DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:reply-to:in-reply-to:references
	:from:date:message-id:subject:to:content-type; q=dns; s=default; b=
	SIA/6kNK7tm77PmGEnnoDYQDoBgtvR/XB1DEMV3LerfSGBiLYz+bhv8lFoogOMl4
	ztYnF5R+OLEhchpR97n+FKvqz3gzGtmO8/RhrmyxiDg1EkKnJ7WavSwhjXlL7j51
	1bwnFmyiJUCd9jiemm49xR6k8u2ZJGz0wQXGUxLi0X0=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
MIME-Version: 1.0
Reply-To: fracting@gmail.com
In-Reply-To: <CALd+sZRo_Nyv=adF5DeeHiShJsxGD+KUPqkDMKb3q47a2Nm=8Q@mail.gmail.com>
References: <CALd+sZRo_Nyv=adF5DeeHiShJsxGD+KUPqkDMKb3q47a2Nm=8Q@mail.gmail.com>
From: Qian Hong <fracting@gmail.com>
Date: Tue, 8 Sep 2015 02:41:53 +0800
Message-ID: <CALd+sZSUAt6_fdHkgdKqefz1Wv-ijShSo82qJKUcCkZH9v5KzA@mail.gmail.com>
Subject: Re: Question about flock - potential memory corruption?
To: cygwin <cygwin@cygwin.com>
Content-Type: text/plain; charset=UTF-8

Hi,

I was still not able to make valgrind display Cygwin symbols, so I
manually translate the address to line this time.

Tested with
$ uname -a
CYGWIN_NT-5.1  2.2.1(0.289/5/3) 2015-08-20 11:40 i686 Cygwin

==29863== Conditional jump or move depends on uninitialised value(s)
==29863==    at 0x7BC82768: RtlGetOwnerSecurityDescriptor (sec.c:740)
==29863==    by 0x7BC92356: NTDLL_create_struct_sd (sync.c:96)
==29863==    by 0x7BC92E10: NtCreateEvent (sync.c:294)
==29863==    by 0x6107B937: ???
==29863==    by 0x61304697: ???

Here 0x6107b937 is the call to NtCreateEvent() inside
lockf_t::create_lock_obj() at:
https://cygwin.com/git/gitweb.cgi?p=newlib-cygwin.git;a=blob;f=winsup/cygwin/flock.cc;h=2332f5467e37d124acfd12c0f85a30281f10a952;hb=HEAD#l772

(I can't explain what the address 0x61304697 means, it seems a bit
weird to me, not sure if it is valgrind related)

Related Wine source code:
https://github.com/wine-compholio/wine-patched/blob/8b3a785e97a7e28ff58731b58d19237a59239acc/dlls/ntdll/sync.c#L294
https://github.com/wine-compholio/wine-patched/blob/8b3a785e97a7e28ff58731b58d19237a59239acc/dlls/ntdll/sync.c#L96
https://github.com/wine-compholio/wine-patched/blob/8b3a785e97a7e28ff58731b58d19237a59239acc/dlls/ntdll/sec.c#L740

According to valgrind, lpsd->Control in
RtlGetOwnerSecurityDescriptor() is uninitialized, which means
((SECURITY_DESCRIPTOR*)attr->SecurityDescriptor)->Control in
NtCreateEvent(,attr,) is not initialized, that's why I'm looking at
create_lock_obj_attr() and everyone_sd(). It seems after
create_lock_obj_attr returned the memory allocated by alloca() is
gone, which cause the valgrind warnings, also cause the random
failures.

If there is any further information required I'm glad to test and provide.

Any comments are great appreciated!

Thanks again!

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple