X-Recipient:	archive-cygwin AT delorie DOT com
X-Original-To:	cygwin AT cygwin DOT com
Delivered-To:	cygwin AT cygwin DOT com
DMARC-Filter:	OpenDMARC Filter v1.4.1 sourceware.org AE16D3858022
Authentication-Results:	sourceware.org;
	dmarc=fail (p=none dis=none) header.from=nifty.ne.jp
Authentication-Results:	sourceware.org; spf=fail smtp.mailfrom=nifty.ne.jp
DKIM-Filter:	OpenDKIM Filter v2.10.3 conssluserg-06.nifty.com 20HClxtO024080
DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed; d=nifty.ne.jp;
	s=dec2015msa; t=1642423680;
	bh=pysjSYdSEy1ohSTbdwdF1Kvp9FNL8f9AyjsnIey4BgU=;
	h=Date:From:To:Subject:In-Reply-To:References:From;
	b=bh8OTHUTaONps0ST0L4WXK86QqS4GyzTV9GrDIjDWvnmy/eg3RnGNY6y2mHeHqlXt
	Ikrzxu7zVXe1Mknw5Fr8rdNjKSF1GH6QnowfDtBhejvPTYXHyLEIz020GE6J86QCWG
	EbiZxUhqEid+nnEGgcmGx8EYdROpK+zeTKLIe1FDL7hkQqqBylp/MDBgNkyqz9c1Xo
	h9BH+FiBi+DSFcfhVt64GW6kopFSfyjMYX3gNCmR2Cw8S/sG08RiugThJEaAajgSHs
	O87SOaW0u0QBYN6A6ikgH22Ae8q1AQ4YsMsNDVsvg3dQXVqXsq6OEYZ0his7j2xddG
	lkKEd+SVbgo4g==
X-Nifty-SrcIP:	[124.155.36.249]
Date:	Mon, 17 Jan 2022 21:48:01 +0900
From:	Takashi Yano <takashi DOT yano AT nifty DOT ne DOT jp>
To:	cygwin AT cygwin DOT com
Subject:	Re: Segmentation fault due to double free for archetype.
Message-Id:	<20220117214801.1f0d9bef92224cac51b6d806@nifty.ne.jp>
In-Reply-To:	<YeVdAnpZ0eUAfEoF@calimero.vinschen.de>
References:	<20220115192030 DOT de26356820d839eec3227e70 AT nifty DOT ne DOT jp>
	<YeVMn4MIgG+6T01I AT calimero DOT vinschen DOT de>
	<20220117204131 DOT b1b3e221874af6804791ccec AT nifty DOT ne DOT jp>
	<YeVdAnpZ0eUAfEoF AT calimero DOT vinschen DOT de>
X-Mailer:	Sylpheed 3.7.0 (GTK+ 2.24.30; i686-pc-mingw32)
Mime-Version:	1.0
X-Spam-Status:	No, score=-11.2 required=5.0 tests=BAYES_00, DKIM_SIGNED,
	DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, NICE_REPLY_A,
	RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS,
	TXREP autolearn=ham autolearn_force=no version=3.4.4
X-Spam-Checker-Version:	SpamAssassin 3.4.4 (2020-01-24) on
	server2.sourceware.org
X-BeenThere:	cygwin AT cygwin DOT com
X-Mailman-Version:	2.1.29
List-Id:	General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe:	<https://cygwin.com/mailman/options/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=unsubscribe>
List-Archive:	<https://cygwin.com/pipermail/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe:	<https://cygwin.com/mailman/listinfo/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
Errors-To:	cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com
Sender:	"Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>

On Mon, 17 Jan 2022 13:11:46 +0100
Corinna Vinschen wrote:
> On Jan 17 20:41, Takashi Yano wrote:
> > On Mon, 17 Jan 2022 12:01:51 +0100
> > Corinna Vinschen wrote:
> > > On Jan 15 19:20, Takashi Yano wrote:
> > > > I also found the following patch fixes the issue. Is this the
> > > > right thing?
> > > > 
> > > > diff --git a/winsup/cygwin/fhandler.cc b/winsup/cygwin/fhandler.cc
> > > > index fc7c0422e..e51208117 100644
> > > > --- a/winsup/cygwin/fhandler.cc
> > > > +++ b/winsup/cygwin/fhandler.cc
> > > > @@ -441,7 +441,7 @@ fhandler_base::open_with_arch (int flags, mode_t mode)
> > > >  	|| open (flags, mode & 07777)))
> > > >      {
> > > >        if (archetype)
> > > > -	delete archetype;
> > > > +	cygheap->fdtab.delete_archetype (archetype);
> > > >      }
> > > >    else if (archetype)
> > > >      {
> > > 
> > > Good catch!  I think this is basically ok, but you have to check the
> > > usecount, i. e.
> > > 
> > >   if (archetype && archetype_usecount (-1) == 0)
> > >     cygheap->fdtab.delete_archetype (archetype);
> > > 
> > > Does that sound right?
> > 
> > Where is archetype->usecount is incremented?
> 
> In fhandler_base::open_with_arch.
> 
> > It seems that
> > archetype->usecount is zero here. archetype->usecount is not
> > incremented around line 672 in dtable.cc when archetype is
> > created by fh->clone().
> > 
> >   else
> >     {
> >       if (!fh->get_name ())
> >         fh->set_name (fh->dev ().native ());
> >       fh->archetype = fh->clone ();
> >       debug_printf ("created an archetype (%p) for %s(%d/%d)", fh->archetype, fh->get_name (), fh->dev ().get_major (), fh->dev ().get_minor ());
> >       fh->archetype->archetype = NULL;
> >       *cygheap->fdtab.add_archetype () = fh->archetype;
> >     }
> 
> Right, but if open isn't called, because you already have an archetype
> at this point:
> 
>   if (!(res = (archetype && archetype->io_handle)
>         || open (flags, mode & 07777)))
> 
> Then the archetype is one already created by a former open_with_arch
> call and then you delete an archetype which is still in use, no?

archetype->usecount is not incremented yet here.
archetype->usecount is incremented only when this 'if' clause
is not true. So, isn't the following code right?

  if (!(res = (archetype && archetype->io_handle)
        || open (flags, mode & 07777)))
    {
      if (archetype && archetype->usecount == 0)
        cygheap->fdtab.delete_archetype (archetype);
    }


-- 
Takashi Yano <takashi DOT yano AT nifty DOT ne DOT jp>

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

- Raw text -