DMARC-Filter:	OpenDMARC Filter v1.4.2 delorie.com 5AO3ZFcD1265738
Authentication-Results:	delorie.com; dmarc=pass (p=none dis=none) header.from=cygwin.com
Authentication-Results:	delorie.com; spf=pass smtp.mailfrom=cygwin.com
DKIM-Filter:	OpenDKIM Filter v2.11.0 delorie.com 5AO3ZFcD1265738
Authentication-Results:	delorie.com;
	dkim=pass (1024-bit key, unprotected) header.d=cygwin.com header.i=@cygwin.com header.a=rsa-sha256 header.s=default header.b=K837MKQz
X-Recipient:	archive-cygwin AT delorie DOT com
DKIM-Filter:	OpenDKIM Filter v2.11.0 sourceware.org 343233858C24
DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1763955313;
	bh=NmALFK8GmA/9nmMPiiNCKgauhMAgKZL0fWNMMW7Rrvw=;
	h=Date:To:Subject:In-Reply-To:References:List-Id:List-Unsubscribe:
	List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:
	From;
	b=K837MKQzjdyTtUUm3pBJfqkvHkKfPB1qPkVT+CSBsivO68pTUeMogfUDB/drlIBjr
	Ze1lL6EVQ8ZtBsorSR6a/3BNXZ40LhEmi85huftckkyW0Kj5k8d+hylWi2KfrwM8nL
	MMenDqtOW8RAl+bJ4RjYHwTLs0Ta5mpg/v+tdvAQ=
X-Original-To:	cygwin AT cygwin DOT com
Delivered-To:	cygwin AT cygwin DOT com
DMARC-Filter:	OpenDMARC Filter v1.4.2 sourceware.org 95BA53858D32
ARC-Filter:	OpenARC Filter v1.0.0 sourceware.org 95BA53858D32
ARC-Seal:	i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1763955280; cv=none;
	b=LFzc3YsMufVvzRdsK8yZSwhXe3btEMqEbB9Q5ov0QmFBypFv2cMjP7lSFNWP5UY90uCarZQkj6uusmGo6SN0WRYbsJQVig5Qm8ZnyGLLh++iD06v2McnsUTvUTyC5YvLdB3UrJYbpnHk8B+b8nE7ystGiZYCzzTqeP/rui9n0BU=
ARC-Message-Signature:	i=1; a=rsa-sha256; d=sourceware.org; s=key;
	t=1763955280; c=relaxed/simple;
	bh=zXUMzU49jTK0GUcW5WukJL/AGwPHB0xXEUS8IB7zUDc=;
	h=Date:From:To:Subject:Message-Id:Mime-Version:DKIM-Signature;
	b=xIhVErRPLuqBM2tZ/cOfyzWmV4ft56usgKCYgGD3leEryl2f+fkQhBnR6SyEG+JpGXqMlsm0TE4dd6BcPU49v9vI4qaDVRYtKnSIUeuhIpqEIz5wd7yms9eH4RrPfvUxeKnyZyPQQDi1ldWcwD3qJD+F/DZQQkhjjdwsTyTlpwI=
ARC-Authentication-Results:	i=1; server2.sourceware.org
DKIM-Filter:	OpenDKIM Filter v2.11.0 sourceware.org 95BA53858D32
Date:	Mon, 24 Nov 2025 12:34:35 +0900
To:	cygwin AT cygwin DOT com
Subject:	Re: flock/open random error
Message-Id:	<20251124123435.8404d9771a49eb47a4a54267@nifty.ne.jp>
In-Reply-To:	<aSBLIOHmUlbblgaG@calimero.vinschen.de>
References:	<CA+1R0VjcBajGpLMJ_0Waie0g_5S15_kPfzpT2=GUyN+39RWrMw AT mail DOT gmail DOT com>
	<20251112182412 DOT ba3a65f36838b9b5fd7d3f9b AT nifty DOT ne DOT jp>
	<CA+1R0VjW5rbKAVBb_vAFqKcKmE0yfvOFi6i0-GB=2-mjOhCY7A AT mail DOT gmail DOT com>
	<20251121190009 DOT f08a3229007bbbf101ad1463 AT nifty DOT ne DOT jp>
	<aSBLIOHmUlbblgaG AT calimero DOT vinschen DOT de>
X-Mailer:	Sylpheed 3.7.0 (GTK+ 2.24.30; i686-pc-mingw32)
Mime-Version:	1.0
X-BeenThere:	cygwin AT cygwin DOT com
X-Mailman-Version:	2.1.30
List-Id:	General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe:	<https://cygwin.com/mailman/options/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=unsubscribe>
List-Archive:	<https://cygwin.com/pipermail/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe:	<https://cygwin.com/mailman/listinfo/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From:	Takashi Yano via Cygwin <cygwin AT cygwin DOT com>
Reply-To:	Takashi Yano <takashi DOT yano AT nifty DOT ne DOT jp>
Errors-To:	cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com
Sender:	"Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>

On Fri, 21 Nov 2025 12:21:04 +0100
Corinna Vinschen wrote:
> On Nov 21 19:00, Takashi Yano via Cygwin wrote:
> > On Fri, 14 Nov 2025 11:27:04 -0800
> > Nahor wrote:
> > > If `flock()` was used on the same file descriptor, then this might
> > > have been a valid point. However, each thread has its own file
> > > descriptor in this case, so this would be very surprising if it wasn't
> > > thread-safe.
> > 
> > IIUC, flock() locks file itself, but not file descriptor. Usually,
> > flock() is used for inter-process file protection, isn't it?
> > 
> > > Moreover, it's not just `flock()` failing, it's also (and mostly!)
> > > `open()` that fails. And it's the `open()` for a completely different
> > > file than the one being locked. So that would suggest that `open()` is
> > > not also not MT-safe. And not safe when using different files. And not
> > > safe across multiple different functions (flock+open).
> > 
> > Indeed, this is really weird. I looked into this, and found 'upath' in
> > path.cc is destroyed after 'NtCreateFile()' call at the following line.
> > 
> > I added assertion as follows:
> > 
> > diff --git a/winsup/cygwin/path.cc b/winsup/cygwin/path.cc
> > index 710775e38..562100161 100644
> > --- a/winsup/cygwin/path.cc
> > +++ b/winsup/cygwin/path.cc
> > @@ -3189,6 +3189,8 @@ restart:
> >  	 symlink (which would spoil the task of this method quite a bit).
> >  	 Fortunately it's ignored on most other file systems so we don't have
> >  	 to special case NFS too much. */
> > +      wchar_t c;
> > +      c = upath.Buffer[0];
> >        status = NtCreateFile (&h,
> >  			     READ_CONTROL | FILE_READ_ATTRIBUTES | FILE_READ_EA,
> >  			     &attr, &io, NULL, 0, FILE_SHARE_VALID_FLAGS,
> > @@ -3196,6 +3198,7 @@ restart:
> >  			     FILE_OPEN_REPARSE_POINT
> >  			     | FILE_OPEN_FOR_BACKUP_INTENT,
> >  			     eabuf, easize);
> > +      assert (upath.Buffer[0] == c);
> >        debug_printf ("%y = NtCreateFile (%S)", status, &upath);
> >        /* No right to access EAs or EAs not supported? */
> >        if (!NT_SUCCESS (status)
> > 
> > then, the assertion fails for your test case like:
> > tmp_dir: /tmp/flockAQ4Hbb
> > assertion "upath.Buffer[0] == c" failed: file "../../.././winsup/cygwin/path.cc", line 3201, function: int symlink_info::check(char*, const suffix_info*, fs_info&, path_conv_handle&)
> >                       Abort
> > 
> > Does another thread destroy the puthbuf? But pathbuf is thread local, IIUC.
> > Corinna, have you noticed anything?
> 
> No, I haven't. The tmp_pathbuf buffers are malloced and reused, but they
> are only ever used in the same thread. So afaics, either the buffer gets
> incorrect stored in a global datastructure and overwritten, or there's
> a buffer overflow in the allocation preceeding the upath.Buffer.  That
> could be an application allocation just as well as a DLL allocation.

I found the cause. In flock.cc, lf_setlock() may access tmp_pathbuf
that is already released in lf_clearlock(). See:
https://cygwin.com/pipermail/cygwin-patches/2025q4/014366.html

-- 
Takashi Yano <takashi DOT yano AT nifty DOT ne DOT jp>

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

- Raw text -