checklocks: synchronize exec FD-table replacement - #14294
Closed
tamird wants to merge 1 commit into
Closed
Conversation
Contributor
Author
|
r? @shailend-g Could you review publishing exec's replacement FD table under Task.mu? Focused local Bazel checks passed. Upstream checks have not reported yet. The syscall integration test could not launch in the restricted local container. Assisted-by: Codex |
Exec replaces Task.fdTable without holding Task.mu, while /proc readers hold that mutex to read the pointer. Pipe-peer collection introduced by 5e247d5 also reads sibling table pointers without the mutex and can race a sibling's unshare. Task-goroutine ownership permits unlocked reads of the task's own pointer, not writes or other tasks' pointers. Use UnshareFdTable to publish the exec replacement under Task.mu and release the old table after unlocking. For pipe peers, acquire the file references under the sibling's mutex, then collect metadata and release the files outside it. Do not acquire another table reference: exit may already have dropped its last reference without clearing the pointer. Annotate the helpers' lock exclusions and document the task-goroutine ownership alternative that checklocks cannot express. Exercise pipe-peer collection concurrently with unshare, retaining the old table so its destruction does not order the conflicting accesses. Assisted-by: Codex
tamird
force-pushed
the
checklocks-exec-fd-table
branch
from
August 22, 2026 16:19
ddc3c74 to
558888f
Compare
Contributor
Author
|
Closing in favor of consolidated #14343. The expanded replacement commits are prepared locally; the replacement branch has not been pushed yet. Assisted-by: Codex |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Exec replaces Task.fdTable without holding Task.mu, while /proc readers hold that mutex to read the pointer. Task-goroutine ownership permits unlocked reads, not writes, so the replacement races those readers.
Use UnshareFdTable to copy and publish the replacement under Task.mu. Preserve the existing CurrentMaxFDs bound and release the old table outside the mutex before removing close-on-exec descriptors. Annotate the helper's lock-exclusion precondition and make the field's asymmetric read/write contract explicit.
Assisted-by: Codex