SIGSEGV in GNU bash, version 5.1.4(1)-release (sparc-sun-solaris2.10)

[Dennis Clarke]

Firstly as a minor nit that seems to re-appear yearly there are still
source files in the release tarballs that are not readable to a normal
user :

#
#  find . -ls | grep '\-\-\-'
7348095   24 -rw------- 1 286 staff 38962 Jul  8 14:19 ./lib/malloc/malloc.c
7347442    1 -rw------- 1 286 staff   226 May 29  2020 ./tests/varenv20.sub
#
# chmod 644 ./lib/malloc/malloc.c  ./tests/varenv20.sub

Trivial but annoyed as it throws the compile process out the window on
the first initial pass.  Otherwise all goes well until we try to use the
resultant bash binary.

I was very surprised to see :

alpha $
alpha $ dbx /opt/bw/bin/bash
node_alpha-host_sun4u-zone_z_003-time_1609232628-pid_10009-uid_16411-gid_20002-fid_bash.core
Reading bash
core file header read successfully
Reading ld.so.1
Reading libreadline.so.8
Reading libhistory.so.8
Reading libcurses.so.2
Reading libintl.so.8.1.7
Reading libiconv.so.2.6.1
Reading libsocket.so.1
Reading libnsl.so.1
Reading libdl.so.1
Reading libc.so.1
Reading libc_psr.so.1
Reading en_US.UTF-8.so.3
Reading methods_unicode.so.3
program terminated by signal SEGV (Segmentation Fault)
0xffffffff7dbdc658: _kill+0x0008:       blu      __cerror       !
0xffffffff7db2f2e4
Current function is termsig_handler
  617     kill (getpid (), sig);
(dbx) where


  [1] _kill(0x0, 0xb, 0xb, 0x0, 0x0, 0x0), at 0xffffffff7dbdc658
=>[2] termsig_handler(sig = 11), line 617 in "sig.c"
  [3] termsig_sighandler(sig = 11), line 539 in "sig.c"
  [4] __sighndlr(0xb, 0x0, 0xffffffff7fffe930, 0x1000d7de0, 0x0, 0xa),
at 0xffffffff7dbd8d6c
  ---- called from signal handler with signal 11 (SIGSEGV) ------
  [5] tgetent(0x0, 0x1002af010, 0x116078, 0x0, 0xffffffff7ea28000,
0xffffffff7ea30528), at 0xffffffff7e911fa4
  [6] _rl_init_terminal_io(terminal_name = (nil)), line 483 in "terminal.c"
  [7] _rl_set_screen_size(rows = 43, cols = 132), line 323 in "terminal.c"
  [8] rl_set_screen_size(rows = 43, cols = 132), line 341 in "terminal.c"
  [9] get_new_window_size(from_sig = 0, rp = (nil), cp = (nil)), line 90
in "winsize.c"
  [10] get_tty_state(), line 2510 in "jobs.c"
  [11] initialize_job_control(force = 0), line 4522 in "jobs.c"
  [12] shell_initialize(), line 1951 in "shell.c"
  [13] main(argc = 1, argv = 0xffffffff7ffff618, env =
0xffffffff7ffff628), line 572 in "shell.c"
(dbx) regs
current frame:  [2]
g0-g1    0x0000000000000000 0x0000000000000025
g2-g3    0x0000000000000000 0x0000000000000000
g4-g5    0x00000001000d7de0 0xffffffffff7fffff
g6-g7    0x0000000000000000 0xffffffff7e100200
o0-o1    0x0000000000000000 0x000000000000000b
o2-o3    0x000000000000000b 0x0000000000000000
o4-o5    0x0000000000000000 0x0000000000000000
o6-o7    0xffffffff7fffdc41 0x00000001000d8344
l0-l1    0x0000000100293d08 0x0000000000000000
l2-l3    0x0000000000000000 0x0000000000000000
l4-l5    0x0000000000000000 0x0000000000000000
l6-l7    0x0000000000000000 0x0000000000000000
i0-i1    0x000000000000000b 0x000000010029754c
i2-i3    0x0000000000000000 0x0000000000000000
i4-i5    0x0000000000000000 0x0000000000000000
i6-i7    0xffffffff7fffdd21 0x00000001000d7ff4
y        0x0000000000000000
ccr      0x0000000000000044
pc       0x00000001000d8344:termsig_handler+0x2c4    call     kill [PLT]
       ! 0x100294ce0
npc      0xffffffff7dbdc65c:_kill+0xc    nop
(dbx)
(dbx) exit
alpha $

This was after a clean compile and all tests from the testsuite passed.
The config.h is attached compressed as :

    bash-5.1_004_sunos5.10_sparcv9.002_config.h.xz


The RUNPATH/RPATH and needed dependencies seemed correct :

alpha $ elfdump -delv bash

ELF Header
  ei_magic:   { 0x7f, E, L, F }
  ei_class:   ELFCLASS64          ei_data:       ELFDATA2MSB
  ei_osabi:   ELFOSABI_SOLARIS    ei_abiversion: EAV_SUNW_CURRENT
  e_machine:  EM_SPARCV9          e_version:     EV_CURRENT
  e_type:     ET_EXEC
  e_flags:    [ EF_SPARCV9_TSO ]
  e_entry:           0x1000210e0  e_ehsize:     64  e_shstrndx:  29
  e_shoff:              0x3b4a08  e_shentsize:  64  e_shnum:     31
  e_phoff:                  0x40  e_phentsize:  56  e_phnum:     5

Version Needed Section:  .SUNW_version
     index  file                        version
       [2]  libsocket.so.1              SUNW_1.1
       [3]                              SUNW_0.7             [ INFO ]
       [4]  libnsl.so.1                 SUNW_0.7
       [5]                              SUNWprivate_1.1
       [6]  libdl.so.1                  SUNW_0.7
       [7]  libc.so.1                   SUNW_1.23
       [8]                              SUNW_1.22.7          [ INFO ]
       [9]                              SUNW_1.22            [ INFO ]
      [10]                              SUNW_1.21.2          [ INFO ]
      [11]                              SUNW_1.21            [ INFO ]
      [12]                              SUNW_1.18            [ INFO ]
      [13]                              SUNW_1.1             [ INFO ]
      [14]                              SUNW_0.9             [ INFO ]
      [15]                              SUNW_0.8             [ INFO ]
      [16]                              SUNW_0.7             [ INFO ]
      [17]                              SUNWprivate_1.1

Dynamic Section:  .dynamic
     index  tag                value
       [0]  NEEDED            0xaada              libreadline.so.8
       [1]  NEEDED            0xaaeb              libhistory.so.8
       [2]  NEEDED            0xaafb              libcurses.so.2
       [3]  NEEDED            0xab0a              libintl.so.8
       [4]  NEEDED            0xab17              libiconv.so.2
       [5]  NEEDED            0xaa36              libsocket.so.1
       [6]  NEEDED            0xaa57              libnsl.so.1
       [7]  NEEDED            0xaa73              libdl.so.1
       [8]  NEEDED            0xaa7e              libc.so.1
       [9]  INIT              0x10017ab78
      [10]  FINI              0x10017ab88
      [11]  RUNPATH           0xab25
/opt/bw/lib:/usr/xpg6/lib/64:/usr/xpg4/lib/64
      [12]  RPATH             0xab25
/opt/bw/lib:/usr/xpg6/lib/64:/usr/xpg4/lib/64
      [13]  HASH              0x100000178
      [14]  STRTAB            0x100012c68
      [15]  STRSZ             0xad53
      [16]  SYMTAB            0x100004c40
      [17]  SYMENT            0x18
      [18]  CHECKSUM          0x987
      [19]  VERNEED           0x10001d9c0
      [20]  VERNEEDNUM        0x4
      [21]  PLTRELSZ          0x1b18
      [22]  PLTREL            0x7
      [23]  JMPREL            0x10001f5c0
      [24]  RELA              0x10001edb0
      [25]  RELASZ            0x2328
      [26]  RELAENT           0x18
      [27]  DEBUG             0
      [28]  FLAGS             0                   0
      [29]  FLAGS_1           0                   0
      [30]  SUNW_STRPAD       0x200
      [31]  SUNW_LDMACH       0x2b                EM_SPARCV9
      [32]  PLTGOT            0x100294000
   [33-43]  NULL              0
alpha $

alpha $
alpha $ ldd bash
        libreadline.so.8 =>      /opt/bw/lib/libreadline.so.8
        libhistory.so.8 =>       /opt/bw/lib/libhistory.so.8
        libcurses.so.2 =>        /usr/xpg4/lib/64/libcurses.so.2
        libintl.so.8 =>  /opt/bw/lib/libintl.so.8
        libiconv.so.2 =>         /opt/bw/lib/libiconv.so.2
        libsocket.so.1 =>        /lib/64/libsocket.so.1
        libnsl.so.1 =>   /lib/64/libnsl.so.1
        libdl.so.1 =>    /lib/64/libdl.so.1
        libc.so.1 =>     /lib/64/libc.so.1
        libmp.so.2 =>    /lib/64/libmp.so.2
        libmd.so.1 =>    /lib/64/libmd.so.1
        libscf.so.1 =>   /lib/64/libscf.so.1
        libdoor.so.1 =>  /lib/64/libdoor.so.1
        libuutil.so.1 =>         /lib/64/libuutil.so.1
        libgen.so.1 =>   /lib/64/libgen.so.1
        libm.so.2 =>     /lib/64/libm.so.2
        /lib/sparcv9/../libm/sparcv9/libm_hwcap1.so.2
        /platform/SUNW,SPARC-Enterprise/lib/sparcv9/libc_psr.so.1
alpha $

I may ask for a version but any attempt to run the shell results in a
SIGSEGV.

alpha $ ./bash --version
GNU bash, version 5.1.4(1)-release (sparc-sun-solaris2.10)
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
alpha $

thankfully I have full coredump files and can single step in to see
where bad things happened :

Looking at winsize.c we see :


void
get_new_window_size (from_sig, rp, cp)
     int from_sig;
     int *rp, *cp;
{
#if defined (TIOCGWINSZ)
  struct winsize win;
  int tty;

  tty = input_tty ();
  if (tty >= 0 && (ioctl (tty, TIOCGWINSZ, &win) == 0) &&
      win.ws_row > 0 && win.ws_col > 0)
    {
      sh_set_lines_and_columns (win.ws_row, win.ws_col);
#if defined (READLINE)
      rl_set_screen_size (win.ws_row, win.ws_col);
      if (rp)
    *rp = win.ws_row;
      if (cp)
    *cp = win.ws_col;
#endif
    }
#endif
}

There we do fall into the #if defined (READLINE) and the call to
rl_set_screen_size (win.ws_row, win.ws_col) does happen. This
will toss us into terminal.c thus :


void
_rl_set_screen_size (int rows, int cols)
{
  if (_rl_term_autowrap == -1)
    _rl_init_terminal_io (rl_terminal_name);

  if (rows > 0)
    _rl_screenheight = rows;
  if (cols > 0)
    {
      _rl_screenwidth = cols;
      if (_rl_term_autowrap == 0)
    _rl_screenwidth--;
    }

  if (rows > 0 || cols > 0)
    _rl_screenchars = _rl_screenwidth * _rl_screenheight;
}

void
rl_set_screen_size (int rows, int cols)
{
  _rl_set_screen_size (rows, cols);
}

rl_terminal_name is NULL and that gets passed onto _rl_init_terminal_io() :


int
_rl_init_terminal_io (const char *terminal_name)
{
  const char *term;
  char *buffer;
  int tty, tgetent_ret, dumbterm;

  term = terminal_name ? terminal_name : sh_get_env_value ("TERM");
  _rl_term_clrpag = _rl_term_cr = _rl_term_clreol = _rl_term_clrscroll =
(char *)NULL;
  tty = rl_instream ? fileno (rl_instream) : 0;

  if (term == 0)
    term = "dumb";

  dumbterm = STREQ (term, "dumb");

#ifdef __MSDOS__
  _rl_term_im = _rl_term_ei = _rl_term_ic = _rl_term_IC = (char *)NULL;
  _rl_term_up = _rl_term_dc = _rl_term_DC = _rl_visible_bell = (char *)NULL;
  _rl_term_ku = _rl_term_kd = _rl_term_kl = _rl_term_kr = (char *)NULL;
  _rl_term_mm = _rl_term_mo = (char *)NULL;
  _rl_terminal_can_insert = term_has_meta = _rl_term_autowrap = 0;
  _rl_term_cr = "\r";
  _rl_term_backspace = (char *)NULL;
  _rl_term_goto = _rl_term_pc = _rl_term_ip = (char *)NULL;
  _rl_term_ks = _rl_term_ke =_rl_term_vs = _rl_term_ve = (char *)NULL;
  _rl_term_kh = _rl_term_kH = _rl_term_at7 = _rl_term_kI = (char *)NULL;
  _rl_term_so = _rl_term_se = (char *)NULL;
#if defined(HACK_TERMCAP_MOTION)
  _rl_term_forward_char = (char *)NULL;
#endif


For reasons that I can not yet figure out sh_get_env_value ("TERM") is
not returning "xterm" or "vt100" or whatever I have in the env var and
we don't seem to get "dumb" either.

Anyways I am trying to dig into that.


-- 
Dennis Clarke
RISC-V/SPARC/PPC/ARM/CISC
UNIX and Linux spoken
GreyBeard and suspenders optional

bash-5.1_004_sunos5.10_sparcv9.002_config.h.xz
Description: application/xz