Bug #13076: SEGV in io.c when reading closed stream in Thread

• Status: Closed
• Assignee: nobu (Nobuyoshi Nakada)
• Target version: -
• ruby -v: ruby 2.4.0p0 (2016-12-24 revision 57164) [x86_64-linux]
• Backport: 2.2: DONE, 2.3: DONE, 2.4: DONE

[masa16 (Masahiro Tanaka)]

System: CentOS Linux release 7.3.1611 (Core)
Kernel: 3.10.0-514.2.2.el7.x86_64
GCC: gcc version 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC)

The following script crushes with ruby 2.4.0, 2.3.3 and 2.2.6.

100.times do |i|
  puts "##{i}"
  a = []
  t = []
  10.times do
    r,w = IO.pipe
    a << [r,w]
    t << Thread.new do
      begin
        while r.gets
        end
      rescue IOError
      end
    end
  end
  a.each do |r,w|
    w.puts "hoge"
    w.close
    r.close
  end
  t.each do |th|
    th.join
  end
end

$ ruby -v t.rb
ruby 2.4.0p0 (2016-12-24 revision 57164) [x86_64-linux]
#0
#1
#2
#3
#4
#5
#6
#7
#8
#9
#10
#11
#12
#13
#14
#15
#16
#17
#18
#19
#20
#21
#22
#23
#24
#25
#26
#27
#28
#29
#30
#31
#32
#33
#34
#35
#36
#37
#38
#39
#40
t.rb:10: [BUG] Segmentation fault at 0x00000000000000
ruby 2.4.0p0 (2016-12-24 revision 57164) [x86_64-linux]

-- Control frame information -----------------------------------------------
c:0003 p:---- s:0010 e:000009 CFUNC  :gets
c:0002 p:0015 s:0006 e:000005 BLOCK  t.rb:10 [FINISH]
c:0001 p:---- s:0003 e:000002 (none) [FINISH]

-- Ruby level backtrace information ----------------------------------------
t.rb:10:in `block (3 levels) in <main>'
t.rb:10:in `gets'

-- Machine register context ------------------------------------------------
 RIP: 0x00007f9b01162d58 RBP: 0x00007f9b0458f8d0 RSP: 0x00007f9afa099368
 RAX: 0x0000000000000000 RBX: 0x0000000000000004 RCX: 0x0000000000000000
 RDX: 0x0000000000000001 RDI: 0x0000000000000000 RSI: 0x000000000000000a
  R8: 0x0000000000000000  R9: 0x0000000000000000 R10: 0x0000000000000000
 R11: 0x0000000000000206 R12: 0x0000000000000000 R13: 0x00007f9b04cbede0
 R14: 0x0000000000000000 R15: 0x0000000000000001 EFL: 0x0000000000010283

-- C level backtrace information -------------------------------------------
/home/masa/local/ruby240/bin/ruby(rb_vm_bugreport+0x528) [0x7f9b024b6868] vm_dump.c:679
/home/masa/local/ruby240/bin/ruby(rb_bug_context+0xd0) [0x7f9b024aba00] error.c:426
/home/masa/local/ruby240/bin/ruby(sigsegv+0x3e) [0x7f9b023a6b5e] signal.c:907
/usr/lib64/libpthread.so.0 [0x7f9b01e5e370]
/usr/lib64/libc.so.6(memchr+0x28) [0x7f9b01162d58] ../sysdeps/x86_64/strspn.S:114
/home/masa/local/ruby240/bin/ruby(rb_io_getline_0+0x7e3) [0x7f9b022e6323] io.c:2995
/home/masa/local/ruby240/bin/ruby(rb_io_gets_m+0x147) [0x7f9b022e6d47] io.c:3230
/home/masa/local/ruby240/bin/ruby(vm_call_cfunc+0xf1) [0x7f9b02417091] vm_insnhelper.c:1752
/home/masa/local/ruby240/bin/ruby(vm_exec_core+0x2251) [0x7f9b0241ee71] insns.def:1066
/home/masa/local/ruby240/bin/ruby(vm_exec+0x87) [0x7f9b02423147] vm.c:1712
/home/masa/local/ruby240/bin/ruby(invoke_iseq_block_from_c+0x3a9) [0x7f9b02423cd9] vm.c:969
/home/masa/local/ruby240/bin/ruby(invoke_block_from_c_unsplattable+0xeb) [0x7f9b02423e7b] vm.c:1086
/home/masa/local/ruby240/bin/ruby(vm_invoke_proc+0xbb) [0x7f9b02423fdb] vm.c:1111
/home/masa/local/ruby240/bin/ruby(thread_start_func_2+0x773) [0x7f9b023e18e3] thread.c:585
/home/masa/local/ruby240/bin/ruby(thread_start_func_1+0xd5) [0x7f9b023e1d85] thread_pthread.c:887
/usr/lib64/libpthread.so.0(start_thread+0xc5) [0x7f9b01e56dc5] pthread_create.c:308
/usr/lib64/libc.so.6(clone+0x6d) [0x7f9b011d173d] ../sysdeps/unix/syscall-template.S:81

-- Other runtime information -----------------------------------------------

* Loaded script: t.rb

* Loaded features:

    0 enumerator.so
    1 thread.rb
    2 rational.so
    3 complex.so
    4 /home/masa/local/ruby240/lib/ruby/2.4.0/x86_64-linux/enc/encdb.so
    5 /home/masa/local/ruby240/lib/ruby/2.4.0/x86_64-linux/enc/trans/transdb.so
    6 /home/masa/local/ruby240/lib/ruby/2.4.0/unicode_normalize.rb
    7 /home/masa/local/ruby240/lib/ruby/2.4.0/x86_64-linux/rbconfig.rb
    8 /home/masa/local/ruby240/lib/ruby/2.4.0/rubygems/compatibility.rb
    9 /home/masa/local/ruby240/lib/ruby/2.4.0/rubygems/defaults.rb
   10 /home/masa/local/ruby240/lib/ruby/2.4.0/rubygems/deprecate.rb
   11 /home/masa/local/ruby240/lib/ruby/2.4.0/rubygems/errors.rb
   12 /home/masa/local/ruby240/lib/ruby/2.4.0/rubygems/version.rb
   13 /home/masa/local/ruby240/lib/ruby/2.4.0/rubygems/requirement.rb
   14 /home/masa/local/ruby240/lib/ruby/2.4.0/rubygems/platform.rb
   15 /home/masa/local/ruby240/lib/ruby/2.4.0/rubygems/basic_specification.rb
   16 /home/masa/local/ruby240/lib/ruby/2.4.0/rubygems/stub_specification.rb
   17 /home/masa/local/ruby240/lib/ruby/2.4.0/rubygems/util/list.rb
   18 /home/masa/local/ruby240/lib/ruby/2.4.0/x86_64-linux/stringio.so
   19 /home/masa/local/ruby240/lib/ruby/2.4.0/rubygems/specification.rb
   20 /home/masa/local/ruby240/lib/ruby/2.4.0/rubygems/exceptions.rb
   21 /home/masa/local/ruby240/lib/ruby/2.4.0/rubygems/dependency.rb
   22 /home/masa/local/ruby240/lib/ruby/2.4.0/rubygems/core_ext/kernel_gem.rb
   23 /home/masa/local/ruby240/lib/ruby/2.4.0/monitor.rb
   24 /home/masa/local/ruby240/lib/ruby/2.4.0/rubygems/core_ext/kernel_require.rb
   25 /home/masa/local/ruby240/lib/ruby/2.4.0/rubygems.rb
   26 /home/masa/local/ruby240/lib/ruby/2.4.0/rubygems/path_support.rb
   27 /home/masa/local/ruby240/lib/ruby/gems/2.4.0/gems/did_you_mean-1.1.0/lib/did_you_mean/version.rb
   28 /home/masa/local/ruby240/lib/ruby/gems/2.4.0/gems/did_you_mean-1.1.0/lib/did_you_mean/core_ext/name_error.rb
   29 /home/masa/local/ruby240/lib/ruby/gems/2.4.0/gems/did_you_mean-1.1.0/lib/did_you_mean/levenshtein.rb
   30 /home/masa/local/ruby240/lib/ruby/gems/2.4.0/gems/did_you_mean-1.1.0/lib/did_you_mean/jaro_winkler.rb
   31 /home/masa/local/ruby240/lib/ruby/gems/2.4.0/gems/did_you_mean-1.1.0/lib/did_you_mean/spell_checker.rb
   32 /home/masa/local/ruby240/lib/ruby/2.4.0/delegate.rb
   33 /home/masa/local/ruby240/lib/ruby/gems/2.4.0/gems/did_you_mean-1.1.0/lib/did_you_mean/spell_checkers/name_error_checkers/class_name_checker.rb
   34 /home/masa/local/ruby240/lib/ruby/gems/2.4.0/gems/did_you_mean-1.1.0/lib/did_you_mean/spell_checkers/name_error_checkers/variable_name_checker.rb
   35 /home/masa/local/ruby240/lib/ruby/gems/2.4.0/gems/did_you_mean-1.1.0/lib/did_you_mean/spell_checkers/name_error_checkers.rb
   36 /home/masa/local/ruby240/lib/ruby/gems/2.4.0/gems/did_you_mean-1.1.0/lib/did_you_mean/spell_checkers/method_name_checker.rb
   37 /home/masa/local/ruby240/lib/ruby/gems/2.4.0/gems/did_you_mean-1.1.0/lib/did_you_mean/spell_checkers/null_checker.rb
   38 /home/masa/local/ruby240/lib/ruby/gems/2.4.0/gems/did_you_mean-1.1.0/lib/did_you_mean/formatter.rb
   39 /home/masa/local/ruby240/lib/ruby/gems/2.4.0/gems/did_you_mean-1.1.0/lib/did_you_mean.rb

* Process memory map:

7f9acc000000-7f9acc021000 rw-p 00000000 00:00 0
7f9acc021000-7f9ad0000000 ---p 00000000 00:00 0
7f9ad3092000-7f9ad4000000 r--s 00000000 fd:00 3677012                    /home/masa/local/ruby240/bin/ruby
7f9ad4000000-7f9ad4021000 rw-p 00000000 00:00 0
7f9ad4021000-7f9ad8000000 ---p 00000000 00:00 0
7f9ad8000000-7f9ad8021000 rw-p 00000000 00:00 0
7f9ad8021000-7f9adc000000 ---p 00000000 00:00 0
7f9adc000000-7f9adc021000 rw-p 00000000 00:00 0
7f9adc021000-7f9ae0000000 ---p 00000000 00:00 0
7f9ae0000000-7f9ae0021000 rw-p 00000000 00:00 0
7f9ae0021000-7f9ae4000000 ---p 00000000 00:00 0
7f9ae4000000-7f9ae4021000 rw-p 00000000 00:00 0
7f9ae4021000-7f9ae8000000 ---p 00000000 00:00 0
7f9ae8000000-7f9ae8021000 rw-p 00000000 00:00 0
7f9ae8021000-7f9aec000000 ---p 00000000 00:00 0
7f9aec000000-7f9aec021000 rw-p 00000000 00:00 0
7f9aec021000-7f9af0000000 ---p 00000000 00:00 0
7f9af0000000-7f9af0021000 rw-p 00000000 00:00 0
7f9af0021000-7f9af4000000 ---p 00000000 00:00 0
7f9af4000000-7f9af4021000 rw-p 00000000 00:00 0
7f9af4021000-7f9af8000000 ---p 00000000 00:00 0
7f9af8b6e000-7f9af8d74000 r--s 00000000 fd:00 73075478                   /usr/lib64/libc-2.17.so
7f9af8d74000-7f9af8d89000 r-xp 00000000 fd:00 107165766                  /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f9af8d89000-7f9af8f88000 ---p 00015000 fd:00 107165766                  /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f9af8f88000-7f9af8f89000 r--p 00014000 fd:00 107165766                  /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f9af8f89000-7f9af8f8a000 rw-p 00015000 fd:00 107165766                  /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f9af8f8a000-7f9af8f8b000 ---p 00000000 00:00 0
7f9af8f8b000-7f9af918c000 rw-p 00000000 00:00 0                          [stack:14653]
7f9af918c000-7f9af918d000 ---p 00000000 00:00 0
7f9af918d000-7f9af938e000 rw-p 00000000 00:00 0
7f9af938e000-7f9af938f000 ---p 00000000 00:00 0
7f9af938f000-7f9af9590000 rw-p 00000000 00:00 0
7f9af9590000-7f9af9591000 ---p 00000000 00:00 0
7f9af9591000-7f9af9792000 rw-p 00000000 00:00 0
7f9af9792000-7f9af9793000 ---p 00000000 00:00 0
7f9af9793000-7f9af9994000 rw-p 00000000 00:00 0
7f9af9994000-7f9af9995000 ---p 00000000 00:00 0
7f9af9995000-7f9af9b96000 rw-p 00000000 00:00 0                          [stack:14655]
7f9af9b96000-7f9af9b97000 ---p 00000000 00:00 0
7f9af9b97000-7f9af9d98000 rw-p 00000000 00:00 0                          [stack:14654]
7f9af9d98000-7f9af9d99000 ---p 00000000 00:00 0
7f9af9d99000-7f9af9f9a000 rw-p 00000000 00:00 0                          [stack:14656]
7f9af9f9a000-7f9af9f9b000 ---p 00000000 00:00 0
7f9af9f9b000-7f9afa19c000 rw-p 00000000 00:00 0
7f9afa19c000-7f9afa19d000 ---p 00000000 00:00 0
7f9afa19d000-7f9afa39e000 rw-p 00000000 00:00 0                          [stack:14652]
7f9afa39e000-7f9afa3a6000 r-xp 00000000 fd:00 5100795                    /home/masa/local/ruby240/lib/ruby/2.4.0/x86_64-linux/stringio.so
7f9afa3a6000-7f9afa5a5000 ---p 00008000 fd:00 5100795                    /home/masa/local/ruby240/lib/ruby/2.4.0/x86_64-linux/stringio.so
7f9afa5a5000-7f9afa5a6000 r--p 00007000 fd:00 5100795                    /home/masa/local/ruby240/lib/ruby/2.4.0/x86_64-linux/stringio.so
7f9afa5a6000-7f9afa5a7000 rw-p 00008000 fd:00 5100795                    /home/masa/local/ruby240/lib/ruby/2.4.0/x86_64-linux/stringio.so
7f9afa5a7000-7f9afa5aa000 r-xp 00000000 fd:00 5100809                    /home/masa/local/ruby240/lib/ruby/2.4.0/x86_64-linux/enc/trans/transdb.so
7f9afa5aa000-7f9afa7a9000 ---p 00003000 fd:00 5100809                    /home/masa/local/ruby240/lib/ruby/2.4.0/x86_64-linux/enc/trans/transdb.so
7f9afa7a9000-7f9afa7aa000 r--p 00002000 fd:00 5100809                    /home/masa/local/ruby240/lib/ruby/2.4.0/x86_64-linux/enc/trans/transdb.so
7f9afa7aa000-7f9afa7ab000 rw-p 00003000 fd:00 5100809                    /home/masa/local/ruby240/lib/ruby/2.4.0/x86_64-linux/enc/trans/transdb.so
7f9afa7ab000-7f9afa7ad000 r-xp 00000000 fd:00 108680444                  /home/masa/local/ruby240/lib/ruby/2.4.0/x86_64-linux/enc/encdb.so
7f9afa7ad000-7f9afa9ac000 ---p 00002000 fd:00 108680444                  /home/masa/local/ruby240/lib/ruby/2.4.0/x86_64-linux/enc/encdb.so
7f9afa9ac000-7f9afa9ad000 r--p 00001000 fd:00 108680444                  /home/masa/local/ruby240/lib/ruby/2.4.0/x86_64-linux/enc/encdb.so
7f9afa9ad000-7f9afa9ae000 rw-p 00002000 fd:00 108680444                  /home/masa/local/ruby240/lib/ruby/2.4.0/x86_64-linux/enc/encdb.so
7f9afa9ae000-7f9b00ed7000 r--p 00000000 fd:00 67169418                   /usr/lib/locale/locale-archive
7f9b00ed7000-7f9b00ed9000 r-xp 00000000 fd:00 73075468                   /usr/lib64/libfreebl3.so
7f9b00ed9000-7f9b010d8000 ---p 00002000 fd:00 73075468                   /usr/lib64/libfreebl3.so
7f9b010d8000-7f9b010d9000 r--p 00001000 fd:00 73075468                   /usr/lib64/libfreebl3.so
7f9b010d9000-7f9b010da000 rw-p 00002000 fd:00 73075468                   /usr/lib64/libfreebl3.so
7f9b010da000-7f9b01290000 r-xp 00000000 fd:00 73075478                   /usr/lib64/libc-2.17.so
7f9b01290000-7f9b01490000 ---p 001b6000 fd:00 73075478                   /usr/lib64/libc-2.17.so
7f9b01490000-7f9b01494000 r--p 001b6000 fd:00 73075478                   /usr/lib64/libc-2.17.so
7f9b01494000-7f9b01496000 rw-p 001ba000 fd:00 73075478                   /usr/lib64/libc-2.17.so
7f9b01496000-7f9b0149b000 rw-p 00000000 00:00 0
7f9b0149b000-7f9b0159b000 r-xp 00000000 fd:00 73075485                   /usr/lib64/libm-2.17.so
7f9b0159b000-7f9b0179b000 ---p 00100000 fd:00 73075485                   /usr/lib64/libm-2.17.so
7f9b0179b000-7f9b0179c000 r--p 00100000 fd:00 73075485                   /usr/lib64/libm-2.17.so
7f9b0179c000-7f9b0179d000 rw-p 00101000 fd:00 73075485                   /usr/lib64/libm-2.17.so
7f9b0179d000-7f9b017a5000 r-xp 00000000 fd:00 73075482                   /usr/lib64/libcrypt-2.17.so
7f9b017a5000-7f9b019a4000 ---p 00008000 fd:00 73075482                   /usr/lib64/libcrypt-2.17.so
7f9b019a4000-7f9b019a5000 r--p 00007000 fd:00 73075482                   /usr/lib64/libcrypt-2.17.so
7f9b019a5000-7f9b019a6000 rw-p 00008000 fd:00 73075482                   /usr/lib64/libcrypt-2.17.so
7f9b019a6000-7f9b019d4000 rw-p 00000000 00:00 0
7f9b019d4000-7f9b019d6000 r-xp 00000000 fd:00 68394974                   /usr/lib64/libdl-2.17.so
7f9b019d6000-7f9b01bd6000 ---p 00002000 fd:00 68394974                   /usr/lib64/libdl-2.17.so
7f9b01bd6000-7f9b01bd7000 r--p 00002000 fd:00 68394974                   /usr/lib64/libdl-2.17.so
7f9b01bd7000-7f9b01bd8000 rw-p 00003000 fd:00 68394974                   /usr/lib64/libdl-2.17.so
7f9b01bd8000-7f9b01c4e000 r-xp 00000000 fd:00 67200228                   /usr/lib64/libgmp.so.10.2.0
7f9b01c4e000-7f9b01e4d000 ---p 00076000 fd:00 67200228                   /usr/lib64/libgmp.so.10.2.0
7f9b01e4d000-7f9b01e4e000 r--p 00075000 fd:00 67200228                   /usr/lib64/libgmp.so.10.2.0
7f9b01e4e000-7f9b01e4f000 rw-p 00076000 fd:00 67200228                   /usr/lib64/libgmp.so.10.2.0
7f9b01e4f000-7f9b01e66000 r-xp 00000000 fd:00 73075503                   /usr/lib64/libpthread-2.17.so
7f9b01e66000-7f9b02065000 ---p 00017000 fd:00 73075503                   /usr/lib64/libpthread-2.17.so
7f9b02065000-7f9b02066000 r--p 00016000 fd:00 73075503                   /usr/lib64/libpthread-2.17.so
7f9b02066000-7f9b02067000 rw-p 00017000 fd:00 73075503                   /usr/lib64/libpthread-2.17.so
7f9b02067000-7f9b0206b000 rw-p 00000000 00:00 0
7f9b0206b000-7f9b0208b000 r-xp 00000000 fd:00 73075473                   /usr/lib64/ld-2.17.so
7f9b0208d000-7f9b0208e000 rw-p 00000000 00:00 0
7f9b0208e000-7f9b02129000 r--s 00000000 fd:00 38126509                   /usr/lib/debug/usr/lib64/libpthread-2.17.so.debug
7f9b02129000-7f9b0214d000 r--s 00000000 fd:00 73075503                   /usr/lib64/libpthread-2.17.so
7f9b0214d000-7f9b0217f000 rw-p 00000000 00:00 0
7f9b0217f000-7f9b02180000 ---p 00000000 00:00 0
7f9b02180000-7f9b0228a000 rw-p 00000000 00:00 0                          [stack:14246]
7f9b0228a000-7f9b0228b000 r--p 0001f000 fd:00 73075473                   /usr/lib64/ld-2.17.so
7f9b0228b000-7f9b0228c000 rw-p 00020000 fd:00 73075473                   /usr/lib64/ld-2.17.so
7f9b0228c000-7f9b0228d000 rw-p 00000000 00:00 0
7f9b0228d000-7f9b0258f000 r-xp 00000000 fd:00 3677012                    /home/masa/local/ruby240/bin/ruby
7f9b0278e000-7f9b02793000 r--p 00301000 fd:00 3677012                    /home/masa/local/ruby240/bin/ruby
7f9b02793000-7f9b02794000 rw-p 00306000 fd:00 3677012                    /home/masa/local/ruby240/bin/ruby
7f9b02794000-7f9b027a6000 rw-p 00000000 00:00 0
7f9b04249000-7f9b04cfa000 rw-p 00000000 00:00 0                          [heap]
7ffccbe02000-7ffccc601000 rw-p 00000000 00:00 0                          [stack]
7ffccc739000-7ffccc73b000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]


[NOTE]
You may have encountered a bug in the Ruby interpreter or extension libraries.
Bug reports are welcome.
For details: http://www.ruby-lang.org/bugreport.html

[nobu (Nobuyoshi Nakada)]

• Status changed from Open to Closed

Applied in changeset r57199.

---

io.c: fix race between read and close

• io.c (io_fillbuf): fix race between read and close, in the case
  the IO gets closed before the reading thread achieve the lock.
  [ruby-core:78845] [Bug #13076]

[usa (Usaku NAKAMURA)]

• Status changed from Closed to Assigned
• Assignee set to nobu (Nobuyoshi Nakada)
• Backport changed from 2.2: UNKNOWN, 2.3: UNKNOWN, 2.4: UNKNOWN to 2.2: REQUIRED, 2.3: REQUIRED, 2.4: REQUIRED

After r57199, IO#getch (in io/console) was broken, at least on Windows.
It required two key types to get the result.
So, I reverted r57199.

Nobu, please check again.

[nobu (Nobuyoshi Nakada)]

• Status changed from Assigned to Closed

Applied in changeset r57224.

---

io.c: fix race between read and close

• io.c (io_fillbuf): fix race between read and close and bail out
  in the case the IO gets closed before the reading thread achieve
  the lock. [ruby-core:78845] [Bug #13076]

[nobu (Nobuyoshi Nakada)]

• Related to Bug #13158: UNIXServer#closed? returns false after UNIXServer#close called added

[naruse (Yui NARUSE)]

• Backport changed from 2.2: REQUIRED, 2.3: REQUIRED, 2.4: REQUIRED to 2.2: REQUIRED, 2.3: REQUIRED, 2.4: DONE

ruby_2_4 r57838 merged revision(s) 57199,57202,57206,57224.

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 2.2: REQUIRED, 2.3: REQUIRED, 2.4: DONE to 2.2: REQUIRED, 2.3: DONE, 2.4: DONE

ruby_2_3 r58058 merged revision(s) 57199,57202,57206,57224.

[usa (Usaku NAKAMURA)]

• Backport changed from 2.2: REQUIRED, 2.3: DONE, 2.4: DONE to 2.2: DONE, 2.3: DONE, 2.4: DONE

ruby_2_2 r58093 merged revision(s) 57199,57202,57206,57224.