bugThe GNU Bourne-Again SHell - Bugs: bug #67546, Crash on `exec 2> >(:)` +...

 
 

bug #67546: Crash on `exec 2> >(:)` + SIGINT

Submitter:  Dennis Marttinen <twelho>
Submitted:  Tue 23 Sep 2025 08:38:19 PM UTC
   
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  Invalid Privacy:  Public
Assigned to:  None Open/Closed:  Open
* Mandatory Fields

Post a Comment

Add a New Comment Rich Markup
   

Discussion

Sat 27 Sep 2025 11:52:17 AM UTC, comment #2: 

All clear, thanks for the explanation! So in my test case it's not the SIGINT signal itself, but probably the prior printing of "^C" to stderr by bash that triggers the behavior.

I did also manage to replicate the same behavior with busybox when it's not running as PID 1. For bash, being PID 1 doesn't change the behavior.

Dennis Marttinen <twelho>
Tue 23 Sep 2025 08:55:06 PM UTC, comment #1: 

This isn't a crash, nor is it a bug.

exec 2> >(:)

permanently changes the file descriptor that bash uses for prompting, readline redisplay, and error output (stderr) to a pipe with no reader.

The next time bash tries to write to the pipe (an fflush on stderr will do), it gets SIGPIPE (write on a pipe with no reader). It doesn't take ^C, a return will do.

SIGPIPE is a fatal signal, so the shell exits.

Chet Ramey <chet>
Group administrator
Tue 23 Sep 2025 08:38:19 PM UTC, original submission:  

Running `exec 2> >(:)` (or `exec 2> <(:)`) in an interactive shell and then issuing SIGINT (or Ctrl+C) to that shell crashes bash:

$ bash --version
GNU bash, version 5.3.3(1)-release (x86_64-pc-linux-gnu)

$ exec 2> >(:)
<Issuing SIGINT through Ctrl+C>

Warning: Program '/bin/bash' crashed.

Tested locally as well as through SSH, in which case the connection is abruptly closed. Above tests conducted in Konsole on Arch Linux, with the issue also replicated on Ubuntu 22.04.3 LTS, Ubuntu 24.04.3 LTS, Fedora 42 and Termux (Android).

`:` can be replaced with almost any binary, with the notable exception of `cat`, which causes the command to return immediately. Interestingly, the `read` binary still triggers the bug, despite its stdin similarity to `cat`.

GDB traces indicate multiple SIGPIPEs and an eventual somewhat controlled invocation of kill_shell. Some backtraces attached as gdb.txt.

For comparison, BusyBox v1.37.0 (Alpine Linux) does not crash, but also ignores SIGINT. This matches for example `exec 2> :` in both shells.

Dennis Marttinen <twelho>

 

Attached Files

Attached Files
file #57681:  gdb.txt added by twelho (8.6KiB - text/plain)

(Note: upload size limit is set to 4.0MiB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Dependencies

This item does not depend on any other items.

No items depend on this one.

 

Mail Notification Carbon-Copy List

Carbon-Copy List
  • -email is unavailable- added by chet (Posted a comment)
  • -email is unavailable- added by twelho (Submitted the item)
  •  

    Votes

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

    History

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2025-09-23 chet StatusNone Invalid
    2025-09-23 twelho Attached File- Added gdb.txt, #57681

    Back to the top

    Powered by Savane 3.16-598c.
    Corresponding source code