fix(plugin)!: panic safety - #84
Merged
Merged
Conversation
Using "C-unwind" was the result of confusion about panic handling, it's not safe to unwind into C++ code under (sinsp) under any circumstances. Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Previously, Routine was an opaque handle with no built-in unsubscribe —
callers had to manually call ThreadPool::unsubscribe and were warned to
use ManuallyDrop to avoid unsafety. The closure was a bare Box<F> passed
as the thread pool's data pointer, with no coordination between drop and
the callback.
Redesign Routine::drop to automatically unsubscribe and free the closure,
using an atomic phase protocol to coordinate with the callback:
The closure (Box<F>) and the coordination state (Arc<SharedState>) are
separate allocations. SharedState holds an AtomicUsize phase flag, a
type-erased pointer to the closure, and a typed destructor. The thread
pool receives Arc::into_raw(SharedState) as its data pointer; Routine
holds its own Arc clone.
Three phase states — IDLE, RUNNING, DROP_REQUESTED — determine who
frees the closure:
- cb_wrapper: borrows the raw Arc via from_raw/clone/forget (leaving
the raw refcount undisturbed), then swaps RUNNING into phase. If it
sees DROP_REQUESTED, the closure is already freed — return 0. After
executing the closure, CAS RUNNING→IDLE; if that fails (drop set
DROP_REQUESTED), free the closure and reclaim the raw Arc refcount.
On Break (return 0), also reclaim the raw refcount since the
framework won't call again.
- Routine::drop: calls unsubscribe, then swaps DROP_REQUESTED into
phase. If previous value was IDLE, free the closure. If RUNNING,
the callback will handle cleanup on return.
Known leak: Routine::drop does not reclaim the thread pool's Arc
clone of SharedState, because a callback may have been dispatched but
not yet entered cb_wrapper (the framework provides no "drain" hook).
This is bounded — just the SharedState (AtomicUsize + two pointers +
Arc overhead). The closure itself (which may capture arbitrarily large
state) is always freed.
Also remove ThreadPool::unsubscribe — unsubscription is now automatic.
Routine is #[must_use] to prevent accidental immediate drops.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
poiana
added
kind/bug
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ekoops, gnosek The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
LGTM label has been added. DetailsGit tree hash: 4d2c1566808b88903373d779677fd0f8a7cf9d04 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind bug
Any specific area of the project related to this PR?
/area plugin
What this PR does / why we need it:
Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
Does this PR introduce a user-facing change?: