Skip to content

deps: cherry-pick libuv/libuv@a6d06ba - #65092

Open
yury-s wants to merge 1 commit into
nodejs:mainfrom
yury-s:fix-65057-libuv-pipe-crash
Open

deps: cherry-pick libuv/libuv@a6d06ba#65092
yury-s wants to merge 1 commit into
nodejs:mainfrom
yury-s:fix-65057-libuv-pipe-crash

Conversation

@yury-s

@yury-s yury-s commented Aug 6, 2026

Copy link
Copy Markdown

Cherry-pick the libuv fix for a crash on Windows: with NODE_PENDING_PIPE_INSTANCES set, a process that loses a named-pipe bind race (EADDRINUSE from a concurrent listen() on the same pipe name) dies with an access violation (0xC0000005) while closing the failed server handle. uv_pipe_pending_instances() pre-sets UV_HANDLE_PIPESERVER, the failed bind resets accept_reqs to NULL, and uv__pipe_close() then dereferences the NULL array.

The upstream commit includes a regression test (pipe_bind_error_addrinuse_pending_instances).

Fixes: #65057
Refs: libuv/libuv#5224
Refs: libuv/libuv@a6d06ba

Original commit message:

    win: fix crash when closing a pipe after a failed bind

    uv_pipe_pending_instances() sets the UV_HANDLE_PIPESERVER flag before the
    pipe is bound. When the subsequent bind fails, e.g. with UV_EADDRINUSE
    after losing a bind race on a well-known pipe name, uv_pipe_bind2() frees
    accept_reqs and resets it to NULL, but the flag stays set. Closing the
    handle then dereferences the NULL accept_reqs array in uv__pipe_close()
    (release builds crash with an access violation; debug builds trip the
    assert in uv__pipe_endgame()).

    Tolerate accept_reqs == NULL at both cleanup sites.

Fixes: nodejs#65057
Refs: libuv/libuv#5224
Refs: libuv/libuv@a6d06ba
@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/security-wg

@avivkeller avivkeller left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Commit content matches that of upstream

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

NODE_PENDING_PIPE_INSTANCES causes 0xC0000005 crash on Windows when a named-pipe listen() loses a bind race (EADDRINUSE)

3 participants