DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 562EInkI3847241
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 20E60385DDE3
Subject: Re: Segfault if /proc/PID/maps is opened in parallel threads [CAUSE:
 RtlQueryProcessDebugInformation]
To: cygwin AT cygwin DOT com
References: <2f7ae08b-80c9-4497-f07c-5d527bbb7ec2 AT t-online DOT de>
 <17bba06c-4bdd-01df-8477-235aff98b2cb AT t-online DOT de>
 <9deb7d60-b05d-ad7f-e316-64781687953b AT t-online DOT de>
Message-ID: <68cbc37b-4825-6e3f-5918-f4fee20d7c05@t-online.de>
Date: Wed, 2 Jul 2025 16:18:13 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101
 SeaMonkey/2.53.20
MIME-Version: 1.0
In-Reply-To: <9deb7d60-b05d-ad7f-e316-64781687953b@t-online.de>
Content-Type: multipart/mixed; boundary="------------87FF849F1191D93AFF3A3638"
Precedence: list
From: Christian Franke via Cygwin <cygwin AT cygwin DOT com>
Reply-To: cygwin AT cygwin DOT com
Cc: Christian Franke <Christian DOT Franke AT t-online DOT de>
Errors-To: cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>

This is a multi-part message in MIME format.
--------------87FF849F1191D93AFF3A3638
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

On Tue, 27 May 2025 17:44:10 +0200 Christian Franke wrote:
> On Sun, 25 May 2025 16:46:49 +0200, Christian Franke wrote:
>> On Sat, 24 May 2025 15:19:10 +0200, Christian Franke wrote:
>>> If /proc/PID/maps is opened in parallel threads, the process PID may 
>>> segfault.
>>>
>>> Testcase:
>>>
>>> ...
>>>
>>> Problem is not reproducible with any of the other /proc/PID/* files.
>>>
>>
>> A closer look shows that the problem is unrelated to thread safety. 
>> The segfault also occurs when the following command is run 
>> simultaneously in two terminals:
>>
>> $ while cat /proc/1234/maps > /dev/null; do printf .; done
>> .............cat: /proc/1234/maps: No such file or directory
>>
>
> The root of the problem is the call of 
> RtlQueryProcessDebugInformation() here:
> https://cygwin.com/git/?p=newlib-cygwin.git;a=blob;f=winsup/cygwin/fhandler/process.cc;h=8fae9be5#l630 
>
>
> If this part is removed, the segfault does no longer occur. Then 
> /proc/PID/maps still work but the "[win heap ...]" information is 
> missing. No patch provided because I don't know whether this could 
> possibly be fixed without removing this functionality.
>
> A test with a separate test program shows that the problem is 
> unrelated to Cygwin: Parallel calls to 
> RtlQueryProcessDebugInformation() with the same PID could be used to 
> crash this process. It also "worked" with Notepad.exe.
>
> Possible Windows (Version 10.0.22631.5039) bug?
>

Testcase (attached):

$ gcc -o querydebug querydebug.c -lntdll

$ sleep 3600 &
[1] 3940

$ ps -p 3940
       PID    PPID    PGID     WINPID   TTY         UID    STIME COMMAND
      3940    1379    3940      18036  pty0      197609 15:52:50 
/usr/bin/sleep

$ while ./querydebug 18036; do printf .; done & \
while ./querydebug 18036; do printf +; done
[2] 3943
.+.+.+.+.+RtlQueryProcessDebugInformation(): NTSTATUS = 0xC0000005
+RtlQueryProcessDebugInformation(): NTSTATUS = 0xC000000B
[1]-  Done                    sleep 3600
[2]+  Done                   while ./querydebug ...


Conclusion: Possible Windows bug in RtlQueryProcessDebugInformation(). 
Cygwin should not use this function to provide "nice to have" types of 
information like "[win heap...]" if this may crash the target process.

-- 
Regards,
Christian


--------------87FF849F1191D93AFF3A3638
Content-Type: text/plain; charset=UTF-8;
 name="querydebug.c"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename="querydebug.c"

I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RkbGliLmg+DQojaW5jbHVkZSA8d2lu
ZG93cy5oPg0KDQovLyBGcm9tIG50ZGxsLmgNCnR5cGVkZWYgc3RydWN0IHsgaW50IGR1bW15
OyB9ICpQREVCVUdfQlVGRkVSOw0KUERFQlVHX0JVRkZFUiBSdGxDcmVhdGVRdWVyeURlYnVn
QnVmZmVyIChVTE9ORywgQk9PTEVBTik7DQpOVFNUQVRVUyBSdGxRdWVyeVByb2Nlc3NEZWJ1
Z0luZm9ybWF0aW9uIChVTE9ORywgVUxPTkcsIFBERUJVR19CVUZGRVIpOw0KTlRTVEFUVVMg
UnRsRGVzdHJveVF1ZXJ5RGVidWdCdWZmZXIgKFBERUJVR19CVUZGRVIpOw0KI2RlZmluZSBQ
RElfSEVBUFMgMHgwNA0KI2RlZmluZSBQRElfSEVBUF9CTE9DS1MgMHgxMA0KLy8gRnJvbSBu
dGRsbC5oIGVuZA0KDQppbnQgbWFpbihpbnQgYXJnYywgY2hhciAqKmFyZ3YpDQp7DQogIGlm
IChhcmdjICE9IDIpIHsNCiAgICBwcmludGYoIlVzYWdlOiAlcyBXSU5QSURcbiIsIGFyZ3Zb
MF0pOyByZXR1cm4gMTsNCiAgfQ0KICBpbnQgcGlkID0gYXRvaShhcmd2WzFdKTsNCiAgUERF
QlVHX0JVRkZFUiBidWYgPSBSdGxDcmVhdGVRdWVyeURlYnVnQnVmZmVyKDB4MTAwMDAwLCBG
QUxTRSk7DQogIGlmICghYnVmKSB7DQogICAgcHJpbnRmKCJSdGxDcmVhdGVRdWVyeURlYnVn
QnVmZmVyKCk6IGZhaWxlZFxuIik7IHJldHVybiAxOw0KICB9DQogIE5UU1RBVFVTIHMgPSBS
dGxRdWVyeVByb2Nlc3NEZWJ1Z0luZm9ybWF0aW9uKHBpZCwNCiAgICAgICAgICAgICAgICAg
UERJX0hFQVBTIHwgUERJX0hFQVBfQkxPQ0tTLCBidWYpOw0KICBSdGxEZXN0cm95UXVlcnlE
ZWJ1Z0J1ZmZlcihidWYpOw0KICBpZiAocyA8IDApIHsNCiAgICAvLyBPYnNlcnZlZDoNCiAg
ICAvLyBTVEFUVVNfQUNDRVNTX1ZJT0xBVElPTiAoMHhDMDAwMDAwNSkNCiAgICAvLyBTVEFU
VVNfSU5WQUxJRF9DSUQgKDB4QzAwMDAwMEIpDQogICAgLy8gU1RBVFVTX1BST0NFU1NfSVNf
VEVSTUlOQVRJTkcgKDB4QzAwMDAxMEEpDQogICAgcHJpbnRmKCJSdGxRdWVyeVByb2Nlc3NE
ZWJ1Z0luZm9ybWF0aW9uKCk6IE5UU1RBVFVTID0gMHglWFxuIiwgcyk7DQogICAgcmV0dXJu
IDE7DQogIH0NCiAgcmV0dXJuIDA7DQp9DQo=
--------------87FF849F1191D93AFF3A3638
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

--------------87FF849F1191D93AFF3A3638--