fix(fs): skip unreadable files and directories during filesystem walk

Unreadable files and directories (e.g. "lstat: input/output error" on
special files when scanning a mounted Windows filesystem) currently
abort the whole scan. Skip them with a debug log instead, as they
cannot be analyzed anyway. Errors with the root directory itself are
still returned as the scan cannot continue without it.

Close #3259

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: kevglynn

pkg/fanal/walker/fs.go

@@ -41,7 +41,16 @@ func (w *FS) Walk(root string, opt Option, fn WalkFunc) error {
 func (w *FS) WalkDirFunc(root string, fn WalkFunc, opt Option) fs.WalkDirFunc {
 	return func(filePath string, d fs.DirEntry, err error) error {
 		if err != nil {
-			return err
+			// An error with the root itself must be returned as the scan cannot continue,
+			// but permission errors are still handled in `onError`.
+			if filePath == root {
+				return err
+			}
+			// Skip unreadable files and directories instead of aborting the whole scan
+			// as they cannot be analyzed anyway (e.g. "lstat: input/output error" on special files).
+			// cf. https://github.com/aquasecurity/trivy/issues/3259
+			log.Debug("Skipping unreadable path", log.FilePath(filePath), log.Err(err))
+			return nil
 		}
 
 		// For exported rootfs (e.g. images/alpine/etc/alpine-release)
@@ -66,7 +75,11 @@ func (w *FS) WalkDirFunc(root string, fn WalkFunc, opt Option) fs.WalkDirFunc {
 
 		info, err := d.Info()
 		if err != nil {
-			return xerrors.Errorf("file info error: %w", err)
+			// Skip unreadable files instead of aborting the whole scan
+			// (e.g. "lstat: input/output error" on special files).
+			// cf. https://github.com/aquasecurity/trivy/issues/3259
+			log.Debug("Skipping unreadable file", log.FilePath(filePath), log.Err(err))
+			return nil
 		}
 
 		if err = fn(relPath, info, fileOpener(filePath)); err != nil {

pkg/fanal/walker/fs_test.go

@@ -3,11 +3,13 @@ package walker_test
 import (
 	"errors"
 	"io"
+	"io/fs"
 	"os"
 	"path/filepath"
 	"runtime"
 	"slices"
 	"strings"
+	"syscall"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -89,6 +91,58 @@ func TestFS_Walk(t *testing.T) {
 	}
 }
 
+// fakeDirEntry is a fs.DirEntry that fails on Info().
+type fakeDirEntry struct {
+	infoErr error
+}
+
+func (e fakeDirEntry) Name() string               { return "bad" }
+func (e fakeDirEntry) IsDir() bool                { return false }
+func (e fakeDirEntry) Type() fs.FileMode          { return 0 } // regular file
+func (e fakeDirEntry) Info() (fs.FileInfo, error) { return nil, e.infoErr }
+
+func TestFS_WalkDirFunc_UnreadablePaths(t *testing.T) {
+	root := "testdata/fs"
+	analyzeFn := func(string, os.FileInfo, analyzer.Opener) error {
+		assert.Fail(t, "analyze function must not be called for unreadable paths")
+		return nil
+	}
+	walkFn := walker.NewFS().WalkDirFunc(root, analyzeFn, walker.Option{})
+
+	t.Run("unreadable file is skipped", func(t *testing.T) {
+		// e.g. "lstat: input/output error" on a broken filesystem
+		// cf. https://github.com/aquasecurity/trivy/issues/3259
+		err := walkFn(filepath.Join(root, "bad"), nil, &fs.PathError{
+			Op:   "lstat",
+			Path: filepath.Join(root, "bad"),
+			Err:  syscall.EIO,
+		})
+		assert.NoError(t, err)
+	})
+
+	t.Run("error with the root is returned", func(t *testing.T) {
+		err := walkFn(root, nil, &fs.PathError{
+			Op:   "lstat",
+			Path: root,
+			Err:  syscall.EIO,
+		})
+		assert.ErrorIs(t, err, syscall.EIO)
+	})
+
+	t.Run("file with unreadable info is skipped", func(t *testing.T) {
+		err := walkFn(filepath.Join(root, "bad"), fakeDirEntry{infoErr: syscall.EIO}, nil)
+		assert.NoError(t, err)
+	})
+}
+
+func TestFS_Walk_NonExistentRoot(t *testing.T) {
+	analyzeFn := func(string, os.FileInfo, analyzer.Opener) error {
+		return nil
+	}
+	err := walker.NewFS().Walk("testdata/non-existent", walker.Option{}, analyzeFn)
+	assert.ErrorContains(t, err, "unknown error with")
+}
+
 func TestFS_BuildSkipPaths(t *testing.T) {
 	tests := []struct {
 		name  string