Re: [PATCH] lastpipe: SIGCHLD during append_process walks a half-linked job ring (segfault)

[Chet Ramey]

On 9/23/26 8:24 AM, Markus Wangler wrote:

Bash Version: 5.3
Patch Level: 15
Release Status: release

Description:
         With lastpipe enabled and job control off, execute_pipeline()
         unblocks SIGCHLD (execute_cmd.c, UNBLOCK_CHILD just before the
         lastpipe_flag block) and then calls append_process() to link a
         dummy PROCESS for the last element into jobs[jid]->pipe.
         append_process() does that with SIGCHLD deliverable and in this
         order:

             p->next = t;                  /* t reachable, t->next == NULL */
             t->next = jobs[jid]->pipe;

         alloc_process() sets t->next to NULL. If SIGCHLD arrives between
         the two stores, sigchld_handler -> waitchld ->
         set_job_status_and_cleanup walks the ring with child = child->next,
         reaches the NULL link, and faults reading child->running
         (si_addr 0x10).

         The other ring mutators in jobs.c already run with SIGCHLD
         blocked (add_process under BLOCK_CHILD; rotate_the_pipeline and
         reverse_the_pipeline document "Must be called with SIGCHLD
         blocked"). append_process is the exception. It also does
         js.c_reaped++ without the signal blocked, and waitchld updates
         the same counter.

Thanks for the report and careful analysis.

Chet

--
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, UTech, CWRU    c...@case.edu    http://tiswww.cwru.edu/~chet/

OpenPGP_signature.asc
Description: OpenPGP digital signature