kill does not properly handle negative PIDs
When the only numeric argument is a negative PID, kill displays the help message:
$ /bin/kill -1
Usage:
kill [options] <pid> [...]
Options:
<pid> [...] send signal to every <pid> listed
-<signal>, -s, --signal <signal>
specify the <signal> to be sent
-l, --list=[<signal>] list all signal names, or convert one to a name
-L, --table list all signal names in a nice table
-h, --help display this help and exit
-V, --version output version information and exit
For more details see kill(1).
When a negative PID is preceded by a positive PID, it is interpreted as a signal number:
$ strace -fv -etrace=kill /bin/kill 1 -1
kill(1, SIGHUP) = -1 EPERM (Operation not permitted)
kill: (1): error code 1
+++ exited with 1 +++
When a negative PID is preceded by a signal number, or a signal name without -s
, it segfaults because pid = atoi(argv[optind]);
runs off the end of the argument list (argv[optind]
is NULL
because there are no more arguments):
$ strace -fv -etrace=kill /bin/kill -TERM -1
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
+++ killed by SIGSEGV +++
zsh: segmentation fault strace -fv -etrace=kill /bin/kill -TERM -1
$ strace -fv -etrace=kill /bin/kill -9 -1
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
+++ killed by SIGSEGV +++
zsh: segmentation fault strace -fv -etrace=kill /bin/kill -9 -1