Bug 2376721

Summary: [abrt] coreutils: freecon(): ls killed by SIGABRT
Product: [Fedora] Fedora Reporter: Andreas <andreas.mock>
Component: coreutilsAssignee: Lukáš Zaoral <lzaoral>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 42CC: admiller, andreas.mock, jamartis, kdudka, kzak, lzaoral, nixuser, ovasik, p, svashisht, vmihalko
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/d5314500fe513e7297f2ab6d65f248240562163
Whiteboard: abrt_hash:27dca81f41999471eea3c0ff8de830ec76c084b7;VARIANT_ID=kde;
Fixed In Version: coreutils-9.6-5.fc42 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2025-07-12 01:45:28 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: limits
none
File: os_info
none
File: open_fds
none
File: cpuinfo
none
File: backtrace
none
File: mountinfo
none
File: maps
none
File: proc_pid_status
none
File: core_backtrace
none
File: dso_list
none
File: environ none

Description Andreas 2025-07-07 08:42:31 UTC 
Description of problem:
Using konsole 25.04.3
executing shell command  'ls -lR /'

Version-Release number of selected component:
coreutils-9.6-4.fc42

Additional info:
reporter:       libreport-2.17.15
journald_cursor: s=598066b569354472a5d3feb9a6b4f0d3;i=850b;b=a1ac3d76b64348d39751a55c30361d57;m=953c2a15;t=6395289484cbd;x=eb1e2b3fb3cec40a
cgroup:         0::/user.slice/user-1000.slice/user/app.slice/app-org.kde.konsole
runlevel:       N 5
crash_function: freecon
reason:         ls killed by SIGABRT
backtrace_rating: 4
kernel:         6.15.4-200.fc42.x86_64
uid:            1000
cmdline:        ls --color=auto -lR /
package:        coreutils-9.6-4.fc42
rootdir:        /
type:           CCpp
executable:     /usr/bin/ls

Truncated backtrace:
Thread no. 1 (3 frames)
 #10 freecon at /usr/src/debug/libselinux-3.8-2.fc42.x86_64/src/freecon.c:8
 #11 clear_files at ../lib/file-has-acl.c:293
 #12 print_dir at ../src/ls.c:3061
Comment 1 Andreas 2025-07-07 08:42:35 UTC 
Created attachment 2096339 [details]
File: limits
Comment 2 Andreas 2025-07-07 08:42:37 UTC 
Created attachment 2096340 [details]
File: os_info
Comment 3 Andreas 2025-07-07 08:42:38 UTC 
Created attachment 2096341 [details]
File: open_fds
Comment 4 Andreas 2025-07-07 08:42:39 UTC 
Created attachment 2096342 [details]
File: cpuinfo
Comment 5 Andreas 2025-07-07 08:42:41 UTC 
Created attachment 2096343 [details]
File: backtrace
Comment 6 Andreas 2025-07-07 08:42:42 UTC 
Created attachment 2096344 [details]
File: mountinfo
Comment 7 Andreas 2025-07-07 08:42:43 UTC 
Created attachment 2096345 [details]
File: maps
Comment 8 Andreas 2025-07-07 08:42:45 UTC 
Created attachment 2096346 [details]
File: proc_pid_status
Comment 9 Andreas 2025-07-07 08:42:46 UTC 
Created attachment 2096347 [details]
File: core_backtrace
Comment 10 Andreas 2025-07-07 08:42:48 UTC 
Created attachment 2096348 [details]
File: dso_list
Comment 11 Andreas 2025-07-07 08:42:49 UTC 
Created attachment 2096349 [details]
File: environ
Comment 12 Pádraig Brady 2025-07-07 10:54:44 UTC 
So ls is failing with a double free of ai->scontext when processing /proc/fs/ext4/dm-1
(As root) I can _not_ repro with: # valgrind ls --color=auto -lR /proc/fs >/dev/null
@Andreas can you repro with? ls --color=auto -lR /proc/fs
If it was easy to repro we could provide you with possible fixes to try.

Note doubled freecon()s were fixed with https://github.com/coreutils/coreutils/commit/cb2abbac7
which might help in this case also?
Comment 13 Andreas 2025-07-08 08:12:34 UTC 
cd /proc/fs
ls --color=auto -lR *
# causes exception free(): double free detected in tcache 2

# BUT:
for name in *; do ls --color=auto -lR $name; done

# causes no exception => seems somthing to do with argument interation

# Additionally:
cd /proc/fs
valgrind -s --leak-check=full --show-leak-kinds=all -- ls --color=auto -lR * 2>&1

# leads to
==33491== Memcheck, a memory error detector
==33491== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al.
==33491== Using Valgrind-3.25.1 and LibVEX; rerun with -h for copyright info
==33491== Command: ls --color=auto -lR ext4 jbd2 nfsd
==33491== 
==33491== Invalid free() / delete / delete[] / realloc()
==33491==    at 0x4866E43: free (vg_replace_malloc.c:989)
==33491==    by 0x4007315: UnknownInlinedFun (file-has-acl.c:293)
==33491==    by 0x4007315: UnknownInlinedFun (ls.c:3270)
==33491==    by 0x4007315: clear_files (ls.c:3280)
==33491==    by 0x4010062: print_dir (ls.c:3061)
==33491==    by 0x4002247: main (ls.c:1860)
==33491==  Address 0x4b8b3d0 is 0 bytes inside a block of size 28 free'd
==33491==    at 0x4866E43: free (vg_replace_malloc.c:989)
==33491==    by 0x40078AD: UnknownInlinedFun (file-has-acl.c:293)
==33491==    by 0x40078AD: UnknownInlinedFun (ls.c:3270)
==33491==    by 0x40078AD: extract_dirs_from_files (ls.c:3759)
==33491==    by 0x4003423: main (ls.c:1819)
==33491==  Block was alloc'd at
==33491==    at 0x4863B26: malloc (vg_replace_malloc.c:446)
==33491==    by 0x495DCEE: strdup (strdup.c:42)
==33491==    by 0x48B0B68: selinux_raw_to_trans_context (setrans_client.c:363)
==33491==    by 0x48B0C98: lgetfilecon (lgetfilecon.c:62)
==33491==    by 0x4010C46: rpl_lgetfilecon (getfilecon.c:91)
==33491==    by 0x400F28A: UnknownInlinedFun (file-has-acl.c:249)
==33491==    by 0x400F28A: UnknownInlinedFun (file-has-acl.c:468)
==33491==    by 0x400F28A: UnknownInlinedFun (file-has-acl.c:443)
==33491==    by 0x400F28A: UnknownInlinedFun (ls.c:3323)
==33491==    by 0x400F28A: gobble_file.constprop.0 (ls.c:3526)
==33491==    by 0x40021F5: main (ls.c:1812)
==33491==
Comment 14 Pádraig Brady 2025-07-08 08:41:39 UTC 
It's good you can repro (I still can't).

Could you try the latest ls release which has the aforementioned patch included.
You can build for your current system like:

# As root
dnf install gcc gettext-devel gmp-devel hostname libacl-devel libattr-devel libcap-devel libselinux-devel libselinux-utils make openssl-devel

# As normal user
wget https://ftp.gnu.org/gnu/coreutils/coreutils-9.7.tar.xz
tar -xf coreutils-9.7.tar.xz
cd coreutils-9.7
./configure --quiet && make -j $(nproc)

# Then you can test with $PWD/src/ls rather than the system ls
Comment 15 Andreas 2025-07-08 09:29:11 UTC 
I did it.

Result: No exception in my case.

# Explicit run with valgrind:
valgrind -s --leak-check=full --show-leak-kinds=all -- /home/mca/development/coreutils/coreutils-9.7/src/ls --color=auto -lR *

# Output
==57077== Memcheck, a memory error detector
==57077== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al.
==57077== Using Valgrind-3.25.1 and LibVEX; rerun with -h for copyright info
==57077== Command: /home/mca/development/coreutils/coreutils-9.7/src/ls --color=auto -lR ext4 jbd2 nfsd
==57077== 
ext4:
total 0
dr-xr-xr-x. 8 root root 0 Jul  7 15:31 dm-1
dr-xr-xr-x. 8 root root 0 Jul  7 15:31 dm-3
dr-xr-xr-x. 8 root root 0 Jul  7 15:31 dm-4
dr-xr-xr-x. 8 root root 0 Jul  7 15:31 dm-5
dr-xr-xr-x. 8 root root 0 Jul  7 15:31 dm-6
dr-xr-xr-x. 8 root root 0 Jul  7 15:31 sda2

ext4/dm-1:
total 0
-r--r--r--. 1 root root 0 Jul  7 15:33 es_shrinker_info
-r--r--r--. 1 root root 0 Jul  7 15:33 fc_info
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_groups
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_stats
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_structs_summary
-r--r--r--. 1 root root 0 Jul  7 15:33 options

ext4/dm-3:
total 0
-r--r--r--. 1 root root 0 Jul  7 15:33 es_shrinker_info
-r--r--r--. 1 root root 0 Jul  7 15:33 fc_info
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_groups
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_stats
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_structs_summary
-r--r--r--. 1 root root 0 Jul  7 15:33 options

ext4/dm-4:
total 0
-r--r--r--. 1 root root 0 Jul  7 15:33 es_shrinker_info
-r--r--r--. 1 root root 0 Jul  7 15:33 fc_info
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_groups
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_stats
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_structs_summary
-r--r--r--. 1 root root 0 Jul  7 15:33 options

ext4/dm-5:
total 0
-r--r--r--. 1 root root 0 Jul  7 15:33 es_shrinker_info
-r--r--r--. 1 root root 0 Jul  7 15:33 fc_info
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_groups
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_stats
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_structs_summary
-r--r--r--. 1 root root 0 Jul  7 15:33 options

ext4/dm-6:
total 0
-r--r--r--. 1 root root 0 Jul  7 15:33 es_shrinker_info
-r--r--r--. 1 root root 0 Jul  7 15:33 fc_info
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_groups
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_stats
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_structs_summary
-r--r--r--. 1 root root 0 Jul  7 15:33 options

ext4/sda2:
total 0
-r--r--r--. 1 root root 0 Jul  7 15:33 es_shrinker_info
-r--r--r--. 1 root root 0 Jul  7 15:33 fc_info
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_groups
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_stats
-r--r--r--. 1 root root 0 Jul  7 15:33 mb_structs_summary
-r--r--r--. 1 root root 0 Jul  7 15:33 options

jbd2:
total 0
dr-xr-xr-x. 3 root root 0 Jul  7 15:34 dm-1-8
dr-xr-xr-x. 3 root root 0 Jul  7 15:34 dm-3-8
dr-xr-xr-x. 3 root root 0 Jul  7 15:34 dm-4-8
dr-xr-xr-x. 3 root root 0 Jul  7 15:34 dm-5-8
dr-xr-xr-x. 3 root root 0 Jul  7 15:34 dm-6-8
dr-xr-xr-x. 3 root root 0 Jul  7 15:34 sda2-8

jbd2/dm-1-8:
total 0
-r--r--r--. 1 root root 0 Jul  7 15:34 info

jbd2/dm-3-8:
total 0
-r--r--r--. 1 root root 0 Jul  7 15:34 info

jbd2/dm-4-8:
total 0
-r--r--r--. 1 root root 0 Jul  7 15:34 info

jbd2/dm-5-8:
total 0
-r--r--r--. 1 root root 0 Jul  7 15:34 info

jbd2/dm-6-8:
total 0
-r--r--r--. 1 root root 0 Jul  7 15:34 info

jbd2/sda2-8:
total 0
-r--r--r--. 1 root root 0 Jul  7 15:34 info

nfsd:
total 0
==57077== 
==57077== HEAP SUMMARY:
==57077==     in use at exit: 39,587 bytes in 161 blocks
==57077==   total heap usage: 740 allocs, 579 frees, 610,958 bytes allocated
==57077== 
==57077== 24 bytes in 1 blocks are still reachable in loss record 1 of 17
==57077==    at 0x483EB26: malloc (vg_replace_malloc.c:446)
==57077==    by 0x415088: xmalloc (xmalloc.c:45)
==57077==    by 0x40F017: getuser (idcache.c:87)
==57077==    by 0x4049A0: format_user_width (ls.c:4281)
==57077==    by 0x409488: gobble_file.constprop.0 (ls.c:3626)
==57077==    by 0x401345: main (ls.c:1812)
==57077== 
==57077== 24 bytes in 1 blocks are still reachable in loss record 2 of 17
==57077==    at 0x483EB26: malloc (vg_replace_malloc.c:446)
==57077==    by 0x415088: xmalloc (xmalloc.c:45)
==57077==    by 0x40F1E7: getgroup (idcache.c:169)
==57077==    by 0x4098C7: format_group_width (ls.c:4289)
==57077==    by 0x4098C7: gobble_file.constprop.0 (ls.c:3633)
==57077==    by 0x401345: main (ls.c:1812)
==57077== 
==57077== 27 bytes in 1 blocks are still reachable in loss record 3 of 17
==57077==    at 0x483EB26: malloc (vg_replace_malloc.c:446)
==57077==    by 0x40266DF: malloc (rtld-malloc.h:56)
==57077==    by 0x40266DF: strdup (strdup.c:42)
==57077==    by 0x4013CE3: _dl_load_cache_lookup (dl-cache.c:499)
==57077==    by 0x4008090: _dl_map_object (dl-load.c:2049)
==57077==    by 0x400BB29: dl_open_worker_begin (dl-open.c:542)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x400B23B: dl_open_worker (dl-open.c:761)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x400B6DD: _dl_open (dl-open.c:874)
==57077==    by 0x49F2954: do_dlopen (dl-libc.c:95)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x4001868: _dl_catch_error (dl-catch.c:260)
==57077== 
==57077== 27 bytes in 1 blocks are still reachable in loss record 4 of 17
==57077==    at 0x483EB26: malloc (vg_replace_malloc.c:446)
==57077==    by 0x400AFF0: UnknownInlinedFun (rtld-malloc.h:56)
==57077==    by 0x400AFF0: _dl_new_object (dl-object.c:199)
==57077==    by 0x400650D: _dl_map_object_from_fd (dl-load.c:1060)
==57077==    by 0x4007DE7: _dl_map_object (dl-load.c:2182)
==57077==    by 0x400BB29: dl_open_worker_begin (dl-open.c:542)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x400B23B: dl_open_worker (dl-open.c:761)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x400B6DD: _dl_open (dl-open.c:874)
==57077==    by 0x49F2954: do_dlopen (dl-libc.c:95)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x4001868: _dl_catch_error (dl-catch.c:260)
==57077== 
==57077== 38 bytes in 2 blocks are still reachable in loss record 5 of 17
==57077==    at 0x483EB26: malloc (vg_replace_malloc.c:446)
==57077==    by 0x40266DF: malloc (rtld-malloc.h:56)
==57077==    by 0x40266DF: strdup (strdup.c:42)
==57077==    by 0x4013CE3: _dl_load_cache_lookup (dl-cache.c:499)
==57077==    by 0x4008090: _dl_map_object (dl-load.c:2049)
==57077==    by 0x4002A7C: openaux (dl-deps.c:64)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x4002EB0: _dl_map_object_deps (dl-deps.c:232)
==57077==    by 0x400BB8C: dl_open_worker_begin (dl-open.c:606)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x400B23B: dl_open_worker (dl-open.c:761)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x400B6DD: _dl_open (dl-open.c:874)
==57077== 
==57077== 38 bytes in 2 blocks are still reachable in loss record 6 of 17
==57077==    at 0x483EB26: malloc (vg_replace_malloc.c:446)
==57077==    by 0x400AFF0: UnknownInlinedFun (rtld-malloc.h:56)
==57077==    by 0x400AFF0: _dl_new_object (dl-object.c:199)
==57077==    by 0x400650D: _dl_map_object_from_fd (dl-load.c:1060)
==57077==    by 0x4007DE7: _dl_map_object (dl-load.c:2182)
==57077==    by 0x4002A7C: openaux (dl-deps.c:64)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x4002EB0: _dl_map_object_deps (dl-deps.c:232)
==57077==    by 0x400BB8C: dl_open_worker_begin (dl-open.c:606)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x400B23B: dl_open_worker (dl-open.c:761)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x400B6DD: _dl_open (dl-open.c:874)
==57077== 
==57077== 56 bytes in 1 blocks are still reachable in loss record 7 of 17
==57077==    at 0x483EB26: malloc (vg_replace_malloc.c:446)
==57077==    by 0x415413: xmalloc (xmalloc.c:45)
==57077==    by 0x415413: xmemdup (xmalloc.c:314)
==57077==    by 0x4137FA: clone_quoting_options (quotearg.c:117)
==57077==    by 0x401B72: decode_switches (ls.c:2402)
==57077==    by 0x401B72: main (ls.c:1719)
==57077== 
==57077== 56 bytes in 1 blocks are still reachable in loss record 8 of 17
==57077==    at 0x483EB26: malloc (vg_replace_malloc.c:446)
==57077==    by 0x415413: xmalloc (xmalloc.c:45)
==57077==    by 0x415413: xmemdup (xmalloc.c:314)
==57077==    by 0x4137FA: clone_quoting_options (quotearg.c:117)
==57077==    by 0x401107: decode_switches (ls.c:2412)
==57077==    by 0x401107: main (ls.c:1719)
==57077== 
==57077== 72 bytes in 1 blocks are still reachable in loss record 9 of 17
==57077==    at 0x4846607: realloc (vg_replace_malloc.c:1801)
==57077==    by 0x4151B0: ireallocarray (ialloc.h:102)
==57077==    by 0x4151B0: xireallocarray (xmalloc.c:93)
==57077==    by 0x4151B0: xinmalloc (xmalloc.c:108)
==57077==    by 0x405067: sort_files (ls.c:4098)
==57077==    by 0x4020C8: main (ls.c:1817)
==57077== 
==57077== 128 bytes in 1 blocks are still reachable in loss record 10 of 17
==57077==    at 0x483EB26: malloc (vg_replace_malloc.c:446)
==57077==    by 0x4145B1: tzalloc (time_rz.c:89)
==57077==    by 0x40124D: main (ls.c:1767)
==57077== 
==57077== 1,260 bytes in 1 blocks are still reachable in loss record 11 of 17
==57077==    at 0x48463F3: calloc (vg_replace_malloc.c:1675)
==57077==    by 0x400AD0D: UnknownInlinedFun (rtld-malloc.h:44)
==57077==    by 0x400AD0D: _dl_new_object (dl-object.c:92)
==57077==    by 0x400650D: _dl_map_object_from_fd (dl-load.c:1060)
==57077==    by 0x4007DE7: _dl_map_object (dl-load.c:2182)
==57077==    by 0x400BB29: dl_open_worker_begin (dl-open.c:542)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x400B23B: dl_open_worker (dl-open.c:761)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x400B6DD: _dl_open (dl-open.c:874)
==57077==    by 0x49F2954: do_dlopen (dl-libc.c:95)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x4001868: _dl_catch_error (dl-catch.c:260)
==57077== 
==57077== 1,848 bytes in 3 blocks are still reachable in loss record 12 of 17
==57077==    at 0x48463F3: calloc (vg_replace_malloc.c:1675)
==57077==    by 0x401301F: UnknownInlinedFun (rtld-malloc.h:44)
==57077==    by 0x401301F: _dl_check_map_versions (dl-version.c:280)
==57077==    by 0x400BBF5: dl_open_worker_begin (dl-open.c:614)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x400B23B: dl_open_worker (dl-open.c:761)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x400B6DD: _dl_open (dl-open.c:874)
==57077==    by 0x49F2954: do_dlopen (dl-libc.c:95)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x4001868: _dl_catch_error (dl-catch.c:260)
==57077==    by 0x49F28BB: dlerror_run (dl-libc.c:45)
==57077==    by 0x49F2B13: __libc_dlopen_mode (dl-libc.c:162)
==57077== 
==57077== 1,901 bytes in 1 blocks are still reachable in loss record 13 of 17
==57077==    at 0x483EB26: malloc (vg_replace_malloc.c:446)
==57077==    by 0x4154D9: xmalloc (xmalloc.c:45)
==57077==    by 0x4154D9: xmemdup (xmalloc.c:314)
==57077==    by 0x4154D9: xstrdup (xmalloc.c:339)
==57077==    by 0x401E59: parse_ls_color (ls.c:2790)
==57077==    by 0x401E59: main (ls.c:1722)
==57077== 
==57077== 2,504 bytes in 2 blocks are still reachable in loss record 14 of 17
==57077==    at 0x48463F3: calloc (vg_replace_malloc.c:1675)
==57077==    by 0x400AD0D: UnknownInlinedFun (rtld-malloc.h:44)
==57077==    by 0x400AD0D: _dl_new_object (dl-object.c:92)
==57077==    by 0x400650D: _dl_map_object_from_fd (dl-load.c:1060)
==57077==    by 0x4007DE7: _dl_map_object (dl-load.c:2182)
==57077==    by 0x4002A7C: openaux (dl-deps.c:64)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x4002EB0: _dl_map_object_deps (dl-deps.c:232)
==57077==    by 0x400BB8C: dl_open_worker_begin (dl-open.c:606)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x400B23B: dl_open_worker (dl-open.c:761)
==57077==    by 0x4001715: _dl_catch_exception (dl-catch.c:241)
==57077==    by 0x400B6DD: _dl_open (dl-open.c:874)
==57077== 
==57077== 4,064 bytes in 1 blocks are still reachable in loss record 15 of 17
==57077==    at 0x483EB26: malloc (vg_replace_malloc.c:446)
==57077==    by 0x411905: call_chunkfun (obstack.c:68)
==57077==    by 0x411905: _obstack_begin_worker.isra.0 (obstack.c:115)
==57077==    by 0x411924: rpl_obstack_begin (obstack.c:137)
==57077==    by 0x40123B: main (ls.c:1764)
==57077== 
==57077== 6,720 bytes in 140 blocks are still reachable in loss record 16 of 17
==57077==    at 0x483EB26: malloc (vg_replace_malloc.c:446)
==57077==    by 0x415088: xmalloc (xmalloc.c:45)
==57077==    by 0x40278F: parse_ls_color (ls.c:2810)
==57077==    by 0x40278F: main (ls.c:1722)
==57077== 
==57077== 20,800 bytes in 1 blocks are still reachable in loss record 17 of 17
==57077==    at 0x483EB26: malloc (vg_replace_malloc.c:446)
==57077==    by 0x415088: xmalloc (xmalloc.c:45)
==57077==    by 0x401300: main (ls.c:1796)
==57077== 
==57077== LEAK SUMMARY:
==57077==    definitely lost: 0 bytes in 0 blocks
==57077==    indirectly lost: 0 bytes in 0 blocks
==57077==      possibly lost: 0 bytes in 0 blocks
==57077==    still reachable: 39,587 bytes in 161 blocks
==57077==         suppressed: 0 bytes in 0 blocks
==57077== 
==57077== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
Comment 16 Pádraig Brady 2025-07-08 10:07:35 UTC 
@lzaoral Could you backport this commit?
https://github.com/coreutils/coreutils/commit/cb2abbac7
I'm almost certain it's the fix for this.

@andreas if you had time to double check this fix in isolation
I've prep'd a tarball with Fedora 42 sources + just this fix
which you could check with:

wget https://www.pixelbeat.org/cu/coreutils-9.6-mca.tar.xz
tar -xf coreutils-9.6-mca.tar.xz
cd coreutils-9.6-mca
./configure --quiet && make -j $(nproc)

# As before you can test with $PWD/src/ls

thanks
Comment 17 Andreas 2025-07-08 10:26:08 UTC 
Sidenote: I had to install automake and makeinfo to fulfill the requirements for make.

Also this version seems to work properly on my system.



┈┈┈┈┈┈▕▔╲
┈┈┈┈┈┈┈▏▕
┈┈┈┈┈┈┈▏▕▂▂▂
▂▂▂▂▂▂╱┈▕▂▂▂▏
▉▉▉▉▉┈┈┈▕▂▂▂▏
▉▉▉▉▉┈┈┈▕▂▂▂▏
▔▔▔▔▔▔╲▂▕▂▂▂
Comment 18 Lukáš Zaoral 2025-07-08 10:27:49 UTC 
Thank you all for the analysis!
Comment 19 Fedora Update System 2025-07-08 12:19:13 UTC 
FEDORA-2025-06b9859763 (coreutils-9.6-5.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-06b9859763
Comment 20 Fedora Update System 2025-07-10 16:00:27 UTC 
FEDORA-2025-06b9859763 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-06b9859763`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-06b9859763

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 21 Fedora Update System 2025-07-12 01:45:28 UTC 
FEDORA-2025-06b9859763 (coreutils-9.6-5.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.