https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118935
--- Comment #40 from GCC Commits <cvs-commit at gcc dot gnu.org> --- The master branch has been updated by Jerry DeLisle <[email protected]>: https://gcc.gnu.org/g:bcf14085d8270f173ee6f1f4f9ae8352959e5ca1 commit r17-6022-gbcf14085d8270f173ee6f1f4f9ae8352959e5ca1 Author: Jerry DeLisle <[email protected]> Date: Tue Nov 3 07:20:35 2026 -0800 libgfortran: [PR118935] Fix data race on the unit stream pointer find_file0 walks the unit tree holding only unit_rwlock for reading, and reads and dereferences each unit's stream pointer. new_unit, set_internal_unit and the close paths change that pointer holding only the unit's mutex, so find_file0 can see a stale or NULL stream, or one already freed by a concurrent CLOSE. Keep the file's device and inode in gfc_unit, stored before the stream pointer is published with release semantics. find_file0 loads the pointer with acquire semantics and compares the stored id, so it no longer dereferences the stream. All writes of the stream pointer go through the new accessors. Assisted-by: Claude Opus 5.5 PR libfortran/118935 libgfortran/ChangeLog: * io/io.h (gfc_unit): Add file_dev and file_ino. (set_unit_stream, get_unit_stream, set_unit_file_id) (unit_file_id_matches): New functions. * io/open.c (new_unit): Use connect_unit_stream. (already_open): Use set_unit_stream. * io/transfer.c (finalize_transfer): Likewise. * io/unit.c (set_internal_unit): Use connect_unit_stream. (init_units): Likewise. * io/unix.c (connect_unit_stream): New function. (find_file0): Use get_unit_stream and unit_file_id_matches instead of dereferencing the stream. * io/unix.h (connect_unit_stream): Declare.
