13643103650

Committed 03 Mar 2025 10:17PM UTC coverage: 71.819% (-0.05%) from 71.867%

Build # 13643103650

Build Type

push

github

Committed by

web-flow

Commit Message

tree-wide: several cleanups and fixlets prompted by Coverity (#36431)

Coverage Stats

78 of 90 new or added lines in 6 files covered. (86.67%)

899 existing lines in 53 files now uncovered.

294620 of 410227 relevant lines covered (71.82%)

715110.21 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

54.84

/src/shared/async.c

/* SPDX-License-Identifier: LGPL-2.1-or-later */

#include <errno.h>
#include <stddef.h>
#include <sys/prctl.h>
#include <sys/wait.h>
#include <unistd.h>

#include "async.h"
#include "errno-util.h"
#include "fd-util.h"
#include "log.h"
#include "macro.h"
#include "process-util.h"
#include "signal-util.h"

int asynchronous_sync(pid_t *ret_pid) {
        int r;

        /* This forks off an invocation of fork() as a child process, in order to initiate synchronization to
         * disk. Note that we implement this as helper process rather than thread as we don't want the sync() to hang our
         * original process ever, and a thread would do that as the process can't exit with threads hanging in blocking
         * syscalls. */

        r = safe_fork("(sd-sync)", FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|(ret_pid ? 0 : FORK_DETACH), ret_pid);
        if (r < 0)
                return r;
        if (r == 0) {
                /* Child process */
                sync();
                _exit(EXIT_SUCCESS);
        }

        return 0;
}

int asynchronous_fsync(int fd, pid_t *ret_pid) {
        int r;

        assert(fd >= 0);
        /* Same as asynchronous_sync() above, but calls fsync() on a specific fd */

        r = safe_fork_full("(sd-fsync)",
                           /* stdio_fds= */ NULL,
                           /* except_fds= */ &fd,
                           /* n_except_fds= */ 1,
                           FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|(ret_pid ? 0 : FORK_DETACH), ret_pid);
        if (r < 0)
                return r;
        if (r == 0) {
                /* Child process */
                (void) fsync(fd);
                _exit(EXIT_SUCCESS);
        }

        return 0;
}

/* We encode the fd to close in the userdata pointer as an unsigned value. The highest bit indicates whether
 * we need to fork again */
#define NEED_DOUBLE_FORK (1U << (sizeof(unsigned) * 8 - 1))

static int close_func(void *p) {
        unsigned v = PTR_TO_UINT(p);

        (void) prctl(PR_SET_NAME, (unsigned long*) "(sd-close)");

        /* Note: 💣 This function is invoked in a child process created via glibc's clone() wrapper. In such
         *       children memory allocation is not allowed, since glibc does not release malloc mutexes in
         *       clone() 💣 */

        if (v & NEED_DOUBLE_FORK) {
                pid_t pid;

                v &= ~NEED_DOUBLE_FORK;

                /* This inner child will be reparented to the subreaper/PID 1. Here we turn on SIGCHLD, so
                 * that the reaper knows when it's time to reap. */
                pid = clone_with_nested_stack(close_func, SIGCHLD|CLONE_FILES, UINT_TO_PTR(v));
                if (pid >= 0)
                        return 0;
        }

        close((int) v); /* no assert() here, we are in the child and the result would be eaten up anyway */
        return 0;
}

int asynchronous_close(int fd) {
        unsigned v;
        pid_t pid;
        int r;

        /* This is supposed to behave similar to safe_close(), but actually invoke close() asynchronously, so
         * that it will never block. Ideally the kernel would have an API for this, but it doesn't, so we
         * work around it, and hide this as a far away as we can.
         *
         * It is important to us that we don't use threads (via glibc pthread) in PID 1, hence we'll do a
         * minimal subprocess instead which shares our fd table via CLONE_FILES. */

        if (fd < 0)
                return -EBADF; /* already invalid */

        PROTECT_ERRNO;

        v = (unsigned) fd;

        /* We want to fork off a process that is automatically reaped. For that we'd usually double-fork. But
         * we can optimize this a bit: if we are PID 1 or a subreaper anyway (the systemd service manager
         * process qualifies as this), we can avoid the double forking, since the double forked process would
         * be reparented back to us anyway. */
        r = is_reaper_process();
        if (r < 0)
                log_debug_errno(r, "Cannot determine if we are a reaper process, assuming we are not: %m");
        if (r <= 0)
                v |= NEED_DOUBLE_FORK;

        pid = clone_with_nested_stack(close_func, CLONE_FILES | ((v & NEED_DOUBLE_FORK) ? 0 : SIGCHLD), UINT_TO_PTR(v));
        if (pid < 0)
                safe_close(fd); /* local fallback */
        else if (v & NEED_DOUBLE_FORK) {

                /* Reap the intermediate child. Key here is that we specify __WCLONE, since we didn't ask for
                 * any signal to be sent to us on process exit, and otherwise waitid() would refuse waiting
                 * then.
                 *
                 * We usually prefer calling waitid(), but before kernel 4.7 it didn't support __WCLONE while
                 * waitpid() did. Hence let's use waitpid() here, it's good enough for our purposes here. */
                for (;;)
                        if (waitpid(pid, NULL, __WCLONE) >= 0 || errno != EINTR)
                                break;
        }

        return -EBADF; /* return an invalidated fd */
}

void asynchronous_close_many(const int fds[], size_t n_fds) {
        assert(fds || n_fds == 0);

        FOREACH_ARRAY(i, fds, n_fds)
                asynchronous_close(*i);
}

int asynchronous_rm_rf(const char *p, RemoveFlags flags) {
        int r;

        assert(p);

        /* Forks off a child that destroys the specified path. This will be best effort only, i.e. the child
         * will attempt to do its thing, but we won't wait for it or check its success. */

        r = safe_fork("(sd-rmrf)", FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DETACH, NULL);
        if (r != 0)
                return r;

        /* Child */

        /* Let's block SIGTERM here, to grant the operation more time on e.g. final killing spree
         * during shutdown. If this gets stalled pid1 would eventually send SIGKILL to us. */
        BLOCK_SIGNALS(SIGTERM);

        r = rm_rf(p, flags);
        if (r < 0) {
                log_debug_errno(r, "Failed to rm -rf '%s', ignoring: %m", p);
                _exit(EXIT_FAILURE); /* This is a detached process, hence no one really cares, but who knows
                                      * maybe it's good for debugging/tracing to return an exit code
                                      * indicative of our failure here. */
        }

        _exit(EXIT_SUCCESS);
}

1	/* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3	#include <errno.h>
4	#include <stddef.h>
5	#include <sys/prctl.h>
6	#include <sys/wait.h>
7	#include <unistd.h>
8
9	#include "async.h"
10	#include "errno-util.h"
11	#include "fd-util.h"
12	#include "log.h"
13	#include "macro.h"
14	#include "process-util.h"
15	#include "signal-util.h"
16
17	int asynchronous_sync(pid_t *ret_pid) {	4✔
18	int r;	4✔
19
20	/* This forks off an invocation of fork() as a child process, in order to initiate synchronization to
21	* disk. Note that we implement this as helper process rather than thread as we don't want the sync() to hang our
22	* original process ever, and a thread would do that as the process can't exit with threads hanging in blocking
23	* syscalls. */
24
25	r = safe_fork("(sd-sync)", FORK_RESET_SIGNALS\|FORK_CLOSE_ALL_FDS\|(ret_pid ? 0 : FORK_DETACH), ret_pid);	4✔
26	if (r < 0)	68✔
27	return r;
28	if (r == 0) {	68✔
29	/* Child process */
30	sync();	64✔
31	_exit(EXIT_SUCCESS);	64✔
32	}
33
34	return 0;
35	}
36
37	int asynchronous_fsync(int fd, pid_t *ret_pid) {	×
38	int r;	×
39
40	assert(fd >= 0);	×
41	/* Same as asynchronous_sync() above, but calls fsync() on a specific fd */
42
43	r = safe_fork_full("(sd-fsync)",	×
44	/* stdio_fds= */ NULL,
45	/* except_fds= */ &fd,
46	/* n_except_fds= */ 1,
47	FORK_RESET_SIGNALS\|FORK_CLOSE_ALL_FDS\|(ret_pid ? 0 : FORK_DETACH), ret_pid);
48	if (r < 0)	×
49	return r;
50	if (r == 0) {	×
51	/* Child process */
NEW 52	(void) fsync(fd);	×
53	_exit(EXIT_SUCCESS);	×
54	}
55
56	return 0;
57	}
58
59	/* We encode the fd to close in the userdata pointer as an unsigned value. The highest bit indicates whether
60	* we need to fork again */
61	#define NEED_DOUBLE_FORK (1U << (sizeof(unsigned) * 8 - 1))
62
63	static int close_func(void *p) {	×
64	unsigned v = PTR_TO_UINT(p);	×
65
66	(void) prctl(PR_SET_NAME, (unsigned long*) "(sd-close)");	×
67
68	/* Note: 💣 This function is invoked in a child process created via glibc's clone() wrapper. In such
69	* children memory allocation is not allowed, since glibc does not release malloc mutexes in
70	* clone() 💣 */
71
72	if (v & NEED_DOUBLE_FORK) {	×
73	pid_t pid;	×
74
75	v &= ~NEED_DOUBLE_FORK;	×
76
77	/* This inner child will be reparented to the subreaper/PID 1. Here we turn on SIGCHLD, so
78	* that the reaper knows when it's time to reap. */
79	pid = clone_with_nested_stack(close_func, SIGCHLD\|CLONE_FILES, UINT_TO_PTR(v));	×
80	if (pid >= 0)	×
81	return 0;
82	}
83
84	close((int) v); /* no assert() here, we are in the child and the result would be eaten up anyway */	×
85	return 0;	×
86	}
87
88	int asynchronous_close(int fd) {	8,639✔
89	unsigned v;	8,639✔
90	pid_t pid;	8,639✔
91	int r;	8,639✔
92
93	/* This is supposed to behave similar to safe_close(), but actually invoke close() asynchronously, so
94	* that it will never block. Ideally the kernel would have an API for this, but it doesn't, so we
95	* work around it, and hide this as a far away as we can.
96	*
97	* It is important to us that we don't use threads (via glibc pthread) in PID 1, hence we'll do a
98	* minimal subprocess instead which shares our fd table via CLONE_FILES. */
99
100	if (fd < 0)	8,639✔
101	return -EBADF; /* already invalid */	8,639✔
102
103	PROTECT_ERRNO;	×
104
105	v = (unsigned) fd;	4,281✔
106
107	/* We want to fork off a process that is automatically reaped. For that we'd usually double-fork. But
108	* we can optimize this a bit: if we are PID 1 or a subreaper anyway (the systemd service manager
109	* process qualifies as this), we can avoid the double forking, since the double forked process would
110	* be reparented back to us anyway. */
111	r = is_reaper_process();	4,281✔
112	if (r < 0)	4,281✔
113	log_debug_errno(r, "Cannot determine if we are a reaper process, assuming we are not: %m");	×
114	if (r <= 0)	4,281✔
115	v \|= NEED_DOUBLE_FORK;	137✔
116
117	pid = clone_with_nested_stack(close_func, CLONE_FILES \| ((v & NEED_DOUBLE_FORK) ? 0 : SIGCHLD), UINT_TO_PTR(v));	4,281✔
118	if (pid < 0)	4,281✔
119	safe_close(fd); /* local fallback */	×
120	else if (v & NEED_DOUBLE_FORK) {	4,281✔
121
122	/* Reap the intermediate child. Key here is that we specify __WCLONE, since we didn't ask for
123	* any signal to be sent to us on process exit, and otherwise waitid() would refuse waiting
124	* then.
125	*
126	* We usually prefer calling waitid(), but before kernel 4.7 it didn't support __WCLONE while
127	* waitpid() did. Hence let's use waitpid() here, it's good enough for our purposes here. */
128	for (;;)	137✔
129	if (waitpid(pid, NULL, __WCLONE) >= 0 \|\| errno != EINTR)	137✔
130	break;
131	}
132
133	return -EBADF; /* return an invalidated fd */	4,281✔
134	}
135
136	void asynchronous_close_many(const int fds[], size_t n_fds) {	×
137	assert(fds \|\| n_fds == 0);	×
138
139	FOREACH_ARRAY(i, fds, n_fds)	×
140	asynchronous_close(*i);	×
141	}	×
142
143	int asynchronous_rm_rf(const char *p, RemoveFlags flags) {	188✔
144	int r;	188✔
145
146	assert(p);	188✔
147
148	/* Forks off a child that destroys the specified path. This will be best effort only, i.e. the child
149	* will attempt to do its thing, but we won't wait for it or check its success. */
150
151	r = safe_fork("(sd-rmrf)", FORK_RESET_SIGNALS\|FORK_CLOSE_ALL_FDS\|FORK_DETACH, NULL);	188✔
152	if (r != 0)	1,415✔
153	return r;	188✔
154
155	/* Child */
156
157	/* Let's block SIGTERM here, to grant the operation more time on e.g. final killing spree
158	* during shutdown. If this gets stalled pid1 would eventually send SIGKILL to us. */
159	BLOCK_SIGNALS(SIGTERM);	1,227✔
160
161	r = rm_rf(p, flags);	1,227✔
162	if (r < 0) {	1,227✔
163	log_debug_errno(r, "Failed to rm -rf '%s', ignoring: %m", p);	×
164	_exit(EXIT_FAILURE); /* This is a detached process, hence no one really cares, but who knows	×
165	* maybe it's good for debugging/tracing to return an exit code
166	* indicative of our failure here. */
167	}
168
169	_exit(EXIT_SUCCESS);	1,227✔
170	}

systemd / systemd / 13643103650

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous