X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:reply-to:in-reply-to:references
	:from:date:message-id:subject:to:content-type; q=dns; s=default; b=
	SIA/6kNK7tm77PmGEnnoDYQDoBgtvR/XB1DEMV3LerfSGBiLYz+bhv8lFoogOMl4
	ztYnF5R+OLEhchpR97n+FKvqz3gzGtmO8/RhrmyxiDg1EkKnJ7WavSwhjXlL7j51
	1bwnFmyiJUCd9jiemm49xR6k8u2ZJGz0wQXGUxLi0X0=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:reply-to:in-reply-to:references
	:from:date:message-id:subject:to:content-type; s=default; bh=gTB
	9JU8Vs+Vkgk/yaaTM7ifG+bg=; b=tYMzcrDRZGI0oHN+aOlL36DnSb2LvLzjFGr
	pgvNcfQEd14xyY/CsGP7rL5Z+fomDNQi+y/DPSf0dJ9jQnXsrLwv2MN+RlJSzkmS
	oYYAIZ34V9Dw0lOKnh03lPe/iJ7HZ5FqWm+5b2pDV7lZutMzlYz4gIYoEToWeydu
	PnqH+ZYs=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-1.0 required=5.0 tests=AWL,BAYES_00,FREEMAIL_FROM,RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2
X-HELO: mail-wi0-f175.google.com
X-Received: by 10.180.89.99 with SMTP id bn3mr35995917wib.61.1441651353548; Mon, 07 Sep 2015 11:42:33 -0700 (PDT)
MIME-Version: 1.0
Reply-To: fracting AT gmail DOT com
In-Reply-To: <CALd+sZRo_Nyv=adF5DeeHiShJsxGD+KUPqkDMKb3q47a2Nm=8Q@mail.gmail.com>
References: <CALd+sZRo_Nyv=adF5DeeHiShJsxGD+KUPqkDMKb3q47a2Nm=8Q AT mail DOT gmail DOT com>
From: Qian Hong <fracting AT gmail DOT com>
Date: Tue, 8 Sep 2015 02:41:53 +0800
Message-ID: <CALd+sZSUAt6_fdHkgdKqefz1Wv-ijShSo82qJKUcCkZH9v5KzA@mail.gmail.com>
Subject: Re: Question about flock - potential memory corruption?
To: cygwin <cygwin AT cygwin DOT com>
Content-Type: text/plain; charset=UTF-8
X-IsSubscribed: yes

Hi,

I was still not able to make valgrind display Cygwin symbols, so I
manually translate the address to line this time.

Tested with
$ uname -a
CYGWIN_NT-5.1  2.2.1(0.289/5/3) 2015-08-20 11:40 i686 Cygwin

==29863== Conditional jump or move depends on uninitialised value(s)
==29863==    at 0x7BC82768: RtlGetOwnerSecurityDescriptor (sec.c:740)
==29863==    by 0x7BC92356: NTDLL_create_struct_sd (sync.c:96)
==29863==    by 0x7BC92E10: NtCreateEvent (sync.c:294)
==29863==    by 0x6107B937: ???
==29863==    by 0x61304697: ???

Here 0x6107b937 is the call to NtCreateEvent() inside
lockf_t::create_lock_obj() at:
https://cygwin.com/git/gitweb.cgi?p=newlib-cygwin.git;a=blob;f=winsup/cygwin/flock.cc;h=2332f5467e37d124acfd12c0f85a30281f10a952;hb=HEAD#l772

(I can't explain what the address 0x61304697 means, it seems a bit
weird to me, not sure if it is valgrind related)

Related Wine source code:
https://github.com/wine-compholio/wine-patched/blob/8b3a785e97a7e28ff58731b58d19237a59239acc/dlls/ntdll/sync.c#L294
https://github.com/wine-compholio/wine-patched/blob/8b3a785e97a7e28ff58731b58d19237a59239acc/dlls/ntdll/sync.c#L96
https://github.com/wine-compholio/wine-patched/blob/8b3a785e97a7e28ff58731b58d19237a59239acc/dlls/ntdll/sec.c#L740

According to valgrind, lpsd->Control in
RtlGetOwnerSecurityDescriptor() is uninitialized, which means
((SECURITY_DESCRIPTOR*)attr->SecurityDescriptor)->Control in
NtCreateEvent(,attr,) is not initialized, that's why I'm looking at
create_lock_obj_attr() and everyone_sd(). It seems after
create_lock_obj_attr returned the memory allocated by alloca() is
gone, which cause the valgrind warnings, also cause the random
failures.

If there is any further information required I'm glad to test and provide.

Any comments are great appreciated!

Thanks again!

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple