From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from conssluserg-06.nifty.com (conssluserg-06.nifty.com [210.131.2.91]) by sourceware.org (Postfix) with ESMTPS id AE16D3858022 for ; Mon, 17 Jan 2022 12:48:36 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org AE16D3858022 Authentication-Results: sourceware.org; dmarc=fail (p=none dis=none) header.from=nifty.ne.jp Authentication-Results: sourceware.org; spf=fail smtp.mailfrom=nifty.ne.jp Received: from Express5800-S70 (v036249.dynamic.ppp.asahi-net.or.jp [124.155.36.249]) (authenticated) by conssluserg-06.nifty.com with ESMTP id 20HClxtO024080 for ; Mon, 17 Jan 2022 21:48:00 +0900 DKIM-Filter: OpenDKIM Filter v2.10.3 conssluserg-06.nifty.com 20HClxtO024080 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nifty.ne.jp; s=dec2015msa; t=1642423680; bh=pysjSYdSEy1ohSTbdwdF1Kvp9FNL8f9AyjsnIey4BgU=; h=Date:From:To:Subject:In-Reply-To:References:From; b=bh8OTHUTaONps0ST0L4WXK86QqS4GyzTV9GrDIjDWvnmy/eg3RnGNY6y2mHeHqlXt Ikrzxu7zVXe1Mknw5Fr8rdNjKSF1GH6QnowfDtBhejvPTYXHyLEIz020GE6J86QCWG EbiZxUhqEid+nnEGgcmGx8EYdROpK+zeTKLIe1FDL7hkQqqBylp/MDBgNkyqz9c1Xo h9BH+FiBi+DSFcfhVt64GW6kopFSfyjMYX3gNCmR2Cw8S/sG08RiugThJEaAajgSHs O87SOaW0u0QBYN6A6ikgH22Ae8q1AQ4YsMsNDVsvg3dQXVqXsq6OEYZ0his7j2xddG lkKEd+SVbgo4g== X-Nifty-SrcIP: [124.155.36.249] Date: Mon, 17 Jan 2022 21:48:01 +0900 From: Takashi Yano To: cygwin@cygwin.com Subject: Re: Segmentation fault due to double free for archetype. Message-Id: <20220117214801.1f0d9bef92224cac51b6d806@nifty.ne.jp> In-Reply-To: References: <20220115192030.de26356820d839eec3227e70@nifty.ne.jp> <20220117204131.b1b3e221874af6804791ccec@nifty.ne.jp> X-Mailer: Sylpheed 3.7.0 (GTK+ 2.24.30; i686-pc-mingw32) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-11.2 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, NICE_REPLY_A, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: cygwin@cygwin.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: General Cygwin discussions and problem reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Jan 2022 12:48:40 -0000 On Mon, 17 Jan 2022 13:11:46 +0100 Corinna Vinschen wrote: > On Jan 17 20:41, Takashi Yano wrote: > > On Mon, 17 Jan 2022 12:01:51 +0100 > > Corinna Vinschen wrote: > > > On Jan 15 19:20, Takashi Yano wrote: > > > > I also found the following patch fixes the issue. Is this the > > > > right thing? > > > > > > > > diff --git a/winsup/cygwin/fhandler.cc b/winsup/cygwin/fhandler.cc > > > > index fc7c0422e..e51208117 100644 > > > > --- a/winsup/cygwin/fhandler.cc > > > > +++ b/winsup/cygwin/fhandler.cc > > > > @@ -441,7 +441,7 @@ fhandler_base::open_with_arch (int flags, mode_t mode) > > > > || open (flags, mode & 07777))) > > > > { > > > > if (archetype) > > > > - delete archetype; > > > > + cygheap->fdtab.delete_archetype (archetype); > > > > } > > > > else if (archetype) > > > > { > > > > > > Good catch! I think this is basically ok, but you have to check the > > > usecount, i. e. > > > > > > if (archetype && archetype_usecount (-1) == 0) > > > cygheap->fdtab.delete_archetype (archetype); > > > > > > Does that sound right? > > > > Where is archetype->usecount is incremented? > > In fhandler_base::open_with_arch. > > > It seems that > > archetype->usecount is zero here. archetype->usecount is not > > incremented around line 672 in dtable.cc when archetype is > > created by fh->clone(). > > > > else > > { > > if (!fh->get_name ()) > > fh->set_name (fh->dev ().native ()); > > fh->archetype = fh->clone (); > > debug_printf ("created an archetype (%p) for %s(%d/%d)", fh->archetype, fh->get_name (), fh->dev ().get_major (), fh->dev ().get_minor ()); > > fh->archetype->archetype = NULL; > > *cygheap->fdtab.add_archetype () = fh->archetype; > > } > > Right, but if open isn't called, because you already have an archetype > at this point: > > if (!(res = (archetype && archetype->io_handle) > || open (flags, mode & 07777))) > > Then the archetype is one already created by a former open_with_arch > call and then you delete an archetype which is still in use, no? archetype->usecount is not incremented yet here. archetype->usecount is incremented only when this 'if' clause is not true. So, isn't the following code right? if (!(res = (archetype && archetype->io_handle) || open (flags, mode & 07777))) { if (archetype && archetype->usecount == 0) cygheap->fdtab.delete_archetype (archetype); } -- Takashi Yano