tiborvass

package main

/*
#include <stdio.h>
#include <signal.h>
#include <stdlib.h>
#include <unistd.h>

extern double asin(double);
extern double acos(double);

tiborvass

Since Go 1.14, changes in the Go runtime made it more likely for some syscalls to be interrupted by SIGURG despite Go's signal handler being set up with SA_RESTART. In those cases the syscalls return EINTR. In Go 1.15, the standard library packages other than syscall were fixed by adding a retry loop if EINTR is returned (e.g., os.File.Write). However, direct syscalls still may have the issue.

The goal of this document is to allow Docker to upgrade its binaries' Go version past 1.13 with confidence without blindly adding retry loops to every syscall. Throughout this analysis we are assuming SA_RESTART and Linux, as the risk of weird behaviors is on the daemon side.

There are two main tasks:

1. Mark syscalls as EINTR-safe or EINTR-unsafe or EINTR-maybe
2. Once that is done, we can look at the callsites of the EINTR-maybe syscalls to vet whether they truly are EINTR-safe or EINTR-unsafe.

1. Syscall vetting

tiborvass

wsl.exe -d docker-desktop
nsenter -a -t $(pgrep lifecycle-server) find /var/lib/docker/containers -name config.v2.json -exec sed -i'' -E 's/"Running":true(,.*"Restarting":true)/"Running":false\1/' {} \;

tiborvass

Accept4 SYS_ACCEPT
Accept4 SYS_ACCEPT4
Accept SYS_ACCEPT
Access SYS_FACCESSAT
Acct SYS_ACCT
AddKey SYS_ADD_KEY
Adjtimex SYS_ADJTIMEX
AttachLsf SYS_SETSOCKOPT
Bind SYS_BIND
BindToDevice SYS_SETSOCKOPT

tiborvass

# list-syscalls.sh ~/docker ~/containerd ~/cli ~/runc ~/go/src/github.com/docker/libnetwork ~/go/src/github.com/rootless-containers/rootlesskit
procCreateVirtualDisk.Addr()
procOpenVirtualDisk.Addr()
SYS_ACCEPT
SYS_ADD_KEY
SYS_BIND
SYS_CHDIR
SYS_CHROOT
SYS_CLOCK_GETTIME
SYS_CLONE

tiborvass

#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

static

tiborvass

#!/bin/bash

if [ $# -ne 2 ]; then
    echo "Usage: $0 file partSizeInMb";
    exit 0;
fi

file=$1

if [ ! -f "$file" ]; then

tiborvass

package main

import (
	"bufio"
	"fmt"
	"io"
	"log"
	"math/rand"
	"os"
	"os/exec"

tiborvass

tiborvass

#!/bin/bash
useradd -s /bin/bash -m unprivileged
cp -rf ~/.ssh ~unprivileged/
chown -R unprivileged:unprivileged ~unprivileged/.ssh/