uutils/coreutils

tac crashes with SIGBUS when input file is truncated during read

Open

#9,748 创建于 2025年12月20日

在 GitHub 查看
 (1 评论) (0 反应) (0 负责人)Rust (23,246 star) (1,852 fork)batch import
U - tacgood first issuereported-canonical

描述

Component

tac

Description

The tac utility crashes with "Bus error (core dumped)" when an input file is truncated while being read. This happens because tac uses memory-mapped I/O (mmap with MAP_SHARED) without installing a SIGBUS signal handler.

When a mapped file is truncated, subsequent access to the now-invalid memory region triggers SIGBUS. The SAFETY comments in the code acknowledge this behavior but treat process termination as acceptable. GNU tac handles this gracefully by avoiding direct memory mapping of untrusted input sources.

Test / Reproduction Steps

dd if=/dev/zero of=/tmp/tactest bs=1M count=10 2>/dev/null
(sleep 0.001; truncate -s 0 /tmp/tactest) &
tac /tmp/tactest

Impact

Denial of Service: This is particularly problematic for log rotation scenarios where tac might be reading logs that get truncated

贡献者指南

技术栈
rust
领域
cli
议题类型
bug
难度面向新贡献者的预计实现难度，1 表示很小改动，5 表示专家级工作。
3
预计时间有经验贡献者完成调查、实现、测试并准备 pull request 的粗略时间范围。
half day
活动状态议题当前的可参与程度：新鲜、活跃、陈旧、阻塞或等待维护者输入。
fresh
清晰度议题是否清楚说明期望改动、验收标准和下一步。
clear
前置要求
Rust basicssignal handling
新手友好度1-100 的估计分数，表示该议题对首次贡献者的友好程度。
70
研究方向
Examine the tac source in `src/uu/tac/src/tac.rs`. The code uses `mmap` with `MAP SHARED`; adding a SIGBUS handler or switching to a read based approach when truncation is detected could fix the issue. Consider following GNU tac's approach of not using mmap for untrusted inputs. Check existing PRs or comments for guidance.