uutils/coreutils

tac crashes with SIGBUS when input file is truncated during read

Open

#9,748 opened on 2025年12月20日

GitHub で見る
 (1 comment) (0 reactions) (0 assignees)Rust (23,246 stars) (1,852 forks)batch import
U - tacgood first issuereported-canonical

説明

Component

tac

Description

The tac utility crashes with "Bus error (core dumped)" when an input file is truncated while being read. This happens because tac uses memory-mapped I/O (mmap with MAP_SHARED) without installing a SIGBUS signal handler.

When a mapped file is truncated, subsequent access to the now-invalid memory region triggers SIGBUS. The SAFETY comments in the code acknowledge this behavior but treat process termination as acceptable. GNU tac handles this gracefully by avoiding direct memory mapping of untrusted input sources.

Test / Reproduction Steps

dd if=/dev/zero of=/tmp/tactest bs=1M count=10 2>/dev/null
(sleep 0.001; truncate -s 0 /tmp/tactest) &
tac /tmp/tactest

Impact

Denial of Service: This is particularly problematic for log rotation scenarios where tac might be reading logs that get truncated

コントリビューターガイド

技術スタック
rust
領域
cli
Issue 種別
bug
難度新しい貢献者にとっての実装難度です。1 は非常に小さな変更、5 は専門的な作業です。
3
推定時間経験ある貢献者が調査、実装、テスト、pull request 準備にかけるおおよその時間範囲です。
half day
活動状況Issue が今どれだけ取り組みやすいかを示します。新しい、活発、古い、ブロック中、またはメンテナー入力待ちなどです。
fresh
明確さ期待される変更、受け入れ条件、次の手順がどれだけ明確かを示します。
clear
前提条件
Rust basicssignal handling
初心者向け度初回貢献者にどれだけ取り組みやすいかを 1-100 で推定したスコアです。
70
調査方針
Examine the tac source in `src/uu/tac/src/tac.rs`. The code uses `mmap` with `MAP SHARED`; adding a SIGBUS handler or switching to a read based approach when truncation is detected could fix the issue. Consider following GNU tac's approach of not using mmap for untrusted inputs. Check existing PRs or comments for guidance.
tac crashes with SIGBUS when input file is truncated during read · uutils/coreutils#9748 | Good First Issue