Repository navigation
fix(eventfd): close a wake descriptor only when its last holder drops - #423
Merged
Merged
Conversation
A core's wake eventfd closed when its thread exited, while the Control Plane notifier and the Tokio AsyncFd registrations still held the raw descriptor number. The kernel reuses the lowest free number, so a late wake could write into an unrelated file opened afterwards. The Data Plane EventFd and its notifiers now share the descriptors through an Arc of OwnedFd, so they close once, when the last holder drops. The bridge EventFd hands out BorrowedFd instead of RawFd, and the Tokio wrapper keeps an Arc to the wake pair for the life of its AsyncFd. The Linux eventfd is also created with EFD_CLOEXEC. Closes #419
When a batched read stalled, queued submission entries still carried the raw descriptors of files that close as the batch returns. Entering the ring again could submit reads against reused descriptor numbers. A stalled ring is now replaced, or marked poisoned and never entered again, with reads falling back to a sequential path. Per-read state and the stall cleanup helpers move into uring_read_state.
farhan-syah
added
the
run-ci
Timing thresholds in unit tests fail under machine load. The KV update test now checks one entry per key and the last written value. The timeseries ingest and aggregation tests drop their timers and keep the row-count and result assertions. Throughput belongs in benchmarks.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #419. A wake descriptor closes only when its last holder drops, so a wake for a dead core can never write into a file that reused the descriptor number.
Changes
EventFdandEventFdNotifiershare anArcof owned descriptors. The notifier isClone, notCopy. A wake for a core that is gone lands in its still-open eventfd, which nothing reads. The eventfd is created withEFD_CLOEXEC.nodedb-bridge: theAsyncFdwatcher holds the shared wake pair itself, and the descriptor getters returnBorrowedFd<'_>, notRawFd. This changes the crate's public API.MAX_STALLED_WAITSis retired and replaced. Before, its unsubmitted entries kept raw descriptors of files that closed when the call returned, and the next call submitted them against whatever file reused the numbers.A workspace sweep found no other raw descriptor that can outlive its owner.
Test plan
notify_after_the_core_dropped_leaves_a_later_file_intact(the issue's reproduction)descriptor_closes_only_when_the_last_holder_dropswakes_after_a_core_panicked_at_open_leave_a_later_file_intact: a realspawn_corepanics at engine open; later wakes and a dispatch leave a newly opened file byte-identical, and the request fails with "core-0 is gone"cargo clippy --workspace --all-targets --all-features -- -D warnings,cargo fmt --all -- --check, allscripts/ci/gates