tac: read regular files instead of mmap to avoid SIGBUS on truncation

tac memory-mapped regular files. If another process truncated such a
file while it was mapped (e.g. during log rotation), accessing the
now-invalid pages raised SIGBUS and killed the process. Read regular
files into memory up front instead, so a concurrent truncation can no
longer crash tac. stdin still uses mmap on its process-owned temp file,
where external truncation is not a concern.

Adds a regression test that truncates a file mid-read and asserts tac is
not killed by a signal.

Fixes #9748

Author: DarthStrom

src/uu/tac/src/tac.rs

@@ -383,20 +383,21 @@ fn tac(filenames: &[OsString], before: bool, regex: bool, separator: &OsStr) ->
                 }
             };
 
-            if let Some(mmap1) = try_mmap_file(&file) {
-                mmap = mmap1;
-                &mmap
-            } else {
-                let mut contents = Vec::new();
-                match file.read_to_end(&mut contents) {
-                    Ok(_) => {
-                        buf = contents;
-                        &buf
-                    }
-                    Err(e) => {
-                        show!(TacError::ReadError(filename.clone(), e));
-                        continue;
-                    }
+            // Read the whole file into memory instead of memory-mapping it.
+            // Memory-mapping a regular file is unsound: if another process
+            // truncates the file while it is mapped, accessing the now-invalid
+            // pages raises SIGBUS and terminates the process (for example
+            // during log rotation). Copying the bytes up front avoids this.
+            // See https://github.com/uutils/coreutils/issues/9748.
+            let mut contents = Vec::new();
+            match file.read_to_end(&mut contents) {
+                Ok(_) => {
+                    buf = contents;
+                    &buf
+                }
+                Err(e) => {
+                    show!(TacError::ReadError(filename.clone(), e));
+                    continue;
                 }
             }
         };
@@ -450,12 +451,6 @@ fn buffer_stdin() -> std::io::Result<StdinData> {
     }
 }
 
-fn try_mmap_file(file: &File) -> Option<Mmap> {
-    // SAFETY: If the file is truncated while we map it, SIGBUS will be raised
-    // and our process will be terminated, thus preventing access of invalid memory.
-    unsafe { Mmap::map(file).ok() }
-}
-
 #[cfg(test)]
 mod tests_hybrid_flavor {
     use super::translate_regex_flavor;

tests/by-util/test_tac.rs

@@ -2,8 +2,8 @@
 //
 // For the full copyright and license information, please view the LICENSE
 // file that was distributed with this source code.
-// spell-checker:ignore axxbxx bxxaxx axxx axxxx xxaxx xxax xxxxa axyz zyax zyxa bbaaa aaabc bcdddd cddddaaabc xyzabc abcxyzabc nbbaaa EISDIR
-#[cfg(target_os = "linux")]
+// spell-checker:ignore axxbxx bxxaxx axxx axxxx xxaxx xxax xxxxa axyz zyax zyxa bbaaa aaabc bcdddd cddddaaabc xyzabc abcxyzabc nbbaaa EISDIR SIGBUS mmap
+#[cfg(unix)]
 use uutests::at_and_ucmd;
 use uutests::new_ucmd;
 use uutests::util::TestScenario;
@@ -475,3 +475,47 @@ fn test_regular_end_anchor() {
         .succeeds()
         .stdout_is("\nccc\nbbaaa\nb");
 }
+
+/// Regression test for <https://github.com/uutils/coreutils/issues/9748>.
+///
+/// `tac` used to memory-map regular files. When another process truncated such
+/// a file while it was mapped, accessing the now-invalid pages raised SIGBUS
+/// and killed the process. Now that `tac` reads files into memory up front, a
+/// concurrent truncation can no longer crash it: it reverses whatever it
+/// managed to read (or reports a normal I/O error).
+///
+/// On a build still using mmap this race would intermittently terminate the
+/// process with SIGBUS; on the fixed build it can never be killed by a signal,
+/// so this assertion is stable regardless of timing.
+#[test]
+#[cfg(unix)]
+fn test_tac_file_truncated_during_read_does_not_crash() {
+    use std::fs::OpenOptions;
+    use std::time::Duration;
+
+    let (at, mut ucmd) = at_and_ucmd!();
+
+    // A large sparse file, so the read overlaps with the truncation below.
+    // `set_len` keeps it sparse, so creation stays cheap.
+    let name = "input";
+    at.make_file(name).set_len(64 * 1024 * 1024).unwrap();
+
+    let child = ucmd.arg(name).run_no_wait();
+
+    // Give tac a moment to start reading, then truncate the file out from
+    // under it.
+    std::thread::sleep(Duration::from_millis(2));
+    OpenOptions::new()
+        .write(true)
+        .open(at.plus(name))
+        .unwrap()
+        .set_len(0)
+        .unwrap();
+
+    let result = child.wait().unwrap();
+    assert!(
+        result.signal().is_none(),
+        "tac was killed by signal {:?} (SIGBUS regression, see #9748)",
+        result.signal()
+    );
+}