checklocks: guard task and IPC state - #14345
Conversation
|
r? @EtiennePerot Could you review registration/session/cache ownership and the atomic cache-pointer contract? Focused local Bazel checks passed. Upstream checks are pending. This comparison currently includes the prerequisites linked in the description. Assisted-by: Codex |
bf6aa8f to
5c98a3e
Compare
|
@tamird This is quite the spam. Merging PRs today is a huge lift because it requires 2 approvals from Googlers and requires constant submit attempts from Googlers because our presubmits are really long and flaky. (I am no longer a Googler and have pending PRs for multiple weeks now) Are these PRs reviewed by you? They do more than just change checklocks. So many commits will also pollute our git commit history with checklocks commits. Please squash all your work into 2-3 PRs, probably divided by subsystem. For example, all checklock changes for netstack can go into 1 commit. |
Sure, can do. Yes, they are all reviewed by me; I'll greatly reduce the number. |
5c98a3e to
10691d2
Compare
tamird
changed the title
|
Following up on Ayush's consolidation request:
The consolidated revisions are now pushed: 77 PRs have become nine subsystem PRs, and the 68 superseded PRs are closed. #14240 remains separate because it was already ready to pull.
Each production PR adds one subsystem commit above the shared tooling prerequisite, #14237. Tooling keeps two independently applicable commits: analyzer fixes and configured-target analysis/generator support. It needs to land first; the eight production branches are siblings, not a chain. The descriptions now distinguish synchronization and error-path fixes from annotations and document the remaining lifecycle and callback limitations. Assisted-by: Codex |
Global declarations and grouped struct fields can lose their annotations; nested captures can fail to resolve. Apply annotations to each declared variable and resolve captured values consistently. Inherit explicit ignore contracts in passed closures. Distinguish shared guards from write permission and classify Racy operations as non-atomic. Atomic calls must use the annotated address as their storage location, not a stored pointer payload. Allow deferred atomic calls only without lock-dependent permissions. Resolve atomic methods from indirect imports without granting their permissions to receiver-changing wrappers. Give global lock identities package-qualified keys and preserve private field paths in exported contracts. Missing SSA declarations then neither crash analysis nor conflate locks. Add alternative reader guards for fields whose writers hold every guard. Restrict the new read permission to immediate loads, including RacyLoad, so retaining an address cannot newly outlive the checked lock state. Assisted-by: Codex
Nogo analyzes binaries through a synthetic library that drops target attributes. Analyze the real binary and pass each rule's transitioned Go configuration to all analyzers, preserving build tags and embedded sources. Use the binary's Go archive so escape checking sees functions removed by linking. Supply transitive package facts for methods exposed through indirect imports. Cache those facts without treating the package as fully imported, and serialize shared bundle decoding. Annotate cache ownership and keep quiescence exceptions at the two collection call sites. Exercise a guarded method reached through a type alias without importing its defining package. Fail analysis when supplied fact files or present bundle entries cannot be read or decoded, instead of silently dropping their contracts. Report invalid decoded payload types as errors rather than recovered analyzer panics. Keep absent facts optional and search later bundles; exercise absent, missing and malformed inputs through the analyzer fact-import path. Preserve inline comments when merging generated templates. Exempt the deliberately allocating lockdep bookkeeping calls from escape checking when selected by build tags, while leaving mutex operations and their callers checked. Exclude the lock-order validator tests' deliberately empty critical sections from the corresponding style check. Require the sanity wrapper's intended diagnostic so unrelated execution failures cannot satisfy it. Read the standard library's language version from the SDK module using its file path and a multiline go directive. Supply the go-prefixed version expected by go/types and stop analysis if resolution fails; printing a warning and continuing left language-version checks disabled. Cover actual module layout and malformed directives in a focused CLI test. Assisted-by: Codex
Serialize parent-death signal resets with readers through the existing locked setter on credential and exec changes. Preserve reset predicates and publication order; exercise concurrent reads during effective UID and GID changes. Avoid reacquiring the held signal mutex when PullFullState fails during signal delivery. Use the locked group-exit helper and release the mutex before entering runExit. Inject a platform failure to check SIGILL and lock release. Snapshot group exit status under that mutex for exit notifications: a Zombie does not make the group status immutable. Guard signal actions, masks, stop and continuation state, termination signals, task start times, and process-group ancestry. Check task, session, traversal, signal and wait-helper contracts. Declare the same-TaskSet and leader signal-lock aliases, retaining explicit caller proofs for collection members and synchronous callbacks. Guard filesystem-context roots and working directories. Place private Fork exceptions at clone, setns and unshare callers before publication. Check kernel atomic tunables and explain their retained proc aliases. Store key permissions atomically and read one snapshot per permission check. Keys can outlive user-namespace changes; neither task locks nor one KeySet transaction mutex serialize all accesses. Preserve typed checkpoint data and check transaction-helper entry contracts. Use atomic.Pointer for futex bucket membership, preserving lock-and-revalidate and waiter-lifetime rules. Guard bucket queues and their helpers; explain the ordered-lock handle aliases at callers. Guard namespace and SysV IPC bookkeeping. Return registry removal errors before changing semaphore indexes, and propagate message-queue removal errors. Exercise denied removals without losing live objects or waking waiters, alongside successful cleanup. Guard security-check registration, session membership and executable hash-cache bookkeeping while preserving lock-free bitmap and sequence-count readers. Keep callback lock scopes, immutable headers, publication phases and task-goroutine ownership explicit. Assisted-by: Codex
10691d2 to
82c6915
Compare
|
I'm further reworking these PRs but there's going to be a lot more than a few; broadly there will be:
|
|
The replacement review scopes are #14352, #14364, #14365, tracked in #14349. This broad PR is only partially replaced: the dependent kernel-runtime/TaskSet and futex batches still need actual prerequisite landing, rebasing and revalidation before separate PRs are opened. Keeping this PR open to retain that remaining scope; please use the linked replacements for the work ready to review now. Its existing cumulative diff is not an additional replacement review unit. Assisted-by: Codex |
2 participants
Serialize parent-death signal resets with readers. On PullFullState failure, use the locked group-exit helper and unlock before entering runExit. Built-in contexts currently return no error; the regression injects that failure. Snapshot mutable group exit status under the signal mutex.
Use atomic key-permission snapshots because shared keys can outlive namespace changes. Replace generated futex bucket pointers with atomic.Pointer while preserving lock-and-revalidate and waiter-lifetime rules.
Return registry-removal errors before changing semaphore indexes and propagate message-queue removal errors, preserving live objects and waiters on denied removals.
Enforce task, signal, session, namespace, filesystem-context, futex and IPC ownership. Check start-time and process-group ancestry contracts and owner aliases. Preserve security-check lock-free readers, callback boundaries, publication phases and task-goroutine ownership.
Depends on #14237. These subsystem changes are based on its checker and nogo commits through 193b205. Rebase onto master after that prerequisite lands to remove those commits from this PR's comparison.
Assisted-by: Codex