Re: Bug#375333: coreutils: rm -rf segfaults when open(".") fails

[Jim Meyering]

Marc Lehmann <address@hidden> wrote:
> Package: coreutils
> Version: 5.96-3
> Severity: minor
>
> autofs often fucks up my system. In such a case, I tried to:
>
>    # rm -rf /fs/doom # autofs mountpoint
>    Segmentation fault
>
> strace shows:
>
>    chdir("/fs/doom")                       = 0
>    lstat(".", {st_mode=S_IFDIR|0555, st_size=0, ...}) = 0
>    open(".", O_RDONLY|O_NONBLOCK|O_DIRECTORY) = -1 ENOENT (No such file or 
> directory)
>    --- SIGSEGV (Segmentation fault) @ 0 (0) ---
>
> And gdb shows a segfault in readdir64.
>
> So I assume rm doesn't check the result of opendir or something similar.

Thank you for the fine bug report.
Here's a patch for remove.c on the coreutils stable branch.
FYI, on the trunk, that file has been rewritten, and appears not
to have this bug.

2006-06-25  Jim Meyering  <address@hidden>

        Avoid a segfault from `rm -rf /some/dir' when that directory
        is in an unusual state (where open(".",...) fails with ENOENT),.
        * src/remove.c (remove_cwd_entries): If opendir fails, ensure
        there is no way to call readdir with a NULL pointer.
        Reported by Marc Lehmann in <http://bugs.debian.org/375333>.


Index: src/remove.c
===================================================================
RCS file: /fetish/cu/src/remove.c,v
retrieving revision 1.132.2.2
diff -u -p -r1.132.2.2 remove.c
--- src/remove.c        6 May 2006 21:12:06 -0000       1.132.2.2
+++ src/remove.c        25 Jun 2006 19:23:35 -0000
@@ -1,5 +1,5 @@
 /* remove.c -- core functions for removing files and directories
-   Copyright (C) 88, 90, 91, 1994-2005 Free Software Foundation, Inc.
+   Copyright (C) 88, 90, 91, 1994-2006 Free Software Foundation, Inc.
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -881,12 +881,9 @@ remove_cwd_entries (Dirstack_state *ds, 
 
   if (dirp == NULL)
     {
-      if (errno != ENOENT || !x->ignore_missing_files)
-       {
-         error (0, errno, _("cannot open directory %s"),
-                quote (full_filename (".")));
-         return RM_ERROR;
-       }
+      error (0, errno, _("cannot open directory %s"),
+            quote (full_filename (".")));
+      return RM_ERROR;
     }
 
   while (1)