008 2015-05-09 20:30:44 UTC
You are not correct.
It works perfectly for the ksh rpm from Fedora.
As I keep repeating, it has been working since 
1989!!

Why don't you show me the lines in MY code that
you try to depic with YOUR code.

I want to see where in MY code you see what you claim.

Comment 20 jd1008 2015-05-09 20:31:24 UTC
I meant "depict"

Sorry for the typo.

Comment 21 Robert Scheck 2015-05-09 21:03:16 UTC
Well, mksh is the MirBSD enhanced version of the Public Domain Korn shell
("former" pdksh) and thus not of ksh88/ksh93 (see also the description of
the mksh package). Upstream outlined that the issue is caused by infinite
recursion, thus if you need original ATT Korn Shell behaviour, I honestly
ask you to use ksh instead. Given I am the downstream package maintainer,
I can not see how this would be a downstream issue - thus closing hereby.