Re: [PATCH] busybox: fix TOCTOU race in various directory traversal

On Sun, 1 Feb 2026 at 12:57, Sertonix via busybox <[email protected]> wrote:
>
> > Please describe exact testcases of the attacks you defend against.
>
> I have attached a demonstration script for the issue with rm -r. The
> script intentionally slows down the rm process to make the issue easier
> to reproduce but the same issue should be possible (but potentially
> difficult) without. The TOCTOU race is possible when between the fstat
> call stat call used to check for a directory and the opendir call to get
> a fd for the directory. Between these moments the directory can be
> replaced with a symlink pointing to any path and opendir will follow
> that symlink when getting the fd.

This should help increasing the latency and thus increase the chance
to see the expected race condition

nice -n19 ionice -c3 stdbuf -o0 -e0 -i0 \
strace -o slow-1 busybox rm -r -f -v tmp > slow-2

Best regards, R-