Skip to content

Unifying boilerplate code for handling child processes - part 3#8203

Merged
alexey-tikhonov merged 16 commits into
SSSD:masterfrom
alexey-tikhonov:child-helpers-3
Dec 3, 2025
Merged

Unifying boilerplate code for handling child processes - part 3#8203
alexey-tikhonov merged 16 commits into
SSSD:masterfrom
alexey-tikhonov:child-helpers-3

Conversation

@alexey-tikhonov

@alexey-tikhonov alexey-tikhonov commented Nov 15, 2025

Copy link
Copy Markdown
Member

Follow up of #7991 / #8174

I also wanted to make 'proxy' use sss_child_start() but that appeared to be not that straightforward:

  • 'proxy' doesn't use FDs for communication with a child process but sbus
  • for this reason there is no point to create pipes => no reason to supply _io output arg => no way to get the pid of child process
  • but 'proxy' uses 'pid' to signal child process

It could be possible to amend sss_child_start() to return 'pid' in a different way but... imo, a better solution would be to fix 'proxy' to end child process via sbus communication, not relying on a signal. This is out of scope for this PR (even thought keeping pc_init_sig_handler() that practically is a copy of child_sig_handler() is frustrating).

@alexey-tikhonov alexey-tikhonov added the no-backport This should go to target branch only. label Nov 15, 2025
@alexey-tikhonov
alexey-tikhonov force-pushed the child-helpers-3 branch 5 times, most recently from e8040d7 to 4eac248 Compare November 26, 2025 18:03
@alexey-tikhonov

Copy link
Copy Markdown
Member Author

/gemini review

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request is a good step towards unifying boilerplate code for handling child processes, specifically by centralizing timeout handling. The changes are consistent and remove a significant amount of redundant code. However, I've identified a critical issue related to potential NULL pointer dereferences in the new timeout handling logic. A memory allocation failure in the new helper function sss_child_create_timeout_cb_pvt is not handled by the callers, which could lead to a crash. I've provided two review comments with suggestions to make the new code more robust against such failures.

Comment thread src/providers/proxy/proxy_auth.c
Comment thread src/util/child_handlers.c
@alexey-tikhonov
alexey-tikhonov marked this pull request as ready for review November 27, 2025 08:19
@alexey-tikhonov alexey-tikhonov added coverity Trigger a coverity scan and removed coverity Trigger a coverity scan labels Nov 28, 2025
@alexey-tikhonov

Copy link
Copy Markdown
Member Author

Note: Covscan is green.

@thalman thalman left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Codewise it looks great, thank you Alexey. Please, fix the commit message.

Comment thread src/providers/be_dyndns.c
@alexey-tikhonov

Copy link
Copy Markdown
Member Author

(rebased)

@thalman thalman left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, ACK

@pbrezina pbrezina left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack, this is a nice improvement.

It might be better to use tevent_req_endtime, but since that would mean reworking the whole patch set, lets keep it as is.

@alexey-tikhonov

Copy link
Copy Markdown
Member Author

It might be better to use tevent_req_endtime

I didn't know about this function...
But looks like it doesn't allow to specify custom error code, some parts of SSSD code rely on specific error code.

Reviewed-by: Pavel Březina <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
and make use of it in gpo/ifp/ssh code.

Reviewed-by: Pavel Březina <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
Reviewed-by: Pavel Březina <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
Reviewed-by: Pavel Březina <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
Reviewed-by: Pavel Březina <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
Reviewed-by: Pavel Březina <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
Reviewed-by: Pavel Březina <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
Reviewed-by: Pavel Březina <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
'nsupdate_child_state::timeout_handler' wasn't really used.

Reviewed-by: Pavel Březina <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
Reviewed-by: Pavel Březina <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
Unused since c7e2d7a

Reviewed-by: Pavel Březina <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
Reviewed-by: Pavel Březina <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
Reviewed-by: Pavel Březina <[email protected]>
Reviewed-by: Tomáš Halman <[email protected]>
@sssd-bot

sssd-bot commented Dec 3, 2025

Copy link
Copy Markdown
Contributor

The pull request was accepted by @alexey-tikhonov with the following PR CI status:


🟢 CodeFactor (success)
🟢 CodeQL (success)
🟢 osh-diff-scan:fedora-rawhide-x86_64:upstream (success)
🟢 rpm-build:centos-stream-10-x86_64:upstream (success)
🟢 rpm-build:fedora-41-x86_64:upstream (success)
🟢 rpm-build:fedora-42-x86_64:upstream (success)
🟢 rpm-build:fedora-43-x86_64:upstream (success)
🟢 rpm-build:fedora-rawhide-x86_64:upstream (success)
🟢 Analyze (target) / cppcheck (success)
🟢 Build / freebsd (success)
🟢 Build / make-distcheck (success)
🟢 ci / intgcheck (centos-10) (success)
🟢 ci / intgcheck (fedora-41) (success)
🟢 ci / intgcheck (fedora-42) (success)
🟢 ci / intgcheck (fedora-43) (success)
🟢 ci / intgcheck (fedora-44) (success)
🟢 ci / prepare (success)
🟢 ci / system (centos-10) (success)
🟢 ci / system (fedora-41) (success)
🟢 ci / system (fedora-42) (success)
🟢 ci / system (fedora-43) (success)
🟢 ci / system (fedora-44) (success)
➖ Coverity scan / coverity (skipped)
🟢 Static code analysis / codeql (success)
🟢 Static code analysis / pre-commit (success)
🟢 Static code analysis / python-system-tests (success)


There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.

@alexey-tikhonov
alexey-tikhonov merged commit ec3e974 into SSSD:master Dec 3, 2025
11 checks passed
@pbrezina

pbrezina commented Dec 3, 2025

Copy link
Copy Markdown
Member

It might be better to use tevent_req_endtime

I didn't know about this function... But looks like it doesn't allow to specify custom error code, some parts of SSSD code rely on specific error code.

That can be handled in _recv, we already convert it to ETIMEDOUT. https://github.com/SSSD/sssd/blob/master/src/util/util.h#L158

@alexey-tikhonov

alexey-tikhonov commented Dec 3, 2025

Copy link
Copy Markdown
Member Author

That can be handled in _recv, we already convert it to ETIMEDOUT

Currently 'EFAULT', 'ERR_RENEWAL_CHILD', 'ERR_DYNDNS_TIMEOUT', 'ERR_P11_CHILD_TIMEOUT' and 'ERR_PASSKEY_CHILD_TIMEOUT' are also used.
Some of those do not actually matter as long as it is not EOK, but some are important (IIRC, initially I wanted to use 'ETIMEDOUT' everywhere but figured those specific error codes are checked for / handled explicitly later).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Accepted no-backport This should go to target branch only.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants