Re: On exit, winsup/cygwin/fhandler/console.cc waits on closed handle, deadlock possible

On Thu, 14 May 2026 23:11:48 +0300
Ivan Krylov wrote:
> On Wed, 13 May 2026 12:59:59 +0300
> Ivan Krylov <[email protected]> wrote:
> 
> > I think it doesn't close the race window completely.
> 
> Here's a patch that I have more confidence in:
> 
> diff --git a/winsup/cygwin/fhandler/console.cc b/winsup/cygwin/fhandler/console.cc
> index c76347f6f..a97df4cef 100644
> --- a/winsup/cygwin/fhandler/console.cc
> +++ b/winsup/cygwin/fhandler/console.cc
> @@ -62,6 +62,7 @@ fhandler_console::console_state NO_COPY
>  
>  static bool NO_COPY inside_pcon_checked = false;
>  static bool NO_COPY inside_pcon = false;
> +static LONG NO_COPY inside_pcon_cleanup = 0;
>  static int NO_COPY parent_pty;
>  static HANDLE NO_COPY parent_pty_input_mutex = NULL;
>  
> @@ -530,8 +531,13 @@ fhandler_console::cons_master_thread (handle_set_t *p, tty *ttyp)
>  	default: /* Error */
>  	  free (input_rec);
>  	  free (input_tmp);
> -	  if (inside_pcon && parent_pty_input_mutex)
> +	  if (inside_pcon && parent_pty_input_mutex) {
>  	    ReleaseMutex (parent_pty_input_mutex);
> +	    if (InterlockedCompareExchange(&inside_pcon_cleanup, 0, 0)) {
> +	      ForceCloseHandle (parent_pty_input_mutex);
> +	      inside_pcon = false;
> +	    }
> +	  }
>  	  ReleaseMutex (p->input_mutex);
>  	  return;
>  	}
> @@ -713,8 +719,13 @@ remove_record:
>  	  while (true);
>  	}
>  skip_writeback:
> -      if (inside_pcon && parent_pty_input_mutex)
> +      if (inside_pcon && parent_pty_input_mutex) {
>  	ReleaseMutex (parent_pty_input_mutex);
> +	if (InterlockedCompareExchange(&inside_pcon_cleanup, 0, 0)) {
> +	  ForceCloseHandle (parent_pty_input_mutex);
> +	  inside_pcon = false;
> +	}
> +      }
>        ReleaseMutex (p->input_mutex);
>        cygwait (40);
>      }
> @@ -2048,7 +2059,7 @@ fhandler_console::pcon_hand_over_proc (void)
>    else
>      system_printf("Acquiring pcon_ho_mutex failed.");
>    ReleaseMutex (mtx);
> -  ForceCloseHandle (parent_pty_input_mutex);
> +  InterlockedExchange(&inside_pcon_cleanup, 1);
>  }
>  
>  bool
> 
> Instead of manipulating the mutex handle shared between threads and
> leaving a race window between if(parent_pty_input_mutex) and
> WaitForSingleObject(parent_pty_input_mutex, ...), tell the
> cons_master_thread to close the handle and stop using it.

Thanks for the report and the patch.

The root cause of the problem is closing parent_pty_input_mutex before
stopping cons_master_thread.

What abount just moving
> -  ForceCloseHandle (parent_pty_input_mutex);
into fhandler_console::close() like:

diff --git a/winsup/cygwin/fhandler/console.cc b/winsup/cygwin/fhandler/console.cc
index c76347f6f..c4950885a 100644
--- a/winsup/cygwin/fhandler/console.cc
+++ b/winsup/cygwin/fhandler/console.cc
@@ -2048,7 +2048,6 @@ fhandler_console::pcon_hand_over_proc (void)
   else
     system_printf("Acquiring pcon_ho_mutex failed.");
   ReleaseMutex (mtx);
-  ForceCloseHandle (parent_pty_input_mutex);
 }
 
 bool
@@ -2157,6 +2156,9 @@ fhandler_console::close (int flag)
   CloseHandle (output_mutex);
   output_mutex = NULL;
 
+  ForceCloseHandle (parent_pty_input_mutex);
+  parent_pty_input_mutex = NULL;
+
   WaitForSingleObject (shared_info_mutex, INFINITE);
   if (--shared_info_state[unit] == 0 && shared_console_info[unit])
     {

-- 
Takashi Yano <[email protected]>

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple