Ubuntu
bash package

bash crashes often if inputrc contains revert-all-at-newline

Bug #1422795 reported by Sven Mueller on 2015-02-17

This bug affects 5 people

	Status	Importance	Assigned to
bash (Debian)	Fix Released	Unknown	debbugs #747341
bash (Ubuntu)	Fix Released	High	Unassigned
Trusty	Fix Released	High	Unassigned

Bug Description

Debian bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=747341
The Debian bug includes complete reproduction case. Basically:
with .inputrc containing
set revert-all-at-newline On

Go back in the commandline history, edit a command, then submit a different command (may be empty)
Such as:
$ ls something
$ <UP><CTRL+W><DOWN><ENTER>

Attached diff is confirmed to fix the issue.

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: bash 4.3-7ubuntu1.5 [origin: goobuntu-trusty-testing-desktop]
ProcVersionSignature: Ubuntu 3.13.0-44.73-generic 3.13.11-ckt12
Uname: Linux 3.13.0-44-generic x86_64
NonfreeKernelModules: nvidia
ApportVersion: 2.14.1-0ubuntu3.6
Architecture: amd64
CurrentDesktop: X-Cinnamon
Date: Tue Feb 17 15:49:30 2015
SourcePackage: bash
UpgradeStatus: No upgrade log present (probably fresh install)
modified.conffile..etc.bash.bashrc: [modified]
mtime.conffile..etc.bash.bashrc: 2015-01-27T03:27:18.751405

[Test Case]

Adapted from the Debian bug report:

1. echo "set revert-all-at-newline on" > bug.inputrc
2. INPUTRC=bug.inputrc bash
3. echo hello
4. ^P^U^N^M [Hold down control and type "punm".]

Bash should die immediately with SIGABRT.

[Regression Potential]

Relatively low.

The change has no effect at all unless _rl_revert_all_lines() is called,
which only happens if revert-all-at-newline is set, and then only when a
newline is typed. So, the potential for regression is essentially zero for
non-interactive shells and for anyone not using revert-all-at-newline (which
is not the default).

Further, this change appeared upstream and in both Debian and Ubuntu over
a year ago, so it's had plenty of public testing.

lib/readline/misc.c:_rl_revert_all_lines() contains a loop which iterates
over history entries, reverting changes to each history entry. This patch
causes entry->data, which points to the per-entry undo list, to be cleared
before reverting edits rather than after. At first glance, this shouldn't
make any difference. However, it prevents rl_do_undo() from replacing the
history entry with one reflecting the change. Otherwise, the entry gets
freed, leaving _rl_revert_all_lines() with an invalid pointer.

_Not_ having an invalid pointer and double-free certainly can't be worse
than the current situation. Since we're avoiding is making the pointer
invalid rather than not doing the free, the chance of a new leak is pretty
much nonexistent.

See original description

Tags:

Revision history for this message

Sven Mueller (smu-u) wrote on 2015-02-17:

Appropriate patch from Debian package Edit (1.6 KiB, text/x-diff)
Dependencies.txt Edit (1.3 KiB, text/plain; charset="utf-8")
ProcEnviron.txt Edit (101 bytes, text/plain; charset="utf-8")

Revision history for this message

Sven Mueller (smu-u) wrote on 2015-02-17:

Note that the odd origin is due to the way we mirror. The package is the (unmodified) 4.3-7ubuntu1.5 package as distributed in Ubuntu.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2015-03-22:

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in bash (Ubuntu):
status:	New → Confirmed

Sven Mueller (smu-u) on 2015-07-14

tags:	added: patch
tags:	added: patch-accepted-debian

Revision history for this message

Margarita Manterola (marga-9) wrote on 2015-07-14:

This bug is pretty annoying for users that have this setting, and the patch is quite simple (just moving one line of code). Can this please get patched on Trusty?

Revision history for this message

Jeffrey Hutzelman (jhutz) wrote on 2015-10-16:

This was reported to the bug-bash mailing list and has been fixed upstream, but there doesn't appear to be a bug tracker.

Revision history for this message

Jeffrey Hutzelman (jhutz) wrote on 2015-10-16:

debdiff containing the upstream patch Edit (2.5 KiB, text/plain)

This was fixed in 4.3-8 and so is already fixed in utopic and later. It will require an SRU to fix in trusty. I've attached a debdiff containing the needed change.

description:

updated

Bug Watch Updater (bug-watch-updater) on 2015-10-16

Changed in bash (Debian):
status:	Unknown → Fix Released

Mathew Hodson (mhodson) on 2015-11-03

Changed in bash (Ubuntu):
importance:	Undecided → High
status:	Confirmed → Fix Released
affects:	gnubash → ubuntu-translations
no longer affects:	ubuntu-translations

Revision history for this message

Jeffrey Hutzelman (jhutz) wrote on 2016-02-01:

It seems like the ball has been dropped on this, possibly by me. Is there something I need to do to get someone to upload a new version using the debdiff I provided?

Revision history for this message

Jeffrey Hutzelman (jhutz) wrote on 2016-02-05:

For those who can't wait, I've built a version with this fix in my PPA.

Revision history for this message

Sven Mueller (smu-u) wrote on 2016-11-01:

So what can be done to get a version with this fix into Trusty?

Revision history for this message

Philipp Kern (pkern) wrote on 2016-11-03:

#10

https://launchpadlibrarian.net/221500232/bash-readline-revert.debdiff should still be valid to apply to bash as-is on trusty and the problem has been fixed in utopic and up already. Thanks to Laney to accept the bug nomination, which finally caused this bug to enter the sponsoring queue (http://reqorts.qa.ubuntu.com/reports/sponsoring/index.html).

Mathew Hodson (mhodson) on 2016-11-05

Changed in bash (Ubuntu Trusty):
importance:	Undecided → High

Philipp Kern (pkern) on 2016-11-05

Changed in bash (Ubuntu Trusty):
status:	New → Confirmed

Julian Andres Klode (juliank) on 2016-11-15

Changed in bash (Ubuntu Trusty):
status:	Confirmed → In Progress

Revision history for this message

Brian Murray (brian-murray) wrote on 2016-11-17: Please test proposed package

#11

Hello Sven, or anyone else affected,

Accepted bash into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/bash/4.3-7ubuntu1.6 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in bash (Ubuntu Trusty):
status:	In Progress → Fix Committed
tags:	added: verification-needed

Revision history for this message

Sven Mueller (smu-u) wrote on 2016-11-18:

#12

I can confirm that 4.3-7ubuntu1.6 fixes the issue.

While the reproduction steps from the Debian bug report (enable revert-all-at-newline, run bash, "echo something"+RETURN, CTRL-P, CTRL-U, CTRL-N, ENTER) reliably crash 4.3-7unbuntu1.5, they don't crash 4.3-7ubuntu1.6

Philipp Kern (pkern) on 2016-11-18

tags:

added: verification-done
removed: verification-needed

Revision history for this message

Julian Andres Klode (juliank) wrote on 2016-11-18:

#13

Failed to build on arm64:

../.././builtins/../.././builtins/help.def: In function 'help_builtin':
../.././builtins/../.././builtins/help.def:130:7: error: format not a string literal and no format arguments [-Werror=format-security]

Julian Andres Klode (juliank) on 2016-11-22

tags:

added: verification-failed
removed: verification-done

Revision history for this message

Julian Andres Klode (juliank) wrote on 2016-11-22:

#14

The build failure on arm64 is tracked in bug 1644048 now. Moving this to in progress again, until we figured out why it fails (or rather why it does not fail on most platforms) and fixed it.

Changed in bash (Ubuntu Trusty):
status:	Fix Committed → In Progress

Revision history for this message

Julian Andres Klode (juliank) wrote on 2016-11-23:

#15

Turns out it does not build on arm64 because the internal gettext is used because binutils (ld) crashes during the configure test for the static build.

That's tracked in bug 1644363 and this SRU basically has to wait for that to get fixed...

Revision history for this message

Julian Andres Klode (juliank) wrote on 2017-04-25:

#16

I just fixed the binutils bug I think, and it's in the queue for trusty. Just Googled for "segfault iterative_hash" and that turned up a patch ... So I think this should build on arm64 again soon.

Revision history for this message

Julian Andres Klode (juliank) wrote on 2017-05-02:

#17

Marking as verification-done again, now that we fixed the build failure on arm64.

tags:

added: verification-done
removed: verification-failed

Revision history for this message

Launchpad Janitor (janitor) wrote on 2017-05-04:

#18

This bug was fixed in the package bash - 4.3-7ubuntu1.6

---------------
bash (4.3-7ubuntu1.6) trusty-proposed; urgency=medium

  * When the readline `revert-all-at-newline' option is set, pressing newline
    when the current line is one retrieved from history results in a double
    free and a segmentation fault. LP: #1422795.

-- Jeffrey Hutzelman <email address hidden> Fri, 16 Oct 2015 17:21:23 -0400

Changed in bash (Ubuntu Trusty):
status:	In Progress → Fix Released

Revision history for this message

Brian Murray (brian-murray) wrote on 2017-05-04: Update Released

#19

The verification of the Stable Release Update for bash has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.