checklocks: enforce filesystem ownership - #14343
Open
tamird wants to merge 3 commits into
Open
Conversation
Contributor
Author
|
r? @EtiennePerot Could you review VFS registries, mount helpers, atomic metadata and lifecycle exceptions? Focused local Bazel checks passed. Upstream checks have not reported yet. Assisted-by: Codex |
tamird
force-pushed
the
checklocks-vfs-state
branch
from
August 22, 2026 16:19
34cded5 to
b78a1e8
Compare
This was referenced Aug 23, 2026
tamird
force-pushed
the
checklocks-vfs-state
branch
from
August 23, 2026 03:04
b78a1e8 to
db2bee1
Compare
tamird
changed the title
Global declarations and grouped struct fields can lose their annotations; nested captures can fail to resolve. Apply annotations to each declared variable and resolve captured values consistently. Inherit explicit ignore contracts in passed closures. Distinguish shared guards from write permission and classify Racy operations as non-atomic. Atomic calls must use the annotated address as their storage location, not a stored pointer payload. Allow deferred atomic calls only without lock-dependent permissions. Resolve atomic methods from indirect imports without granting their permissions to receiver-changing wrappers. Give global lock identities package-qualified keys and preserve private field paths in exported contracts. Missing SSA declarations then neither crash analysis nor conflate locks. Add alternative reader guards for fields whose writers hold every guard. Restrict the new read permission to immediate loads, including RacyLoad, so retaining an address cannot newly outlive the checked lock state. Assisted-by: Codex
Nogo analyzes binaries through a synthetic library that drops target attributes. Analyze the real binary and pass each rule's transitioned Go configuration to all analyzers, preserving build tags and embedded sources. Use the binary's Go archive so escape checking sees functions removed by linking. Supply transitive package facts for methods exposed through indirect imports. Cache those facts without treating the package as fully imported, and serialize shared bundle decoding. Annotate cache ownership and keep quiescence exceptions at the two collection call sites. Exercise a guarded method reached through a type alias without importing its defining package. Fail analysis when supplied fact files or present bundle entries cannot be read or decoded, instead of silently dropping their contracts. Report invalid decoded payload types as errors rather than recovered analyzer panics. Keep absent facts optional and search later bundles; exercise absent, missing and malformed inputs through the analyzer fact-import path. Preserve inline comments when merging generated templates. Exempt the deliberately allocating lockdep bookkeeping calls from escape checking when selected by build tags, while leaving mutex operations and their callers checked. Exclude the lock-order validator tests' deliberately empty critical sections from the corresponding style check. Require the sanity wrapper's intended diagnostic so unrelated execution failures cannot satisfy it. Read the standard library's language version from the SDK module using its file path and a multiline go directive. Supply the go-prefixed version expected by go/types and stop analysis if resolution fails; printing a warning and continuing left language-version checks disabled. Cover actual module layout and malformed directives in a focused CLI test. Assisted-by: Codex
Serialize public FD-table iteration so device scans cannot race another task mutating a shared table. Keep the locked internal iterator and stopped-task timer scans, with checked bitmap/helper contracts and exceptions at actual allocation, callback and quiescence boundaries. Publish exec's FD-table replacement under Task.mu. Acquire sibling file references under that task's mutex before collecting pipe-peer metadata or releasing references. Keep task-goroutine reads and returned-file lifetimes explicit. Cover iteration and sibling unshare with distinct regressions that preserve the unordered accesses. Use atomic stores for virtual host-file ownership, matching unlocked Stat readers while retaining permission checks and error ordering. Preserve file-type bits when changing permissions. Exercise concurrent Stat and SetStat through an imported file. Guard filesystem and device registries, dynamic file buffers, terminal state, pipe buffers, readiness queues and LisaFS collections. Detach the VFS filesystem-type registry before unlocked release callbacks. Use alternative-reader contracts for epoll sequencing and tmpfs file size; require both writer locks and atomic size writes. Make tmpfs path walkers filesystem methods to check their owner lock. Guard mapping, data, offset and link-count state; check tar and link helpers. Express fixed root/whiteout owner aliases while keeping dynamic inode, callback and final-reference exceptions at the affected accesses. Check LisaFS node/FD helper contracts and concrete gofer entry points, including rename-lock requirements through private package fields. Do not remove a replacement child when an unlinked node loses its last reference. Exercise both child-map representations with balanced refs. Keep synchronous callback and returned-owner exceptions narrow, and explain interface dispatch, intrusive links and nil-parent construction. Guard eventfd host-descriptor state and its save hook. Keep checkpoint quiescence at the generated caller, restore-phase exceptions at the two necessary accesses, and private construction at its allocating caller. Document borrowed host-descriptor lifetime without changing ownership. Assisted-by: Codex
tamird
force-pushed
the
checklocks-vfs-state
branch
from
August 23, 2026 11:51
db2bee1 to
970f5a4
Compare
Contributor
Author
|
The replacement review scopes are #14353, #14361, #14362, #14363, tracked in #14349. This broad PR is only partially replaced: the dependent TMPFS/VFS contracts and FD-table batch still need actual prerequisite landing, rebasing and revalidation before separate PRs are opened. Keeping this PR open to retain that remaining scope; please use the linked replacements for the work ready to review now. Its existing cumulative diff is not an additional replacement review unit. Assisted-by: Codex |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Serialize public FD-table iteration while preserving locked internal iteration and stopped-task timer scans. Publish exec's table replacement under Task.mu, and acquire sibling file references before unlocking and collecting metadata or releasing references.
Update virtual host-file ownership atomically, retaining permission checks and file-type bits. Detach the VFS filesystem-type registry before invoking release callbacks unlocked.
Prevent an unlinked LisaFS node's final release from removing its replacement child. Check node, FD and gofer helper contracts while preserving intrusive-link and returned-owner limitations.
Enforce filesystem/device registry, terminal, pipe, eventfd and readiness contracts. Use alternative-reader guards for epoll sequencing and tmpfs size, retaining both writer locks and atomic size updates. Make tmpfs walkers owner methods and check mapping, data, offset, link-count, tar and link operations.
Depends on #14237. These subsystem changes are based on its checker and nogo commits through 193b205. Rebase onto master after that prerequisite lands to remove those commits from this PR's comparison.
Assisted-by: Codex