Bug 1269088

This bug is present in RHEL 7, too.


Version-Release number of selected component (if applicable):

ksh-20120801-22.el7_1.2

+++ This bug was initially created as a clone of Bug #1221766 +++

Description of problem:

  ksh crashes under chroot environment with segmentation fault

Version-Release number of selected component (if applicable):

  ksh-20120801-21.el6.x86_64


How reproducible:

  Always

Steps to Reproduce:
1. Run the following commands.
  # cd /root
  # ./test.ksh
  # ulimit -c unlimited
  # chroot /root/NEWROOT /bin/ksh

Actual results:

  you will see
    Segmentation fault (core dumped)
  and get a corefile like "/root/NEWROOT/core.12345"

Expected results:

  Print an error.


Additional info:

(gdb) bt
#0  __strlen_sse42 () at ../sysdeps/x86_64/multiarch/strlen-sse4.S:32
#1  0x00000000004a7696 in strdup (s=0x0) at /usr/src/debug/ksh-20120801/src/lib/libast/string/strdup.c:59
#2  0x000000000041d447 in sh_histinit (sh_context=<value optimized out>) at /usr/src/debug/ksh-20120801/src/cmd/ksh93/edit/history.c:398
#3  0x0000000000406f2f in exfile (shp=0x76d180, iop=0x76adc0, fno=0) at /usr/src/debug/ksh-20120801/src/cmd/ksh93/sh/main.c:400
#4  0x0000000000407e60 in sh_main (ac=<value optimized out>, av=0x7fffc9f22c08, userinit=<value optimized out>) at /usr/src/debug/ksh-20120801/src/cmd/ksh93/sh/main.c:353
#5  0x00007ff93162dd5d in __libc_start_main (main=0x406c00 <main>, argc=1, ubp_av=0x7fffc9f22c08, init=<value optimized out>, fini=<value optimized out>, 
    rtld_fini=<value optimized out>, stack_end=0x7fffc9f22bf8) at libc-start.c:226
#6  0x0000000000406b39 in _start ()

// strdup take '\0'.
(gdb) f 1
#1  0x00000000004a7696 in strdup (s=0x0) at /usr/src/debug/ksh-20120801/src/lib/libast/string/strdup.c:59
59		return (s && (t = oldof(0, char, n = strlen(s) + 1, 0))) ? (char*)memcpy(t, s, n) : (char*)0;

// ttyname(2) fails.
(gdb) f 2
#2  0x000000000041d447 in sh_histinit (sh_context=<value optimized out>) at /usr/src/debug/ksh-20120801/src/cmd/ksh93/edit/history.c:398
398					hp->tty = strdup(ttyname(2));



// strace shows ksh is trying to access /dev and /proc.
# strace -fttv chroot /root/NEWROOT /bin/ksh
...
14:46:55.268541 readlink("/proc/self/fd/2", 0x7f8e91325100, 4095) = -1 ENOENT (No such file or directory)
14:46:55.268558 fstat(2, {st_dev=makedev(0, 11), st_ino=3, st_mode=S_IFCHR|0620, st_nlink=1, st_uid=0, st_gid=5, st_blksize=1024, st_blocks=0, st_rdev=makedev(136, 0), st_atime=2015/05/14-14:46:55, st_mtime=2015/05/14-14:46:55, st_ctime=2015/05/14-14:40:13}) = 0
14:46:55.268583 stat("/dev/pts", 0x7ffff40874e0) = -1 ENOENT (No such file or directory)
14:46:55.268600 open("/dev", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
14:46:55.268620 --- SIGSEGV (Segmentation fault) @ 0 (0) ---
14:46:55.298019 +++ killed by SIGSEGV (core dumped) +++
Segmentation fault (core dumped)