Bug 951391

Created attachment 734607 [details]
ps_procps-ng-3.3.7-1.el7.x86_64_core.20031.bz2

# gdb /bin/ps core.20031 
GNU gdb (GDB) Red Hat Enterprise Linux (7.5.91.20130402-15.el7)
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/ps...Reading symbols from /usr/lib/debug/usr/bin/ps.debug...done.
done.
[New LWP 20031]
Core was generated by `ps -p 20030'.
Program terminated with signal 11, Segmentation fault.
#0  __strrchr_sse42 () at ../sysdeps/x86_64/multiarch/strrchr.S:112
112		movdqa	(%r8), %xmm0
(gdb) bt full
#0  __strrchr_sse42 () at ../sysdeps/x86_64/multiarch/strrchr.S:112
No locals.
#1  0x00007ffb451c6e85 in stat2proc (S=0x1 <Address 0x1 out of bounds>, P=P@entry=0x615760 <buf.6243>) at readproc.c:476
        num = <optimized out>
        tmp = <optimized out>
#2  0x00007ffb451c83e6 in simple_readproc (PT=0x1f92570, p=0x615760 <buf.6243>) at readproc.c:774
        ub = {buf = 0x1f9a650 "", siz = 4096}
        sb = {st_dev = 3, st_ino = 488760, st_nlink = 8, st_mode = 16749, st_uid = 0, st_gid = 0, __pad0 = 0, st_rdev = 0, 
          st_size = 0, st_blksize = 1024, st_blocks = 0, st_atim = {tv_sec = 1365753789, tv_nsec = 49519444}, st_mtim = {
            tv_sec = 1365753789, tv_nsec = 49519444}, st_ctim = {tv_sec = 1365753789, tv_nsec = 49519444}, __unused = {0, 0, 0}}
        path = 0x1f925d0 "/proc/20030"
        flags = 96
#3  0x00007ffb451c8a9a in readproc (PT=PT@entry=0x1f92570, p=p@entry=0x615760 <buf.6243>) at readproc.c:1077
        ret = <optimized out>
        saved_p = 0x615760 <buf.6243>
#4  0x0000000000402b06 in simple_spew () at display.c:354
        ptp = 0x1f92570
        buf = {tid = 20030, ppid = 0, maj_delta = 0, min_delta = 0, pcpu = 0, state = 0 '\000', pad_1 = 0 '\000', pad_2 = 0 '\000', 
          pad_3 = 0 '\000', utime = 0, stime = 0, cutime = 0, cstime = 0, start_time = 0, signal = '\000' <repeats 17 times>, 
          blocked = '\000' <repeats 17 times>, sigignore = '\000' <repeats 17 times>, sigcatch = '\000' <repeats 17 times>, 
          _sigpnd = '\000' <repeats 17 times>, start_code = 0, end_code = 0, start_stack = 0, kstk_esp = 0, kstk_eip = 0, 
          wchan = 0, priority = 0, nice = 0, rss = 0, alarm = 0, size = 0, resident = 0, share = 0, trs = 0, lrs = 0, drs = 0, 
          dt = 0, vm_size = 0, vm_lock = 0, vm_rss = 0, vm_data = 0, vm_stack = 0, vm_swap = 0, vm_exe = 0, vm_lib = 0, 
          rtprio = 18446744073709551615, sched = 18446744073709551615, vsize = 0, rss_rlim = 0, flags = 0, min_flt = 0, 
          maj_flt = 0, cmin_flt = 0, cmaj_flt = 0, environ = 0x0, cmdline = 0x0, cgroup = 0x0, supgid = 0x0, supgrp = 0x0, 
          euser = '\000' <repeats 19 times>, ruser = '\000' <repeats 19 times>, suser = '\000' <repeats 19 times>, 
          fuser = '\000' <repeats 19 times>, rgroup = '\000' <repeats 19 times>, egroup = '\000' <repeats 19 times>, 
          sgroup = '\000' <repeats 19 times>, fgroup = '\000' <repeats 19 times>, cmd = '\000' <repeats 15 times>, ring = 0x0, 
          next = 0x0, pgrp = 0, session = 0, nlwp = 0, tgid = 20030, tty = 0, euid = 0, egid = 0, ruid = 0, rgid = 0, suid = 0, 
          sgid = 0, fuid = 0, fgid = 0, tpgid = 0, exit_signal = 0, processor = 0}
        buf2 = {tid = 0, ppid = 0, maj_delta = 0, min_delta = 0, pcpu = 0, state = 0 '\000', pad_1 = 0 '\000', pad_2 = 0 '\000', 
          pad_3 = 0 '\000', utime = 0, stime = 0, cutime = 0, cstime = 0, start_time = 0, signal = '\000' <repeats 17 times>, 
          blocked = '\000' <repeats 17 times>, sigignore = '\000' <repeats 17 times>, sigcatch = '\000' <repeats 17 times>, 
          _sigpnd = '\000' <repeats 17 times>, start_code = 0, end_code = 0, start_stack = 0, kstk_esp = 0, kstk_eip = 0, 
          wchan = 0, priority = 0, nice = 0, rss = 0, alarm = 0, size = 0, resident = 0, share = 0, trs = 0, lrs = 0, drs = 0, 
          dt = 0, vm_size = 0, vm_lock = 0, vm_rss = 0, vm_data = 0, vm_stack = 0, vm_swap = 0, vm_exe = 0, vm_lib = 0, rtprio = 0, 
          sched = 0, vsize = 0, rss_rlim = 0, flags = 0, min_flt = 0, maj_flt = 0, cmin_flt = 0, cmaj_flt = 0, environ = 0x0, 
          cmdline = 0x0, cgroup = 0x0, supgid = 0x0, supgrp = 0x0, euser = '\000' <repeats 19 times>, 
          ruser = '\000' <repeats 19 times>, suser = '\000' <repeats 19 times>, fuser = '\000' <repeats 19 times>, 
          rgroup = '\000' <repeats 19 times>, egroup = '\000' <repeats 19 times>, sgroup = '\000' <repeats 19 times>, 
---Type <return> to continue, or q <return> to quit---
          fgroup = '\000' <repeats 19 times>, cmd = '\000' <repeats 15 times>, ring = 0x0, next = 0x0, pgrp = 0, session = 0, 
          nlwp = 0, tgid = 0, tty = 0, euid = 0, egid = 0, ruid = 0, rgid = 0, suid = 0, sgid = 0, fuid = 0, fgid = 0, tpgid = 0, 
          exit_signal = 0, processor = 0}
#5  main (argc=3, argv=<optimized out>) at display.c:592
No locals.

I think following commit fixed the issue in upstream:

commit 526bc5dfa924177e68be0123bd67e3370955f924
Author: Jim Warner <james.warner>
Date:   Sat Mar 30 00:00:00 2013 -0500
    library: avoid SEGV if file2str should read zero bytes

Ahoj Honzo.

I'm just building a new release.
Thanks for the report.

Regards, Jaromir.

Please, test procps-ng-3.3.7-3.el7 ...

Thx,
J.

Works OK for me. Here's a better reproducer:

# rpm -qa procps-ng
procps-ng-3.3.7-1.el7.x86_64.rpm

# cat hook_open.c
-----------------------------------------------------------------------
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

// gcc -Wall -fPIC -shared -o hook_open.so hook_open.c

int open(const char *pathname, int flags, mode_t mode)
{
	if (strcmp(pathname, "/proc/1/stat") == 0) {
		printf("%s\n", pathname);
		return syscall(SYS_open, "/tmp/empty", flags, mode);
	}
	return syscall(SYS_open, pathname, flags, mode);
}
-----------------------------------------------------------------------

# touch /tmp/empty 
# LD_PRELOAD=./hook_open.so ps
/proc/1/stat
Signal 11 (SEGV) caught by ps (procps-ng version 3.3.7).
ps:display.c:66: please report this bug
Segmentation fault

# yum localupdate procps-ng-3.3.7-3.el7.x86_64.rpm
# touch /tmp/empty 
# LD_PRELOAD=./hook_open.so ps
/proc/1/stat
  PID TTY          TIME CMD
 4893 pts/1    00:00:00 ps
31826 pts/1    00:00:00 bash