Le 03/11/2026 à 19:57, Jerry D a écrit :
See the attached patch. This one is adjusted a little from the one
tested in the PR:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118935
Regression tested. I have copied Huang to retest there as well.
Huang, please confirm.
OK for mainline?
Looks good.
Regards,
Jerry
---
libgfortran: [PR118935] Fix data race on the unit stream pointer
find_file0 walks the unit tree holding only unit_rwlock for reading,
and reads and dereferences each unit's stream pointer. new_unit,
set_internal_unit and the close paths change that pointer holding
only the unit's mutex, so find_file0 can see a stale or NULL stream,
or one already freed by a concurrent CLOSE.
Keep the file's device and inode in gfc_unit, stored before the
stream pointer is published with release semantics. find_file0
loads the pointer with acquire semantics and compares the stored
id, so it no longer dereferences the stream. All writes of the
stream pointer go through the new accessors.
Assisted-by: Claude Opus 5.5
PR libfortran/118935
libgfortran/ChangeLog:
* io/io.h (gfc_unit): Add file_dev and file_ino.
(set_unit_stream, get_unit_stream, set_unit_file_id)
(unit_file_id_matches): New functions.
* io/open.c (new_unit): Use connect_unit_stream.
(already_open): Use set_unit_stream.
* io/transfer.c (finalize_transfer): Likewise.
* io/unit.c (set_internal_unit): Use connect_unit_stream.
(init_units): Likewise.
* io/unix.c (connect_unit_stream): New function.
(find_file0): Use get_unit_stream and unit_file_id_matches
instead of dereferencing the stream.
* io/unix.h (connect_unit_stream): Declare.
---
