Re: On exit, winsup/cygwin/fhandler/console.cc waits on closed handle, deadlock possible

On Mon, 18 May 2026 10:13:26 +0900
Takashi Yano via Cygwin <[email protected]> wrote:
> On Mon, 18 May 2026 10:04:04 +0900
> Takashi Yano wrote:
> > On Thu, 14 May 2026 23:11:48 +0300
> > Ivan Krylov wrote:
> > > On Wed, 13 May 2026 12:59:59 +0300
> > > Ivan Krylov <[email protected]> wrote:
> > > 
> > > > I think it doesn't close the race window completely.
> > > 
> > > Here's a patch that I have more confidence in:
> > > 
> > > diff --git a/winsup/cygwin/fhandler/console.cc b/winsup/cygwin/fhandler/console.cc
> > > index c76347f6f..a97df4cef 100644
> > > --- a/winsup/cygwin/fhandler/console.cc
> > > +++ b/winsup/cygwin/fhandler/console.cc
> > > @@ -62,6 +62,7 @@ fhandler_console::console_state NO_COPY
> > >  
> > >  static bool NO_COPY inside_pcon_checked = false;
> > >  static bool NO_COPY inside_pcon = false;
> > > +static LONG NO_COPY inside_pcon_cleanup = 0;
> > >  static int NO_COPY parent_pty;
> > >  static HANDLE NO_COPY parent_pty_input_mutex = NULL;
> > >  
> > > @@ -530,8 +531,13 @@ fhandler_console::cons_master_thread (handle_set_t *p, tty *ttyp)
> > >  	default: /* Error */
> > >  	  free (input_rec);
> > >  	  free (input_tmp);
> > > -	  if (inside_pcon && parent_pty_input_mutex)
> > > +	  if (inside_pcon && parent_pty_input_mutex) {
> > >  	    ReleaseMutex (parent_pty_input_mutex);
> > > +	    if (InterlockedCompareExchange(&inside_pcon_cleanup, 0, 0)) {
> > > +	      ForceCloseHandle (parent_pty_input_mutex);
> > > +	      inside_pcon = false;
> > > +	    }
> > > +	  }
> > >  	  ReleaseMutex (p->input_mutex);
> > >  	  return;
> > >  	}
> > > @@ -713,8 +719,13 @@ remove_record:
> > >  	  while (true);
> > >  	}
> > >  skip_writeback:
> > > -      if (inside_pcon && parent_pty_input_mutex)
> > > +      if (inside_pcon && parent_pty_input_mutex) {
> > >  	ReleaseMutex (parent_pty_input_mutex);
> > > +	if (InterlockedCompareExchange(&inside_pcon_cleanup, 0, 0)) {
> > > +	  ForceCloseHandle (parent_pty_input_mutex);
> > > +	  inside_pcon = false;
> > > +	}
> > > +      }
> > >        ReleaseMutex (p->input_mutex);
> > >        cygwait (40);
> > >      }
> > > @@ -2048,7 +2059,7 @@ fhandler_console::pcon_hand_over_proc (void)
> > >    else
> > >      system_printf("Acquiring pcon_ho_mutex failed.");
> > >    ReleaseMutex (mtx);
> > > -  ForceCloseHandle (parent_pty_input_mutex);
> > > +  InterlockedExchange(&inside_pcon_cleanup, 1);
> > >  }
> > >  
> > >  bool
> > > 
> > > Instead of manipulating the mutex handle shared between threads and
> > > leaving a race window between if(parent_pty_input_mutex) and
> > > WaitForSingleObject(parent_pty_input_mutex, ...), tell the
> > > cons_master_thread to close the handle and stop using it.
> > 
> > Thanks for the report and the patch.
> > 
> > The root cause of the problem is closing parent_pty_input_mutex before
> > stopping cons_master_thread.
> > 
> > What abount just moving
> > > -  ForceCloseHandle (parent_pty_input_mutex);
> > into fhandler_console::close() like:
> > 
> > diff --git a/winsup/cygwin/fhandler/console.cc b/winsup/cygwin/fhandler/console.cc
> > index c76347f6f..c4950885a 100644
> > --- a/winsup/cygwin/fhandler/console.cc
> > +++ b/winsup/cygwin/fhandler/console.cc
> > @@ -2048,7 +2048,6 @@ fhandler_console::pcon_hand_over_proc (void)
> >    else
> >      system_printf("Acquiring pcon_ho_mutex failed.");
> >    ReleaseMutex (mtx);
> > -  ForceCloseHandle (parent_pty_input_mutex);
> >  }
> >  
> >  bool
> > @@ -2157,6 +2156,9 @@ fhandler_console::close (int flag)
> >    CloseHandle (output_mutex);
> >    output_mutex = NULL;
> >  
> > +  ForceCloseHandle (parent_pty_input_mutex);
> 
> Hmm, this should be:
> +  if (parent_pty_input_mutex)
> +    CloseHandle (parent_pty_input_mutex);
> 
> > +  parent_pty_input_mutex = NULL;
> > +
> >    WaitForSingleObject (shared_info_mutex, INFINITE);
> >    if (--shared_info_state[unit] == 0 && shared_console_info[unit])
> >      {

This might be better:

diff --git a/winsup/cygwin/fhandler/console.cc b/winsup/cygwin/fhandler/console.cc
index c76347f6f..6fd4cd965 100644
--- a/winsup/cygwin/fhandler/console.cc
+++ b/winsup/cygwin/fhandler/console.cc
@@ -2018,7 +2018,6 @@ fhandler_console::setup_pcon_hand_over ()
 	if (get_console_process_id (owner, true, false, false, false))
 	  {
 	    inside_pcon = true;
-	    atexit (fhandler_console::pcon_hand_over_proc);
 	    parent_pty = i;
 	    parent_pty_input_mutex =
 	      cygwin_shared->tty[i]->open_input_mutex (MAXIMUM_ALLOWED);
@@ -2157,6 +2156,8 @@ fhandler_console::close (int flag)
   CloseHandle (output_mutex);
   output_mutex = NULL;
 
+  pcon_hand_over_proc ();
+
   WaitForSingleObject (shared_info_mutex, INFINITE);
   if (--shared_info_state[unit] == 0 && shared_console_info[unit])
     {

-- 
Takashi Yano <[email protected]>

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple