Subject: Re: bug#49209: coreutils: stack out-of-bounds write in tail --follow

From: Paul Eggert <[email-masked]>
Date: Sat, 26 Jun 2021 18:47:46 -0700

On 6/24/21 8:50 AM, Paul Eggert wrote:

> inotify_init can return 1025 even if called first thing, so we also need 
> to dup2 the result of early inotify_init down to 3 (or whatever), or at 
> least to check that it's less than 1024. Choosing 3 is a tricky 
> business, since it's not clear what fds the C library actually needs.

When looking into this I decided it was cleaner to fix coreutils by 
using 'poll' instead of 'select', as Kamil suggested. I installed the 
attached patches to do that. The last patch fixes the bug.

Thanks for reporting the problem.
From 145707949f9479f00dce41f479549f7629d7d0c9 Mon Sep 17 00:00:00 2001
From: Paul Eggert <[email-masked]>
Date: Sat, 26 Jun 2021 18:23:52 -0700
Subject: [PATCH 1/3] =?UTF-8?q?maint:=20while=20(1)=20=E2=86=92=20while=20?=
 =?UTF-8?q?(true)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/basenc.c     |  2 +-
 src/chcon.c      |  2 +-
 src/chmod.c      |  2 +-
 src/chown-core.c |  2 +-
 src/csplit.c     |  2 +-
 src/cut.c        |  2 +-
 src/date.c       |  2 +-
 src/dd.c         |  2 +-
 src/dircolors.c  |  2 +-
 src/du.c         |  2 +-
 src/expr.c       | 12 ++++++------
 src/head.c       |  4 ++--
 src/join.c       |  2 +-
 src/ls.c         |  4 ++--
 src/nproc.c      |  2 +-
 src/od.c         |  6 +++---
 src/ptx.c        |  2 +-
 src/pwd.c        |  6 +++---
 src/realpath.c   |  2 +-
 src/remove.c     |  2 +-
 src/rmdir.c      |  2 +-
 src/runcon.c     |  2 +-
 src/sort.c       |  2 +-
 src/sum.c        |  2 +-
 src/system.h     |  2 +-
 src/tac-pipe.c   |  6 +++---
 src/tac.c        |  2 +-
 src/tail.c       | 12 ++++++------
 src/tsort.c      |  2 +-
 29 files changed, 47 insertions(+), 47 deletions(-)

diff --git a/src/basenc.c b/src/basenc.c
index 7e22363bf..5c97a3652 100644
--- a/src/basenc.c
+++ b/src/basenc.c
@@ -605,7 +605,7 @@ z85_encode (char const *restrict in, size_t inlen,
   unsigned int val;
   size_t outidx = 0;
 
-  while (1)
+  while (true)
     {
       if (inlen == 0)
         {
diff --git a/src/chcon.c b/src/chcon.c
index dc2258de0..88010848e 100644
--- a/src/chcon.c
+++ b/src/chcon.c
@@ -315,7 +315,7 @@ process_files (char **files, int bit_flags)
 
   FTS *fts = xfts_open (files, bit_flags, NULL);
 
-  while (1)
+  while (true)
     {
       FTSENT *ent;
 
diff --git a/src/chmod.c b/src/chmod.c
index 78d9c9cba..160a0c537 100644
--- a/src/chmod.c
+++ b/src/chmod.c
@@ -335,7 +335,7 @@ process_files (char **files, int bit_flags)
 
   FTS *fts = xfts_open (files, bit_flags, NULL);
 
-  while (1)
+  while (true)
     {
       FTSENT *ent;
 
diff --git a/src/chown-core.c b/src/chown-core.c
index a0b2f670f..4d816de4a 100644
--- a/src/chown-core.c
+++ b/src/chown-core.c
@@ -524,7 +524,7 @@ chown_files (char **files, int bit_flags,
 
   FTS *fts = xfts_open (files, bit_flags | stat_flags, NULL);
 
-  while (1)
+  while (true)
     {
       FTSENT *ent;
 
diff --git a/src/csplit.c b/src/csplit.c
index f188e8894..e1fb66ed2 100644
--- a/src/csplit.c
+++ b/src/csplit.c
@@ -496,7 +496,7 @@ load_buffer (void)
   if (bytes_wanted < hold_count)
     bytes_wanted = hold_count;
 
-  while (1)
+  while (true)
     {
       b = get_new_buffer (bytes_wanted);
       bytes_avail = b->bytes_alloc; /* Size of buffer returned. */
diff --git a/src/cut.c b/src/cut.c
index 78b82c80e..f4d44c211 100644
--- a/src/cut.c
+++ b/src/cut.c
@@ -306,7 +306,7 @@ cut_fields (FILE *stream)
      That is because a non-delimited line has exactly one field.  */
   buffer_first_field = (suppress_non_delimited ^ !print_kth (1));
 
-  while (1)
+  while (true)
     {
       if (field_idx == 1 && buffer_first_field)
         {
diff --git a/src/date.c b/src/date.c
index d5eebaf25..4a7a4e243 100644
--- a/src/date.c
+++ b/src/date.c
@@ -313,7 +313,7 @@ batch_convert (char const *input_filename, char const *format,
   line = NULL;
   buflen = 0;
   ok = true;
-  while (1)
+  while (true)
     {
       ssize_t line_length = getline (&line, &buflen, in_stream);
       if (line_length < 0)
diff --git a/src/dd.c b/src/dd.c
index d284357a4..fc5108f8b 100644
--- a/src/dd.c
+++ b/src/dd.c
@@ -2179,7 +2179,7 @@ dd_copy (void)
   alloc_ibuf ();
   alloc_obuf ();
 
-  while (1)
+  while (true)
     {
       if (status_level == STATUS_PROGRESS)
         {
diff --git a/src/dircolors.c b/src/dircolors.c
index fea0cdf01..b765ded9f 100644
--- a/src/dircolors.c
+++ b/src/dircolors.c
@@ -253,7 +253,7 @@ dc_parse_stream (FILE *fp, char const *filename)
   if (term == NULL || *term == '\0')
     term = "none";
 
-  while (1)
+  while (true)
     {
       char *keywd, *arg;
       bool unrecognized;
diff --git a/src/du.c b/src/du.c
index d4760a36c..efd519706 100644
--- a/src/du.c
+++ b/src/du.c
@@ -684,7 +684,7 @@ du_files (char **files, int bit_flags)
     {
       FTS *fts = xfts_open (files, bit_flags, NULL);
 
-      while (1)
+      while (true)
         {
           FTSENT *ent;
 
diff --git a/src/expr.c b/src/expr.c
index ec76f7607..41185a8f8 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -781,7 +781,7 @@ eval5 (bool evaluate)
   trace ("eval5");
 #endif
   l = eval6 (evaluate);
-  while (1)
+  while (true)
     {
       if (nextarg (":"))
         {
@@ -812,7 +812,7 @@ eval4 (bool evaluate)
   trace ("eval4");
 #endif
   l = eval5 (evaluate);
-  while (1)
+  while (true)
     {
       if (nextarg ("*"))
         fxn = multiply;
@@ -851,7 +851,7 @@ eval3 (bool evaluate)
   trace ("eval3");
 #endif
   l = eval4 (evaluate);
-  while (1)
+  while (true)
     {
       if (nextarg ("+"))
         fxn = plus;
@@ -881,7 +881,7 @@ eval2 (bool evaluate)
   trace ("eval2");
 #endif
   l = eval3 (evaluate);
-  while (1)
+  while (true)
     {
       VALUE *r;
       enum
@@ -960,7 +960,7 @@ eval1 (bool evaluate)
   trace ("eval1");
 #endif
   l = eval2 (evaluate);
-  while (1)
+  while (true)
     {
       if (nextarg ("&"))
         {
@@ -991,7 +991,7 @@ eval (bool evaluate)
   trace ("eval");
 #endif
   l = eval1 (evaluate);
-  while (1)
+  while (true)
     {
       if (nextarg ("|"))
         {
diff --git a/src/head.c b/src/head.c
index 844c5636a..7b2a44041 100644
--- a/src/head.c
+++ b/src/head.c
@@ -520,7 +520,7 @@ elide_tail_lines_pipe (char const *filename, int fd, uintmax_t n_elide,
   /* Always read into a fresh buffer.
      Read, (producing no output) until we've accumulated at least
      n_elide newlines, or until EOF, whichever comes first.  */
-  while (1)
+  while (true)
     {
       n_read = safe_read (fd, tmp->buffer, BUFSIZ);
       if (n_read == 0 || n_read == SAFE_READ_ERROR)
@@ -676,7 +676,7 @@ elide_tail_lines_seekable (char const *pretty_filename, int fd,
   if (n_lines && bytes_read && buffer[bytes_read - 1] != line_end)
     --n_lines;
 
-  while (1)
+  while (true)
     {
       /* Scan backward, counting the newlines in this bufferfull.  */
 
diff --git a/src/join.c b/src/join.c
index 57f4665bc..f22ffda53 100644
--- a/src/join.c
+++ b/src/join.c
@@ -598,7 +598,7 @@ prjoin (struct line const *line1, struct line const *line2)
       const struct outlist *o;
 
       o = outlist;
-      while (1)
+      while (true)
         {
           if (o->file == 0)
             {
diff --git a/src/ls.c b/src/ls.c
index 4586b5ecc..1b20f17fe 100644
--- a/src/ls.c
+++ b/src/ls.c
@@ -2980,7 +2980,7 @@ print_dir (char const *name, char const *realname, bool command_line_arg)
   /* Read the directory entries, and insert the subfiles into the 'cwd_file'
      table.  */
 
-  while (1)
+  while (true)
     {
       /* Set errno to zero so we can distinguish between a readdir failure
          and when readdir simply finds that there are no more entries.  */
@@ -5112,7 +5112,7 @@ print_many_per_line (void)
       size_t pos = 0;
 
       /* Print the next row.  */
-      while (1)
+      while (true)
         {
           struct fileinfo const *f = sorted_file[filesno];
           size_t name_length = length_of_file_name_and_frills (f);
diff --git a/src/nproc.c b/src/nproc.c
index e06b7a431..55a51bfbe 100644
--- a/src/nproc.c
+++ b/src/nproc.c
@@ -86,7 +86,7 @@ main (int argc, char **argv)
 
   enum nproc_query mode = NPROC_CURRENT_OVERRIDABLE;
 
-  while (1)
+  while (true)
     {
       int c = getopt_long (argc, argv, "", longopts, NULL);
       if (c == -1)
diff --git a/src/od.c b/src/od.c
index 5b2d507a1..f04e0ccb7 100644
--- a/src/od.c
+++ b/src/od.c
@@ -1387,7 +1387,7 @@ dump (void)
 
   if (limit_bytes_to_format)
     {
-      while (1)
+      while (true)
         {
           size_t n_needed;
           if (current_offset >= end_offset)
@@ -1409,7 +1409,7 @@ dump (void)
     }
   else
     {
-      while (1)
+      while (true)
         {
           ok &= read_block (bytes_per_block, block[idx], &n_bytes_read);
           if (n_bytes_read < bytes_per_block)
@@ -1462,7 +1462,7 @@ dump_strings (void)
   uintmax_t address = n_bytes_to_skip;
   bool ok = true;
 
-  while (1)
+  while (true)
     {
       size_t i;
       int c;
diff --git a/src/ptx.c b/src/ptx.c
index fc4d0912f..c488b1192 100644
--- a/src/ptx.c
+++ b/src/ptx.c
@@ -837,7 +837,7 @@ find_occurs_in_text (int file_index)
       /* Read and process a single input line or sentence, one word at a
          time.  */
 
-      while (1)
+      while (true)
         {
           if (word_regex.string)
 
diff --git a/src/pwd.c b/src/pwd.c
index 3a18c3d81..5dfda31bd 100644
--- a/src/pwd.c
+++ b/src/pwd.c
@@ -178,7 +178,7 @@ find_dir_entry (struct stat *dot_sb, struct file_name *file_name,
   use_lstat = (parent_sb.st_dev != dot_sb->st_dev);
 
   found = false;
-  while (1)
+  while (true)
     {
       struct dirent const *dp;
       struct stat ent_sb;
@@ -279,7 +279,7 @@ robust_getcwd (struct file_name *file_name)
   if (stat (".", &dot_sb) < 0)
     die (EXIT_FAILURE, errno, _("failed to stat %s"), quoteaf ("."));
 
-  while (1)
+  while (true)
     {
       /* If we've reached the root, we're done.  */
       if (SAME_INODE (dot_sb, *root_dev_ino))
@@ -340,7 +340,7 @@ main (int argc, char **argv)
 
   atexit (close_stdout);
 
-  while (1)
+  while (true)
     {
       int c = getopt_long (argc, argv, "LP", longopts, NULL);
       if (c == -1)
diff --git a/src/realpath.c b/src/realpath.c
index 4c9ffbcb4..8e4aabfdf 100644
--- a/src/realpath.c
+++ b/src/realpath.c
@@ -185,7 +185,7 @@ main (int argc, char **argv)
 
   atexit (close_stdout);
 
-  while (1)
+  while (true)
     {
       int c = getopt_long (argc, argv, "eLmPqsz", longopts, NULL);
       if (c == -1)
diff --git a/src/remove.c b/src/remove.c
index da380e0a7..5dd0479e6 100644
--- a/src/remove.c
+++ b/src/remove.c
@@ -590,7 +590,7 @@ rm (char *const *file, struct rm_options const *x)
 
       FTS *fts = xfts_open (file, bit_flags, NULL);
 
-      while (1)
+      while (true)
         {
           FTSENT *ent;
 
diff --git a/src/rmdir.c b/src/rmdir.c
index 3a9911ff0..149d4659a 100644
--- a/src/rmdir.c
+++ b/src/rmdir.c
@@ -117,7 +117,7 @@ remove_parents (char *dir)
   bool ok = true;
 
   strip_trailing_slashes (dir);
-  while (1)
+  while (true)
     {
       slash = strrchr (dir, '/');
       if (slash == NULL)
diff --git a/src/runcon.c b/src/runcon.c
index fda8bb398..716170092 100644
--- a/src/runcon.c
+++ b/src/runcon.c
@@ -124,7 +124,7 @@ main (int argc, char **argv)
 
   atexit (close_stdout);
 
-  while (1)
+  while (true)
     {
       int option_index = 0;
       int c = getopt_long (argc, argv, "+r:t:u:l:c", long_options,
diff --git a/src/sort.c b/src/sort.c
index d98796b96..451bfe08a 100644
--- a/src/sort.c
+++ b/src/sort.c
@@ -3552,7 +3552,7 @@ static void
 merge_loop (struct merge_node_queue *queue,
             size_t total_lines, FILE *tfp, char const *temp_output)
 {
-  while (1)
+  while (true)
     {
       struct merge_node *node = queue_pop (queue);
 
diff --git a/src/sum.c b/src/sum.c
index 218db808d..f9641dbb1 100644
--- a/src/sum.c
+++ b/src/sum.c
@@ -179,7 +179,7 @@ sysv_sum_file (char const *file, int print_name)
         }
     }
 
-  while (1)
+  while (true)
     {
       size_t bytes_read = safe_read (fd, buf, sizeof buf);
 
diff --git a/src/system.h b/src/system.h
index 676f5f562..ce264b121 100644
--- a/src/system.h
+++ b/src/system.h
@@ -277,7 +277,7 @@ dot_or_dotdot (char const *file_name)
 static inline struct dirent const *
 readdir_ignoring_dot_and_dotdot (DIR *dirp)
 {
-  while (1)
+  while (true)
     {
       struct dirent const *dp = readdir (dirp);
       if (dp == NULL || ! dot_or_dotdot (dp->d_name))
diff --git a/src/tac-pipe.c b/src/tac-pipe.c
index 5fefd631b..5192607d9 100644
--- a/src/tac-pipe.c
+++ b/src/tac-pipe.c
@@ -58,7 +58,7 @@ buf_init_from_stdin (Buf *x, char eol_byte)
 #define OBS (&(x->obs))
   obstack_init (OBS);
 
-  while (1)
+  while (true)
     {
       char *buf = (char *) malloc (BUFFER_SIZE);
       size_t bytes_read;
@@ -185,7 +185,7 @@ find_bol (const Buf *x,
   tmp = line_ptr_decrement (x, last_bol);
   last_bol_ptr = tmp.ptr;
   i = tmp.i;
-  while (1)
+  while (true)
     {
       char *nl = memrchr (x->p[i].start, last_bol_ptr, eol_byte);
       if (nl)
@@ -250,7 +250,7 @@ tac_mem ()
   bol.i = x.n_bufs - 1;
   bol.ptr = ONE_PAST_END (&x, bol.i);
 
-  while (1)
+  while (true)
     {
       Line_ptr new_bol;
       if (! find_bol (&x, &bol, &new_bol, eol_byte))
diff --git a/src/tac.c b/src/tac.c
index 1a01c005e..cbc3deac9 100644
--- a/src/tac.c
+++ b/src/tac.c
@@ -505,7 +505,7 @@ copy_to_temp (FILE **g_tmp, char **g_tempfile, int input_fd, char const *file)
   if (!temp_stream (&fp, &file_name))
     return -1;
 
-  while (1)
+  while (true)
     {
       size_t bytes_read = safe_read (input_fd, G_buffer, read_size);
       if (bytes_read == 0)
diff --git a/src/tail.c b/src/tail.c
index b91fcfd82..7c3ae22d9 100644
--- a/src/tail.c
+++ b/src/tail.c
@@ -453,7 +453,7 @@ dump_remainder (bool want_header, char const *pretty_filename, int fd,
   uintmax_t n_remaining = n_bytes;
 
   n_written = 0;
-  while (1)
+  while (true)
     {
       char buffer[BUFSIZ];
       size_t n = MIN (n_remaining, BUFSIZ);
@@ -641,7 +641,7 @@ pipe_lines (char const *pretty_filename, int fd, uintmax_t n_lines,
   tmp = xmalloc (sizeof (LBUFFER));
 
   /* Input is always read into a fresh buffer.  */
-  while (1)
+  while (true)
     {
       n_read = safe_read (fd, tmp->buffer, BUFSIZ);
       if (n_read == 0 || n_read == SAFE_READ_ERROR)
@@ -780,7 +780,7 @@ pipe_bytes (char const *pretty_filename, int fd, uintmax_t n_bytes,
   tmp = xmalloc (sizeof (CBUFFER));
 
   /* Input is always read into a fresh buffer.  */
-  while (1)
+  while (true)
     {
       n_read = safe_read (fd, tmp->buffer, BUFSIZ);
       if (n_read == 0 || n_read == SAFE_READ_ERROR)
@@ -900,7 +900,7 @@ start_lines (char const *pretty_filename, int fd, uintmax_t n_lines,
   if (n_lines == 0)
     return 0;
 
-  while (1)
+  while (true)
     {
       char buffer[BUFSIZ];
       size_t bytes_read = safe_read (fd, buffer, BUFSIZ);
@@ -1160,7 +1160,7 @@ tail_forever (struct File_spec *f, size_t n_files, double sleep_interval)
 
   last = n_files - 1;
 
-  while (1)
+  while (true)
     {
       size_t i;
       bool any_input = false;
@@ -1617,7 +1617,7 @@ tail_forever_inotify (int wd, struct File_spec *f, size_t n_files,
      ensure that watched files can be re-added when following by name.
      This loop blocks on the 'safe_read' call until a new event is notified.
      But when --pid=P is specified, tail usually waits via the select.  */
-  while (1)
+  while (true)
     {
       struct File_spec *fspec;
       struct inotify_event *ev;
diff --git a/src/tsort.c b/src/tsort.c
index 92bd1b2af..33b3419c0 100644
--- a/src/tsort.c
+++ b/src/tsort.c
@@ -452,7 +452,7 @@ tsort (char const *file)
 
   init_tokenbuffer (&tokenbuffer);
 
-  while (1)
+  while (true)
     {
       /* T2. Next Relation.  */
       size_t len = readtoken (stdin, DELIM, sizeof (DELIM) - 1, &tokenbuffer);
-- 
2.30.2

From bce0fe7fa095edfe52d0724d9287a9043346316b Mon Sep 17 00:00:00 2001
From: Paul Eggert <[email-masked]>
Date: Sat, 26 Jun 2021 18:23:52 -0700
Subject: [PATCH 2/3] tail: fix abuse2 test race
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* tests/tail-2/inotify-hash-abuse2.sh (fastpoll):
Fix race where tailed file ‘f’ temporarily did not exist.
---
 tests/tail-2/inotify-hash-abuse2.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/tail-2/inotify-hash-abuse2.sh b/tests/tail-2/inotify-hash-abuse2.sh
index 2c40236af..4b36b7a33 100755
--- a/tests/tail-2/inotify-hash-abuse2.sh
+++ b/tests/tail-2/inotify-hash-abuse2.sh
@@ -33,8 +33,8 @@ for mode in '' '---disable-inotify'; do
 
   for i in $(seq 200); do
     kill -0 $pid || break;
-    mv f g
-    touch f
+    touch g
+    mv g f
   done
 
   # Ensure tail hasn't aborted
-- 
2.30.2

From 3f83f82d2612d0c6ea8f1983350e85ef3cc0fc7a Mon Sep 17 00:00:00 2001
From: Paul Eggert <[email-masked]>
Date: Sat, 26 Jun 2021 18:23:52 -0700
Subject: [PATCH 3/3] tail: use poll, not select
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This fixes an unlikely stack out-of-bounds write reported by
Stepan Broz via Kamil Dudka (Bug#49209).
* bootstrap.conf (gnulib_modules): Replace select with poll.
* src/tail.c: Do not include <sys/select.h>.
[!_AIX]: Include poll.h.
(check_output_alive) [!_AIX]: Use poll instead of select.
(tail_forever_inotify): Likewise.  Simplify logic, as there is no
need for a ‘while (len <= evbuf_off)’ loop.
---
 NEWS           |   4 ++
 bootstrap.conf |   2 +-
 src/tail.c     | 100 +++++++++++++++++++------------------------------
 3 files changed, 44 insertions(+), 62 deletions(-)

diff --git a/NEWS b/NEWS
index 02b57470f..97532d3d0 100644
--- a/NEWS
+++ b/NEWS
@@ -43,6 +43,10 @@ GNU coreutils NEWS                                    -*- outline -*-
   Previously a chunk starting after 128KiB, output the wrong part of the file.
   [bug introduced in coreutils-8.26]
 
+  tail -f no longer overruns a stack buffer when given too many files
+  to follow and ulimit -n exceeds 1024.
+  [bug introduced in coreutils-7.5]
+
   tr no longer crashes when using --complement with certain
   invalid combinations of case character classes.
   [bug introduced in coreutils-8.6]
diff --git a/bootstrap.conf b/bootstrap.conf
index daea2824c..e7ed7e5ff 100644
--- a/bootstrap.conf
+++ b/bootstrap.conf
@@ -193,6 +193,7 @@ gnulib_modules="
   physmem
   pipe-posix
   pipe2
+  poll
   posix-shell
   posixtm
   posixver
@@ -227,7 +228,6 @@ gnulib_modules="
   save-cwd
   savedir
   savewd
-  select
   selinux-at
   setenv
   settime
diff --git a/src/tail.c b/src/tail.c
index 7c3ae22d9..99977afa7 100644
--- a/src/tail.c
+++ b/src/tail.c
@@ -28,12 +28,9 @@
 #include <stdio.h>
 #include <assert.h>
 #include <getopt.h>
-#include <sys/select.h>
+#include <poll.h>
 #include <sys/types.h>
 #include <signal.h>
-#ifdef _AIX
-# include <poll.h>
-#endif
 
 #include "system.h"
 #include "argmatch.h"
@@ -351,27 +348,12 @@ check_output_alive (void)
   if (! monitor_output)
     return;
 
-#ifdef _AIX
-  /* select on AIX was seen to give a readable event immediately.  */
   struct pollfd pfd;
   pfd.fd = STDOUT_FILENO;
   pfd.events = POLLERR;
 
   if (poll (&pfd, 1, 0) >= 0 && (pfd.revents & POLLERR))
     die_pipe ();
-#else
-  struct timeval delay;
-  delay.tv_sec = delay.tv_usec = 0;
-
-  fd_set rfd;
-  FD_ZERO (&rfd);
-  FD_SET (STDOUT_FILENO, &rfd);
-
-  /* readable event on STDOUT is equivalent to POLLERR,
-     and implies an error condition on output like broken pipe.  */
-  if (select (STDOUT_FILENO + 1, &rfd, NULL, NULL, &delay) == 1)
-    die_pipe ();
-#endif
 }
 
 static bool
@@ -1616,7 +1598,7 @@ tail_forever_inotify (int wd, struct File_spec *f, size_t n_files,
   /* Wait for inotify events and handle them.  Events on directories
      ensure that watched files can be re-added when following by name.
      This loop blocks on the 'safe_read' call until a new event is notified.
-     But when --pid=P is specified, tail usually waits via the select.  */
+     But when --pid=P is specified, tail usually waits via poll.  */
   while (true)
     {
       struct File_spec *fspec;
@@ -1636,54 +1618,51 @@ tail_forever_inotify (int wd, struct File_spec *f, size_t n_files,
           return false;
         }
 
-      /* When watching a PID, ensure that a read from WD will not block
-         indefinitely.  */
-      while (len <= evbuf_off)
+      if (len <= evbuf_off)
         {
-          struct timeval delay; /* how long to wait for file changes.  */
+          /* Poll for inotify events.  When watching a PID, ensure
+             that a read from WD will not block indefinitely.
+             If MONITOR_OUTPUT, also poll for a broken output pipe.  */
 
-          if (pid)
+          int file_change;
+          struct pollfd pfd[2];
+          do
             {
-              if (writer_is_dead)
-                exit (EXIT_SUCCESS);
+              /* How many ms to wait for changes.  -1 means wait forever.  */
+              int delay = -1;
 
-              writer_is_dead = (kill (pid, 0) != 0 && errno != EPERM);
-
-              if (writer_is_dead)
-                delay.tv_sec = delay.tv_usec = 0;
-              else
+              if (pid)
                 {
-                  delay.tv_sec = (time_t) sleep_interval;
-                  delay.tv_usec = 1000000 * (sleep_interval - delay.tv_sec);
+                  if (writer_is_dead)
+                    exit (EXIT_SUCCESS);
+
+                  writer_is_dead = (kill (pid, 0) != 0 && errno != EPERM);
+
+                  if (writer_is_dead || sleep_interval <= 0)
+                    delay = 0;
+                  else if (sleep_interval < INT_MAX / 1000 - 1)
+                    {
+                      /* delay = ceil (sleep_interval * 1000), sans libm.  */
+                      double ddelay = sleep_interval * 1000;
+                      delay = ddelay;
+                      delay += delay < ddelay;
+                    }
                 }
+
+              pfd[0].fd = wd;
+              pfd[0].events = POLLIN;
+              pfd[1].fd = STDOUT_FILENO;
+              pfd[1].events = pfd[1].revents = 0;
+              file_change = poll (pfd, monitor_output + 1, delay);
             }
+          while (file_change == 0);
 
-           fd_set rfd;
-           FD_ZERO (&rfd);
-           FD_SET (wd, &rfd);
-           if (monitor_output)
-             FD_SET (STDOUT_FILENO, &rfd);
-
-           int file_change = select (MAX (wd, STDOUT_FILENO) + 1,
-                                     &rfd, NULL, NULL, pid ? &delay: NULL);
-
-           if (file_change == 0)
-             continue;
-           else if (file_change == -1)
-             die (EXIT_FAILURE, errno,
-                  _("error waiting for inotify and output events"));
-           else if (FD_ISSET (STDOUT_FILENO, &rfd))
-             {
-               /* readable event on STDOUT is equivalent to POLLERR,
-                  and implies an error on output like broken pipe.  */
-               die_pipe ();
-             }
-           else
-             break;
-        }
+          if (file_change < 0)
+            die (EXIT_FAILURE, errno,
+                 _("error waiting for inotify and output events"));
+          if (pfd[1].revents)
+            die_pipe ();
 
-      if (len <= evbuf_off)
-        {
           len = safe_read (wd, evbuf, evlen);
           evbuf_off = 0;
 
@@ -2444,8 +2423,7 @@ main (int argc, char **argv)
   if (forever && ignore_fifo_and_pipe (F, n_files))
     {
       /* If stdout is a fifo or pipe, then monitor it
-         so that we exit if the reader goes away.
-         Note select() on a regular file is always readable.  */
+         so that we exit if the reader goes away.  */
       struct stat out_stat;
       if (fstat (STDOUT_FILENO, &out_stat) < 0)
         die (EXIT_FAILURE, errno, _("standard output"));
-- 
2.30.2