Abort a process when FD ownership is violated #124130
Conversation
When an EBADF happens then something else already touched an FD in ways it is not allowed to. At that point things can already be arbitrarily bad, e.g. clobbered mmaps. Recovery is not possible. All we can do is hasten the fire.
rustbot
added
S-waiting-on-review
|
@the8472 Does |
|
Thanks! We'll be able to see these as we listen for both rust panics in-process, and also pull in macOS crash reports (as described here https://github.com/zed-industries/zed/blob/main/docs/src/developing_zed__debugging_crashes.md) |
|
|
|
Well, we'll see the abort and be able to infer from the stack trace, but we don't ship stderr. |
|
Is there a way to say "run the panic handler, then just die instead of unwinding"? I think there is, isn't there? |
|
( I think I mean panic hook. ) |
|
Alas, FUSE can inject EBADF so it's not a good idea to tear down the process in response to that, even if that's very questionable behavior by the filesystem. |
|
new PR: #124210 |
… r=Mark-Simulacrum Abort a process when FD ownership is violated When an owned FD has already been closed before it's dropped that means something else touched an FD in ways it is not allowed to. At that point things can already be arbitrarily bad, e.g. clobbered mmaps. Recovery is not possible. All we can do is hasten the fire. Unlike the previous attempt in rust-lang#124130 this shouldn't suffer from the possibility that FUSE filesystems can return arbitrary errors.
…=Mark-Simulacrum Abort a process when FD ownership is violated When an owned FD has already been closed before it's dropped that means something else touched an FD in ways it is not allowed to. At that point things can already be arbitrarily bad, e.g. clobbered mmaps. Recovery is not possible. All we can do is hasten the fire. Unlike the previous attempt in rust-lang#124130 this shouldn't suffer from the possibility that FUSE filesystems can return arbitrary errors.
When an EBADF happens then something else already touched an FD in ways it is not allowed to. At that point things can already be arbitrarily bad, e.g. clobbered mmaps. Recovery is not possible.
All we can do is hasten the fire.
It could help with the investigation in #124105. Currently only
Drop for Dirpanics whileOwnedFdcloses silently. If we makeOwnedFdfail loudly too then it should tell us whether the bug is specific toDiror there's more general FD-clobbering going on.