uutils/coreutils

tac crashes with SIGBUS when input file is truncated during read

Open

#9748 opened on Dec 20, 2025

View on GitHub
 (1 comment) (0 reactions) (0 assignees)Rust (23,246 stars) (1,852 forks)batch import
U - tacgood first issuereported-canonical

Description

Component

tac

Description

The tac utility crashes with "Bus error (core dumped)" when an input file is truncated while being read. This happens because tac uses memory-mapped I/O (mmap with MAP_SHARED) without installing a SIGBUS signal handler.

When a mapped file is truncated, subsequent access to the now-invalid memory region triggers SIGBUS. The SAFETY comments in the code acknowledge this behavior but treat process termination as acceptable. GNU tac handles this gracefully by avoiding direct memory mapping of untrusted input sources.

Test / Reproduction Steps

dd if=/dev/zero of=/tmp/tactest bs=1M count=10 2>/dev/null
(sleep 0.001; truncate -s 0 /tmp/tactest) &
tac /tmp/tactest

Impact

Denial of Service: This is particularly problematic for log rotation scenarios where tac might be reading logs that get truncated

Contributor guide

Tech stack
rust
Domain
cli
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Rust basicssignal handling
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70
Research direction
Examine the tac source in `src/uu/tac/src/tac.rs`. The code uses `mmap` with `MAP SHARED`; adding a SIGBUS handler or switching to a read based approach when truncation is detected could fix the issue. Consider following GNU tac's approach of not using mmap for untrusted inputs. Check existing PRs or comments for guidance.