From: Mathieu Othacehe <othacehe@gnu.org>
To: "Ludovic Courtès" <ludo@gnu.org>
Cc: 58732@debbugs.gnu.org
Subject: bug#58732: installer: finalizers & device destroy segfault
Date: Wed, 09 Nov 2022 16:25:55 +0100 [thread overview]
Message-ID: <87tu38m9oc.fsf@gnu.org> (raw)
In-Reply-To: <8735auwwjf.fsf@gnu.org> (Mathieu Othacehe's message of "Mon, 07 Nov 2022 17:37:24 +0100")
[-- Attachment #1: Type: text/plain, Size: 934 bytes --]
Hey,
I ran further tests and my understanding is that the weak hash-table /
finalizer mechanism is not compatible with a C function that can return
multiple times the same allocated object.
Even if we were to introduce a set-pointer-unique-finalizer! procedure
that calls scm_i_set_finalizer instead of scm_i_add_finalizer we would
still have double free errors because the finalizers are registered on
SCM pointers and not on libparted C pointers when calling
GC_REGISTER_FINALIZER_NO_ORDER.
I tested it out and I had several SCM pointers encapsulating the same
libparted C pointer, thus multiple finalizers on the same underlying C
pointer.
Anyway, here is a patch that solves the issue by removing the device
finalizer. It also means that all devices are persisted until the end of
the program which doesn't feel right, but I cannot think of a better
solution.
Let me know if you agree with my reasoning :)
Thanks,
Mathieu
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0001-Remove-the-finalizer-on-device-pointers.patch --]
[-- Type: text/x-patch, Size: 2238 bytes --]
From 066220a75c020b818aab9c2f5c3a7db835fa871a Mon Sep 17 00:00:00 2001
From: Mathieu Othacehe <othacehe@gnu.org>
Date: Wed, 9 Nov 2022 16:12:52 +0100
Subject: [PATCH 1/1] Remove the finalizer on device pointers.
Fixes: <https://issues.guix.gnu.org/58732>
* parted/device.scm (%device-destroy): Remove it.
(pointer->device!): Do not set a finalizer.
---
parted/device.scm | 25 ++++++++++++++-----------
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/parted/device.scm b/parted/device.scm
index 56a774b..be7f0ac 100644
--- a/parted/device.scm
+++ b/parted/device.scm
@@ -43,20 +43,23 @@
device-get-minimum-alignment
device-get-optimum-alignment))
-;; Record all devices, so that pointer finalizers are only set once,
-;; even if get-device returns an already known pointer. Use the
-;; pointer as key and the associated <device> as value.
-(define %devices (make-weak-value-hash-table))
-
-(define %device-destroy
- (libparted->pointer "ped_device_destroy"))
-
+;; Record all devices, so that we do not end up with different <device>
+;; objects aliasing the same underlying C pointer. Use the pointer as key and
+;; the associated <device> as value.
+(define %devices (make-hash-table))
+
+;; %DEVICES was a weak hash-table and we used to set a finalizer on POINTER.
+;; This is inevitably causing double free issues for the following reason:
+;;
+;; When <device> goes out of scope and is removed from the %DEVICES table, the
+;; finalizer that is set on the underlying C pointer is still registered but
+;; possibly not called as finalization happens is a separate thread. If a
+;; subsequent call to ped_device_get returns the same C pointer, another
+;; finalizer will be registered. This means that the finalization function
+;; can be called twice on the same pointer, causing a double free issue.
(define (pointer->device! pointer)
- ;; Check if a finalizer is already registered for this pointer.
(or (hash-ref %devices pointer)
(let ((device (pointer->device pointer)))
- ;; Contrary to its name, this "adds" a finalizer.
- (set-pointer-finalizer! pointer %device-destroy)
(hash-set! %devices pointer device)
device)))
--
2.38.0
next prev parent reply other threads:[~2022-11-09 15:27 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-23 9:07 bug#58732: installer: finalizers & device destroy segfault Mathieu Othacehe
2022-11-02 10:55 ` Ludovic Courtès
2022-11-03 11:09 ` Mathieu Othacehe
2022-11-03 11:25 ` Ludovic Courtès
2022-11-06 17:17 ` Mathieu Othacehe
2022-11-07 13:29 ` Ludovic Courtès
2022-11-07 16:37 ` Mathieu Othacehe
2022-11-09 15:25 ` Mathieu Othacehe [this message]
2022-11-10 11:42 ` Ludovic Courtès
2022-11-10 12:29 ` Mathieu Othacehe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87tu38m9oc.fsf@gnu.org \
--to=othacehe@gnu.org \
--cc=58732@debbugs.gnu.org \
--cc=ludo@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).