Red Hat Bugzilla – Bug 922851
exec a script causes a fork bomb when receiving SIGTSTP
Last modified: 2013-11-21 05:54:29 EST
Description of problem:
Calling a subshell within a script started by exec can cause the exec'ed script to call itself indefinitely, much like a fork bomb.
Note: be careful with the test case, as it may make your system unstable.
Version-Release number of selected component (if applicable):
100% of the time
Steps to Reproduce:
1. Create an executable file "foo" with the following two strings:
$ cat /root/foo
# Comment needed to trigger the bomb
2. Start a KSH session and exec the foo script:
$ exec /root/foo
3. You are now in a VI session. Send the TSTP signal to VI using CTRL-Z, close VI using :q.
/root/foo spawns itself as a child until it hits the nproc limit and is unable to fork any more processes.
The VI session drops to the background and can be recalled using "fg".
Unable to reproduce using bash. Still reproduces using the updated KSH RPM's from bug https://bugzilla.redhat.com/show_bug.cgi?id=892206
Some more information on how the processes look:
$ ps -ef --forest
root 4741 1 0 20:11 pts/0 00:00:00 /root/foo
root 4742 4741 0 20:11 pts/0 00:00:00 \_ /root/foo
root 4743 4742 0 20:11 pts/0 00:00:00 \_ /root/foo
root 4744 4743 0 20:11 pts/0 00:00:00 \_ /root/foo
root 4745 4744 0 20:11 pts/0 00:00:00 \_ /root/foo
thanks for reporting
Reproduces in RHEL6 as well:
$ ksh --version
version sh (AT&T Research) 93t+ 2010-06-21
$ rpm -qa |grep ksh
On RHEL6 the script sometimes gives a Memory fault without spawning unlimited childs:
$ exec /root/foo
/root/foo: line 1: 0:
/root/foo: line 1: 2396: Memory fault
There is already another ksh fork bomb bug reported for RHEL5 - bug #910923
Instead of closing this as a duplicate, I'll use it for tracking this bug in RHEL6
I'm not authorized to see that bug, I guess that is why it missed the search.
Any details on the bug (hunting) yet?
(In reply to comment #5)
> Any details on the bug (hunting) yet?
We have patch ready for next update
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.