Bug 1786640 - incron causes a segmentation fault when watching directories and passing arguments to the target script
Summary: incron causes a segmentation fault when watching directories and passing argu...
Keywords:
Status: ASSIGNED
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: incron
Version: epel8
Hardware: All
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Kevin Fenzi
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-12-26 17:31 UTC by Trevor Vaughan
Modified: 2020-01-08 23:38 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Trevor Vaughan 2019-12-26 17:31:54 UTC
Description of problem:

When watching directories and passing arguments to the target script, incron crashes with a segmentation fault.

Version-Release number of selected component (if applicable):

* incron-0.5.12-12.el8.x86_64 (Fails on EL8)
* incron-0.5.12-11.el7.x86_64 (Fails on EL8, works on EL7)
* incron-0.5.10-8.el7.x86_64.rpm (Works on EL8 and EL7)

How reproducible:

Add any event that passes an argument (such as $@) to the underlying script to incron and trigger a directory event.

Steps to Reproduce:
1. echo '/tmp IN_CREATE /bin/true $@'
2. systemctl start incrond
3. mkdir /tmp/test
4. Obtain stacktrace from journalctl

Actual results:

Dec 26 17:27:48 oel8 incrond[3771]: loading user tables
Dec 26 17:27:48 oel8 incrond[3771]: ready to process filesystem events
Dec 26 17:28:07 oel8 incrond[3771]: PATH (/tmp) FILE (test7) EVENT (IN_CREATE,IN_ISDIR)
Dec 26 17:28:08 oel8 incrond[3771]: cannot create watch for system table test: (2) No such file or directory
Dec 26 17:28:08 oel8 kernel: incrond[3771]: segfault at 55bd00000001 ip 000055bd99e47a5b sp 00007ffe45164c70 error 4 in incrond[55bd99e3e000+21000]
Dec 26 17:28:08 oel8 kernel: Code: 01 00 00 00 4c 89 f6 4c 89 e7 88 44 24 0f e8 3c a5 ff ff 48 83 c3 01 4c 39 eb 74 3b 48 3b 5d 08 0f 87 72 01 00 00 48 8b 45 00 <0f> b6 04 18 3c 20 0f 84 19 01 00 00 3c 5c 75 c5 ba 02 00 00 00 48
Dec 26 17:28:08 oel8 systemd[1]: Started Process Core Dump (PID 3779/UID 0).
-- Subject: Unit systemd-coredump has finished start-up
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
--
-- Unit systemd-coredump has finished starting up.
--
-- The start-up result is RESULT.
Dec 26 17:28:08 oel8 systemd[1]: incrond.service: Main process exited, code=dumped, status=11/SEGV
Dec 26 17:28:08 oel8 systemd[1]: incrond.service: Failed with result 'core-dump'.
Dec 26 17:28:08 oel8 systemd-coredump[3780]: Process 3771 (incrond) of user 0 dumped core.

                                             Stack trace of thread 3771:
                                             #0  0x000055bd99e47a5b _ZN14IncronTabEntry11GetSafePathERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE (incrond)
                                             #1  0x000055bd99e5103f _ZN9UserTable7OnEventER12InotifyEvent (incrond)
                                             #2  0x000055bd99e51464 _ZN15EventDispatcher13ProcessEventsEv (incrond)
                                             #3  0x000055bd99e45453 main (incrond)
                                             #4  0x00007f3dace8b873 __libc_start_main (libc.so.6)
                                             #5  0x000055bd99e45c7e _start (incrond)
-- Subject: Process 3771 (incrond) dumped core
-- Defined-By: systemd
-- Support: https://access.redhat.com/support
-- Documentation: man:core(5)
--
-- Process 3771 (incrond) crashed and dumped core.
--
-- This usually indicates a programming error in the crashing program and
-- should be reported to its vendor as a bug.

Expected results:

This, but with a directory entry instead of a file entry. This was created using 'touch /tmp/blah'.

Dec 26 17:28:50 oel8 incrond[3795]: loading user tables
Dec 26 17:28:50 oel8 incrond[3795]: ready to process filesystem events
Dec 26 17:29:05 oel8 incrond[3795]: PATH (/tmp) FILE (blah) EVENT (IN_CREATE)
Dec 26 17:29:05 oel8 incrond[3795]: (system::test) CMD (/bin/true /tmp)

Additional info:

If you do not pass an argument to the underlying script, no segfault is triggered.

For instance, '/tmp IN_CREATE /bin/true' works without issue (but is largely useless).

Comment 1 Kevin Fenzi 2019-12-29 20:47:47 UTC
Strange. All the same patches are applied in epel8. It must be a toolchain difference somehow. 

I'll try and track it down... thanks for the report!

Comment 2 tcooper 2020-01-08 23:38:11 UTC
If this needs additional information I can provide another case to upvote investigation/resolution.


Note You need to log in before you can comment on or make changes to this bug.