From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mout.kundenserver.de (mout.kundenserver.de [217.72.192.73]) by sourceware.org (Postfix) with ESMTPS id 14A9F3858018 for ; Mon, 17 Jan 2022 12:11:48 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 14A9F3858018 Authentication-Results: sourceware.org; dmarc=fail (p=none dis=none) header.from=cygwin.com Authentication-Results: sourceware.org; spf=fail smtp.mailfrom=cygwin.com Received: from calimero.vinschen.de ([24.134.7.25]) by mrelayeu.kundenserver.de (mreue106 [212.227.15.183]) with ESMTPSA (Nemesis) id 1Mqagw-1mVzSF2c0e-00mYz3 for ; Mon, 17 Jan 2022 13:11:47 +0100 Received: by calimero.vinschen.de (Postfix, from userid 500) id E121DA8079E; Mon, 17 Jan 2022 13:11:46 +0100 (CET) Date: Mon, 17 Jan 2022 13:11:46 +0100 From: Corinna Vinschen To: cygwin@cygwin.com Subject: Re: Segmentation fault due to double free for archetype. Message-ID: Reply-To: cygwin@cygwin.com Mail-Followup-To: cygwin@cygwin.com References: <20220115192030.de26356820d839eec3227e70@nifty.ne.jp> <20220117204131.b1b3e221874af6804791ccec@nifty.ne.jp> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20220117204131.b1b3e221874af6804791ccec@nifty.ne.jp> X-Provags-ID: V03:K1:jPMPKy5skCOoTOGux4FtAXUQJeil/b3LgVgmiip/1c46/DZqHnl DST244lxBnW+yKBpBrwCoZKYe1Ynnh3o8mF8CgC16XCjYVvBeT4uipVgtL7EeAfWGYTCcwi YHCj3SekG0luXPvAWmsdPMv6plnPYLZYJjvpalg55Rvh3QaNERG+QFX6lr3FoLpXxTdE1by PaM6dt0Y4X1rfofnfdQrA== X-UI-Out-Filterresults: notjunk:1;V03:K0:DS4ECZtEGY0=:rdlxQ1ENRbOh2g+JV1u32V dYuobB3NCL6s8EyOQQb6hyKeaDU1mAuL9+RiShK9+Yz9wizmD/qDXu7R6Ln2Kjj6hgjIQg7Ki FwpiQV4yEKFWgztYNG+fhFlhE5tdEu3ejvCH6XAsMTuWHUukBSr7YRMRgUXEoYOwYPe76tGL5 P3CdoaMgnS3kxsKyoNU+0w3cbUJTqWpIPzEuz1Ls3FMtFMPNOJhZNmAnZblmbpq/KBN19/bCj ps+dRQjDeUq0txQyMMO+YwyoQ/O6TM3vQS6zNzzo4+7ShlchFzTbEiVUHdkVo2R2mbEJtFlUG 2EmXNQv/Y+VHPyQEqBi1GHwGXM2ZPT9nUxS/M+TgN+N0IK9mi7YHQESEDsgBvPljMzpXCPfF1 CoBwszJVK9Gf3BYa30GszDkVNEFGxP5D16YHv+BahZGeICMuxvsRfbHKpQXCLr1zcsHL/4kt3 azIFHGQAoAbdnq6R/XDc7W7wj+fnNPXN94MseL/foUW2S/CBCRQ8rMdsn1U6Pt5eRImRlj25E YXgL5dvkcs2CrEt0HamFq614mishp+AjQmkzYwrtGKm5cnHBahqg5hCI42PM7UAvc91KFNWMO Jq0HkYgHEoNqqerEJOOi7ylSrH42qASxgjJ5/BzvN8FQnTiDI03iAZch8Pb8arVyxSiBp686+ cvqIEAcX39mxG3XMFh9ZyjR/q4qlTUqQpMTsoR0Tc7ykDe8xtRlkZNPxi7B8y2T7hNPin3lqu QO/dGS+yIYSj3+Nh X-Spam-Status: No, score=-102.0 required=5.0 tests=BAYES_00, GIT_PATCH_0, GOOD_FROM_CORINNA_CYGWIN, KAM_DMARC_NONE, KAM_DMARC_STATUS, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H5, RCVD_IN_MSPIKE_WL, SPF_FAIL, SPF_HELO_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: cygwin@cygwin.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: General Cygwin discussions and problem reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Jan 2022 12:11:50 -0000 On Jan 17 20:41, Takashi Yano wrote: > On Mon, 17 Jan 2022 12:01:51 +0100 > Corinna Vinschen wrote: > > On Jan 15 19:20, Takashi Yano wrote: > > > I also found the following patch fixes the issue. Is this the > > > right thing? > > > > > > diff --git a/winsup/cygwin/fhandler.cc b/winsup/cygwin/fhandler.cc > > > index fc7c0422e..e51208117 100644 > > > --- a/winsup/cygwin/fhandler.cc > > > +++ b/winsup/cygwin/fhandler.cc > > > @@ -441,7 +441,7 @@ fhandler_base::open_with_arch (int flags, mode_t mode) > > > || open (flags, mode & 07777))) > > > { > > > if (archetype) > > > - delete archetype; > > > + cygheap->fdtab.delete_archetype (archetype); > > > } > > > else if (archetype) > > > { > > > > Good catch! I think this is basically ok, but you have to check the > > usecount, i. e. > > > > if (archetype && archetype_usecount (-1) == 0) > > cygheap->fdtab.delete_archetype (archetype); > > > > Does that sound right? > > Where is archetype->usecount is incremented? In fhandler_base::open_with_arch. > It seems that > archetype->usecount is zero here. archetype->usecount is not > incremented around line 672 in dtable.cc when archetype is > created by fh->clone(). > > else > { > if (!fh->get_name ()) > fh->set_name (fh->dev ().native ()); > fh->archetype = fh->clone (); > debug_printf ("created an archetype (%p) for %s(%d/%d)", fh->archetype, fh->get_name (), fh->dev ().get_major (), fh->dev ().get_minor ()); > fh->archetype->archetype = NULL; > *cygheap->fdtab.add_archetype () = fh->archetype; > } Right, but if open isn't called, because you already have an archetype at this point: if (!(res = (archetype && archetype->io_handle) || open (flags, mode & 07777))) Then the archetype is one already created by a former open_with_arch call and then you delete an archetype which is still in use, no? Corinna