X-Recipient: archive-cygwin AT delorie DOT com
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org D5CE6385800D
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1642421674;
	bh=rNMUG+7du/mtzzjHqVGtuVK3hxja7CU2isZbHHphjHs=;
	h=Date:From:To:Subject:References:In-Reply-To:List-Id:
	 List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe:
	 Reply-To:From;
	b=nhhall687UarXPcDWdnd3CQAPOi1gjdLf4QDA4SkA9ZephrLE9pLTShcVvfoAT+wi
	 z37vSKJGG2k9Fr7jYz1jpFVfKlCP1YORjIeoQrW9NY/WbOext5/3QWfKB9MVBhum4u
	 CC3Dd8uMjc8u58xapdfX34viuAElUL7tZPH1Oa1g=
X-Original-To: cygwin AT cygwin DOT com
Delivered-To: cygwin AT cygwin DOT com
DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 14A9F3858018
Authentication-Results: sourceware.org;
 dmarc=fail (p=none dis=none) header.from=cygwin.com
Authentication-Results: sourceware.org; spf=fail smtp.mailfrom=cygwin.com
Date: Mon, 17 Jan 2022 13:11:46 +0100
From: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To: cygwin AT cygwin DOT com
Subject: Re: Segmentation fault due to double free for archetype.
Message-ID: <YeVdAnpZ0eUAfEoF@calimero.vinschen.de>
Mail-Followup-To: cygwin AT cygwin DOT com
References: <20220115192030 DOT de26356820d839eec3227e70 AT nifty DOT ne DOT jp>
 <YeVMn4MIgG+6T01I AT calimero DOT vinschen DOT de>
 <20220117204131 DOT b1b3e221874af6804791ccec AT nifty DOT ne DOT jp>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <20220117204131.b1b3e221874af6804791ccec@nifty.ne.jp>
X-Provags-ID: V03:K1:jPMPKy5skCOoTOGux4FtAXUQJeil/b3LgVgmiip/1c46/DZqHnl
 DST244lxBnW+yKBpBrwCoZKYe1Ynnh3o8mF8CgC16XCjYVvBeT4uipVgtL7EeAfWGYTCcwi
 YHCj3SekG0luXPvAWmsdPMv6plnPYLZYJjvpalg55Rvh3QaNERG+QFX6lr3FoLpXxTdE1by
 PaM6dt0Y4X1rfofnfdQrA==
X-UI-Out-Filterresults: notjunk:1;V03:K0:DS4ECZtEGY0=:rdlxQ1ENRbOh2g+JV1u32V
 dYuobB3NCL6s8EyOQQb6hyKeaDU1mAuL9+RiShK9+Yz9wizmD/qDXu7R6Ln2Kjj6hgjIQg7Ki
 FwpiQV4yEKFWgztYNG+fhFlhE5tdEu3ejvCH6XAsMTuWHUukBSr7YRMRgUXEoYOwYPe76tGL5
 P3CdoaMgnS3kxsKyoNU+0w3cbUJTqWpIPzEuz1Ls3FMtFMPNOJhZNmAnZblmbpq/KBN19/bCj
 ps+dRQjDeUq0txQyMMO+YwyoQ/O6TM3vQS6zNzzo4+7ShlchFzTbEiVUHdkVo2R2mbEJtFlUG
 2EmXNQv/Y+VHPyQEqBi1GHwGXM2ZPT9nUxS/M+TgN+N0IK9mi7YHQESEDsgBvPljMzpXCPfF1
 CoBwszJVK9Gf3BYa30GszDkVNEFGxP5D16YHv+BahZGeICMuxvsRfbHKpQXCLr1zcsHL/4kt3
 azIFHGQAoAbdnq6R/XDc7W7wj+fnNPXN94MseL/foUW2S/CBCRQ8rMdsn1U6Pt5eRImRlj25E
 YXgL5dvkcs2CrEt0HamFq614mishp+AjQmkzYwrtGKm5cnHBahqg5hCI42PM7UAvc91KFNWMO
 Jq0HkYgHEoNqqerEJOOi7ylSrH42qASxgjJ5/BzvN8FQnTiDI03iAZch8Pb8arVyxSiBp686+
 cvqIEAcX39mxG3XMFh9ZyjR/q4qlTUqQpMTsoR0Tc7ykDe8xtRlkZNPxi7B8y2T7hNPin3lqu
 QO/dGS+yIYSj3+Nh
X-Spam-Status: No, score=-102.0 required=5.0 tests=BAYES_00, GIT_PATCH_0,
 GOOD_FROM_CORINNA_CYGWIN, KAM_DMARC_NONE, KAM_DMARC_STATUS, RCVD_IN_DNSWL_NONE,
 RCVD_IN_MSPIKE_H5, RCVD_IN_MSPIKE_WL, SPF_FAIL, SPF_HELO_NONE,
 TXREP autolearn=ham autolearn_force=no version=3.4.4
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on
 server2.sourceware.org
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe: <https://cygwin.com/mailman/options/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=unsubscribe>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
Reply-To: cygwin AT cygwin DOT com
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>

On Jan 17 20:41, Takashi Yano wrote:
> On Mon, 17 Jan 2022 12:01:51 +0100
> Corinna Vinschen wrote:
> > On Jan 15 19:20, Takashi Yano wrote:
> > > I also found the following patch fixes the issue. Is this the
> > > right thing?
> > > 
> > > diff --git a/winsup/cygwin/fhandler.cc b/winsup/cygwin/fhandler.cc
> > > index fc7c0422e..e51208117 100644
> > > --- a/winsup/cygwin/fhandler.cc
> > > +++ b/winsup/cygwin/fhandler.cc
> > > @@ -441,7 +441,7 @@ fhandler_base::open_with_arch (int flags, mode_t mode)
> > >  	|| open (flags, mode & 07777)))
> > >      {
> > >        if (archetype)
> > > -	delete archetype;
> > > +	cygheap->fdtab.delete_archetype (archetype);
> > >      }
> > >    else if (archetype)
> > >      {
> > 
> > Good catch!  I think this is basically ok, but you have to check the
> > usecount, i. e.
> > 
> >   if (archetype && archetype_usecount (-1) == 0)
> >     cygheap->fdtab.delete_archetype (archetype);
> > 
> > Does that sound right?
> 
> Where is archetype->usecount is incremented?

In fhandler_base::open_with_arch.

> It seems that
> archetype->usecount is zero here. archetype->usecount is not
> incremented around line 672 in dtable.cc when archetype is
> created by fh->clone().
> 
>   else
>     {
>       if (!fh->get_name ())
>         fh->set_name (fh->dev ().native ());
>       fh->archetype = fh->clone ();
>       debug_printf ("created an archetype (%p) for %s(%d/%d)", fh->archetype, fh->get_name (), fh->dev ().get_major (), fh->dev ().get_minor ());
>       fh->archetype->archetype = NULL;
>       *cygheap->fdtab.add_archetype () = fh->archetype;
>     }

Right, but if open isn't called, because you already have an archetype
at this point:

  if (!(res = (archetype && archetype->io_handle)
        || open (flags, mode & 07777)))

Then the archetype is one already created by a former open_with_arch
call and then you delete an archetype which is still in use, no?


Corinna

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple