Cygwin 3.7.0-0.569.g524d75ff regression: segfault on parallel open of /proc/PID/fd/*

[Christian Franke]

On Sat, 25 Jul 2026 23:51:56 +0900, Takashi Yano via Cygwin wrote:

> Hi Christian,
>
> Thanks for the report.
>
> On Sat, 25 Jul 2026 15:12:54 +0200
> Christian Franke wrote:
>
>> After 524d75ff ("Cygwin: open: Unlock fdtab before open_with_arch()"),
>> CI workflow shows that 'stress-ng --procfs ...' now hangs.
>>
>> Testcase:
>>
>> $ uname -r # not with 3.7.0-0.567.g161e3cb999fb.x86_64
>> 3.7.0-0.569.g524d75ff7398.x86_64
>>
>> $ cat proc-self-fd.c
>> #include <errno.h>
>> #include <fcntl.h>
>> #include <pthread.h>
>> #include <stdio.h>
>> #include <unistd.h>
>>
>> static void * threadfunc(void * arg)
>> {
>>     (void)arg;
>>     for (int i = 0; i < 100000; i++) {
>>       char path[32];
>>       snprintf(path, sizeof(path), "/proc/self/fd/%d", i % 10);
>>       int fd = open(path, O_RDONLY);
>>       if (fd < 0) {
>>         printf("%p#%06d: %s: errno=%d\n", pthread_self(), i, path, errno);
>>         continue;
>>       }
>>       printf("%p#%06d: %s: fd=%d\n", pthread_self(), i, path, fd);
>>       close(fd);
>>     }
>>     return NULL;
>> }
>>
>> int main()
>> {
>>     pthread_t t = NULL;
>>     int ret = pthread_create(&t, NULL, threadfunc, NULL);
>>     if (ret)
>>       return 1;
>>     threadfunc(NULL);
>>     ret = pthread_join(t, NULL);
>>     printf("pthread_join(%p, .)=%d\n", t, ret);
>>     if (ret)
>>       return 1;
>>     return 0;
>> }
>>
>> $ gcc -o proc-self-fd proc-self-fd.c
>>
>> $ ./proc-self-fd
>> ...
>> 0xa00000500#001908: /proc/self/fd/8: errno=2
>> 0xa00000010#001900: /proc/self/fd/0: fd=3
>> 0xa00000500#001909: /proc/self/fd/9: errno=2
>> 0xa00000010#001901: /proc/self/fd/1: errno=14<== EFAULT
>> [hangs, kill -9 does not work]
>>
>> $ strace -o trace.log ./proc-self-fd
>> [taskkill /f /im proc-self-fd.exe in other window]
>>
>> $ less trace.log
>> ...
>>      25   21725 [main] proc-self-fd 14876 fhandler_pty_slave::open_setup:
>> /dev/pty1 opened, usecount 3
>>      61   21786 [main] proc-self-fd 14876 build_fh_pc: found an archetype
>> for (null)(136/1) io_handle 0x200
>>      66   21852 [main] proc-self-fd 14876 build_fh_pc: fh 0x800008E40,
>> dev 00880001
>>      71   21923 [main] proc-self-fd 14876 fhandler_base::open_with_arch:
>> line 471: /dev/pty1<0x8000086F0> usecount + 1 = 4
>> --- Process 3968 (pid: 14876), exception c0000008 at 00007ff81682416a
>> --- Process 3968 (pid: 14876), exception c0000008 at 00007ff81682416a
>> ...
>>
>>
>> "... found an archetype for (null) ..." <== Hmm...
> Perhaps, this is due to the defects pointed out by Johannes.
> https://cygwin.com/pipermail/cygwin-patches/2026q3/015227.html
>

These are possibly fixed now. With 3.7.0-0.579.g61b4866baf41, the above 
testcase completes as expected.

-- 
Regards,
Christian