Bash crashes on autocompletion of directories with broken nfs mountpoints.

[Bart Polot]

Configuration Information [Automatically generated, do not change]:
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='x86_64'
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='x86_64-unknown-linux-gnu'
-DCONF_VENDOR='unknown' -DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash'
-DSHELL -DHAVE_CONFIG_H   -I.  -I. -I./include -I./lib
-D_FORTIFY_SOURCE=2 -march=x86-64 -mtune=generic -O2 -pipe
-fstack-protector-strong --param=ssp-buffer-size=4
-DDEFAULT_PATH_VALUE='/usr/local/sbin:/usr/local/bin:/usr/bin'
-DSTANDARD_UTILS_PATH='/usr/bin' -DSYS_BASHRC='/etc/bash.bashrc'
-DSYS_BASH_LOGOUT='/etc/bash.bash_logout'
uname output: Linux ranger 3.14.51-1-lts #1 SMP Mon Aug 17 19:21:08 CEST
2015 x86_64 GNU/Linux
Machine Type: x86_64-unknown-linux-gnu

Bash Version: 4.3
Patch Level: 39
Release Status: release

Description:

        First bash crashed while trying to cancel the autocomplete of
        the contents of a directory which included an unavailable nfs
        mountpoint (/mnt/nfs):

        1. Mount NFS volume on /mnt/nfs while on wifi
        2. Plugged ethernet cable
        3. NFS volume is not available, must [force] unmount
        4. Type "umount /mnt/<TAB>" to autocomplete
        5. System tries to read directories again, takes a lot of time
        6. Press <Ctrl+C> repeatedly to cancel autocompletion.
        7. Bash succeds in showing the subdirectories of /mnt, but then
           crashes


        # umount -f /mnt/<TAB><Ctrl+C><Ctrl+C><Ctrl+C><Ctrl+C>
        iso/ nfs  usb/
        # umount -f /mnt/^C*** Error in `-bash': double free or
corruption (fasttop): 0x0000000000e6a160 ***
        [ see attached trace1 for details ]


Repeat-By:

        Does not always happen exactly like this, but this situation
        (broken nfs mount) allows to trigger bash to crash:

        # umount /mnt/<TAB>
        iso/ nfs  usb/
        # umount /mnt/^C^C [no crash]
        # ls /mn<TAB>*** Error in `-bash': corrupted double-linked list:
0x000000000241c440 ***
        [ see attached trace2 for details ]

-- 
Bart Polot

trace1
Description: Text document

trace2
Description: Text document

signature.asc
Description: OpenPGP digital signature