From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from conssluserg-03.nifty.com (conssluserg-03.nifty.com [210.131.2.82]) by sourceware.org (Postfix) with ESMTPS id 9ADD0385843E for ; Mon, 17 Jan 2022 11:41:48 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 9ADD0385843E Authentication-Results: sourceware.org; dmarc=fail (p=none dis=none) header.from=nifty.ne.jp Authentication-Results: sourceware.org; spf=fail smtp.mailfrom=nifty.ne.jp Received: from Express5800-S70 (v036249.dynamic.ppp.asahi-net.or.jp [124.155.36.249]) (authenticated) by conssluserg-03.nifty.com with ESMTP id 20HBfUhp022539 for ; Mon, 17 Jan 2022 20:41:30 +0900 DKIM-Filter: OpenDKIM Filter v2.10.3 conssluserg-03.nifty.com 20HBfUhp022539 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nifty.ne.jp; s=dec2015msa; t=1642419690; bh=vnMEh9fXHK9F67vS/XfiTNbsGow43dvBVG70Hx1ZiCQ=; h=Date:From:To:Subject:In-Reply-To:References:From; b=Peay6kVMdBmV3HQ06nvuMxtsWrHfALQ+rPjKM75rxlBbW6r3Ax/k4jOdfuBT0kDaF nACtD6mfOBqpEcBEmbxF4bPj4AGx+3eeQ3RqtXVInkwK0t41N61/eFk6sqTKeP4O9X qtCWi9hfK/wXQie1ZuegWRq30L8zScfqVOpRjASUzlRTWq4c0Pm4FFIfbzZkoLBodw RW9C1YhoGxw9wEMOKSB0lhfgC/ZS+I1Ape2NAueCZP/NPZxy3xTazcisDLCQlxpPhS jS4MLtBS6FQrVymKy5OjQEQ1OmxAJbj9PteN+AJ+i/ZS2l1gb2e/GR9hMgtzGZ9JJE IHRW0z9TaUibw== X-Nifty-SrcIP: [124.155.36.249] Date: Mon, 17 Jan 2022 20:41:31 +0900 From: Takashi Yano To: cygwin@cygwin.com Subject: Re: Segmentation fault due to double free for archetype. Message-Id: <20220117204131.b1b3e221874af6804791ccec@nifty.ne.jp> In-Reply-To: References: <20220115192030.de26356820d839eec3227e70@nifty.ne.jp> X-Mailer: Sylpheed 3.7.0 (GTK+ 2.24.30; i686-pc-mingw32) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-11.2 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, NICE_REPLY_A, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: cygwin@cygwin.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: General Cygwin discussions and problem reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Jan 2022 11:41:52 -0000 On Mon, 17 Jan 2022 12:01:51 +0100 Corinna Vinschen wrote: > On Jan 15 19:20, Takashi Yano wrote: > > I also found the following patch fixes the issue. Is this the > > right thing? > > > > diff --git a/winsup/cygwin/fhandler.cc b/winsup/cygwin/fhandler.cc > > index fc7c0422e..e51208117 100644 > > --- a/winsup/cygwin/fhandler.cc > > +++ b/winsup/cygwin/fhandler.cc > > @@ -441,7 +441,7 @@ fhandler_base::open_with_arch (int flags, mode_t mode) > > || open (flags, mode & 07777))) > > { > > if (archetype) > > - delete archetype; > > + cygheap->fdtab.delete_archetype (archetype); > > } > > else if (archetype) > > { > > Good catch! I think this is basically ok, but you have to check the > usecount, i. e. > > if (archetype && archetype_usecount (-1) == 0) > cygheap->fdtab.delete_archetype (archetype); > > Does that sound right? Where is archetype->usecount is incremented? It seems that archetype->usecount is zero here. archetype->usecount is not incremented around line 672 in dtable.cc when archetype is created by fh->clone(). else { if (!fh->get_name ()) fh->set_name (fh->dev ().native ()); fh->archetype = fh->clone (); debug_printf ("created an archetype (%p) for %s(%d/%d)", fh->archetype, fh->get_name (), fh->dev ().get_major (), fh->dev ().get_minor ()); fh->archetype->archetype = NULL; *cygheap->fdtab.add_archetype () = fh->archetype; } -- Takashi Yano