checklocks: enforce networking state ownership - #14338
Open
tamird wants to merge 3 commits into
Open
Conversation
Contributor
Author
|
r? @nybidari Could you review TCP endpoint/helper ownership, keepalive locking, and lifecycle exceptions? Focused local Bazel checks passed. Upstream checks have not reported yet. Assisted-by: Codex |
This was referenced Aug 23, 2026
tamird
force-pushed
the
checklocks-tcp-state
branch
from
August 23, 2026 03:04
fed1674 to
6f1fe59
Compare
tamird
changed the title
Global declarations and grouped struct fields can lose their annotations; nested captures can fail to resolve. Apply annotations to each declared variable and resolve captured values consistently. Inherit explicit ignore contracts in passed closures. Distinguish shared guards from write permission and classify Racy operations as non-atomic. Atomic calls must use the annotated address as their storage location, not a stored pointer payload. Allow deferred atomic calls only without lock-dependent permissions. Resolve atomic methods from indirect imports without granting their permissions to receiver-changing wrappers. Give global lock identities package-qualified keys and preserve private field paths in exported contracts. Missing SSA declarations then neither crash analysis nor conflate locks. Add alternative reader guards for fields whose writers hold every guard. Restrict the new read permission to immediate loads, including RacyLoad, so retaining an address cannot newly outlive the checked lock state. Assisted-by: Codex
Nogo analyzes binaries through a synthetic library that drops target attributes. Analyze the real binary and pass each rule's transitioned Go configuration to all analyzers, preserving build tags and embedded sources. Use the binary's Go archive so escape checking sees functions removed by linking. Supply transitive package facts for methods exposed through indirect imports. Cache those facts without treating the package as fully imported, and serialize shared bundle decoding. Annotate cache ownership and keep quiescence exceptions at the two collection call sites. Exercise a guarded method reached through a type alias without importing its defining package. Fail analysis when supplied fact files or present bundle entries cannot be read or decoded, instead of silently dropping their contracts. Report invalid decoded payload types as errors rather than recovered analyzer panics. Keep absent facts optional and search later bundles; exercise absent, missing and malformed inputs through the analyzer fact-import path. Preserve inline comments when merging generated templates. Exempt the deliberately allocating lockdep bookkeeping calls from escape checking when selected by build tags, while leaving mutex operations and their callers checked. Exclude the lock-order validator tests' deliberately empty critical sections from the corresponding style check. Require the sanity wrapper's intended diagnostic so unrelated execution failures cannot satisfy it. Read the standard library's language version from the SDK module using its file path and a multiline go directive. Supply the go-prefixed version expected by go/types and stop analysis if resolution fails; printing a warning and continuing left language-version checks disabled. Cover actual module layout and malformed directives in a focused CLI test. Assisted-by: Codex
Guard TCP protocol, endpoint, send-buffer, RTT and queue state, plus UDP receive and registration state. Keep lock ordering, snapshot ownership, nullable listeners and synchronous callback boundaries explicit. Use rcvMu for UDP freeze and thaw, including restore, so their writes are serialized with packet delivery's frozen-state read. Protect TCP restore accesses with the endpoint mutex without carrying it across waits or public methods that lock it. Guard forwarder request segments and read request IDs under their mutex. Preserve accepted-child address lookup after close, with the tuple-lifetime proof at its caller. Load and store TCP send-buffer snapshot atomics without copying live atomic values. Accumulate connection-close bits atomically, and publish the selected local port before transport registration exposes it to ICMP error delivery. Restore the old ID if registration fails. Release the fragmentation mutex when processing finds a released instance. Check ordinary reassembler accesses while documenting the one-way transfer to cleanup after processing stops. Construct gonet deadline timers before publication and exercise deadline replacement deterministically. Run the TCP transfer fixture's full cleanup so its stack workers do not survive into later tests. Preserve qdisc shutdown cleanup and inspect timeout diagnostics under their queue locks. Snapshot TUN flags under the device mutex before encoding or injecting packets. Read SACK and port-range values from the authoritative stack instead of racy proc caches. Preserve forwarding's last-written value under its own mutex and test reads, writes, rejection and shared stack state. Use a full-width atomic plugin readiness cache. Consume requested I/O bits with compare-and-swap, preserving unrelated concurrent updates without taking the notifier mutex from a readiness callback. Verify the full remaining cache, not a mask that hides unconsumed I/O bits. Check Unix endpoint, queue and credential contracts, preserving pending endpoint ownership and final receiver-release requirements. Annotate namespace, socket-option, link, host socket and RNG ownership. Retain narrow caller proofs where interface dispatch, returned allocations or callback parameters prevent checklocks from following the actual owner. Assisted-by: Codex
tamird
force-pushed
the
checklocks-tcp-state
branch
from
August 23, 2026 11:51
6f1fe59 to
9ef1fba
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Use atomic TCP snapshots and close-bit accumulation. Publish endpoint IDs before registration exposes them, restoring the old ID on failure. Synchronize TCP restore and forwarder accesses without holding locks across waits or self-locking methods.
Use rcvMu for UDP freeze/thaw, including restore. Release the fragmentation mutex on the post-release error path, and snapshot TUN flags under their owner lock.
Read SACK and port-range values from the stack instead of proc caches; synchronize forwarding's last-written value. Consume plugin readiness bits with full-width atomic compare-and-swap without taking the notifier mutex.
Enforce endpoint, queue, socket, namespace, link and RNG contracts while preserving callback and final-reference boundaries. Construct gonet timers before publication, exercise deadline replacement deterministically, and retain complete TCP-transfer and qdisc fixture cleanup.
Depends on #14237. These subsystem changes are based on its checker and nogo commits through 193b205. Rebase onto master after that prerequisite lands to remove those commits from this PR's comparison.
Assisted-by: Codex