[ruby-core:122124] [Ruby Bug#21342] Segfault: invalid keeping_mutexes when using Mutex in Thread then Fiber after GC

Issue #21342 has been updated by byroot (Jean Boussier).


Looks like it's not that simple. This smells of memory corruption because we end up in this loop:

```c
-> 230 	    while (*keeping_mutexes && *keeping_mutexes != mutex) {
   231 	        // Move to the next mutex in the list:
   232 	        keeping_mutexes = &(*keeping_mutexes)->next_mutex;
   233 	    }
```

And at some point `->next_mutex` is a clearly wrong pointer (various low values such as `0xff`, `0x13`, etc). So I assume something else end up overwriting that memory.

All I can say is it still reproduce on `master`.


----------------------------------------
Bug #21342: Segfault: invalid keeping_mutexes when using Mutex in Thread then Fiber after GC
https://bugs.ruby-lang.org/issues/21342#change-113277

* Author: maciej.mensfeld (Maciej Mensfeld)
* Status: Open
* ruby -v: 3.4.3 (2025-04-14 revision d0b7e5b6a0) +PRISM [x86_64-linux]
* Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN
----------------------------------------
Ruby crashes with a `[BUG] invalid keeping_mutexes error` when attempting to GC locked mutex that was used in a Thread within a Fiber context after garbage collection. The error indicates an attempt to unlock a mutex that is not locked, suggesting a state management issue with mutexes across Thread and Fiber boundaries.

## Ruby Version

`ruby 3.4.3 (2025-04-14 revision d0b7e5b6a0) +PRISM [x86_64-linux]`

## Reproduce Process

``` ruby
# segv.rb

5.times do
  m = Mutex.new
  Thread.new do
    m.synchronize do
    end
  end.join
  Fiber.new do
    GC.start
    m.lock
  end.resume
end
```

1. Save the above code to a file (e.g., `segv.rb`)
2. Run with `ruby segv.rb`
3. The crash occurs intermittently - sometimes it crashes immediately, sometimes it hangs, once in a while it works

## Actual Result

The program crashes with the following error:
```
segv.rb: [BUG] invalid keeping_mutexes: Attempt to unlock a mutex which is not locked
ruby 3.4.3 (2025-04-14 revision d0b7e5b6a0) +PRISM [x86_64-linux]
```

whole segfault in the attached txt file.

Full crash backtrace shows the error originates from:
- `rb_threadptr_unlock_all_locking_mutexes` in thread.c:450
- `rb_thread_terminate_all` in thread.c:467

The crash suggests an issue in mutex state management during thread termination.

## Expected Result

The script should complete successfully without crashing. The mutex should be properly managed across Thread and Fiber contexts, and garbage collection should not interfere with mutex state.


---Files--------------------------------
crash.txt (23.4 KB)


-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- [e-mail]
 To unsubscribe send an email to [e-mail]
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/