Description

When using a binary stream processor within a diff plugin, there is a race condition between when the binaryProcessor.err field is set to the underlying exec.Cmd's exit status by (*binaryProcessor).wait() and when that processor's err status is checked in in diff.(Applier).Apply by a plugin.

I am working on moving windows layer tar extraction (#1681) to a separate binary that is registered as a stream processor in the containerd toml. However, it is not guaranteed that (binaryProcessors).wait will run before checking (binaryProcessors).Err, and there is no way to currently wait on the error field to be updated.

The diff.Applier used in the "walking" diff plugin can detect errors even if the processors return nil since the digest of the data read from the processors will be different, and subsequent calls to archive.Apply will error on invalid data.
However, the tar extraction is the final step, so there is no other way to check for extraction errors in the binary.

Possible solutions:

• (binaryProcessors).Err blocks until (binaryProcessors).wait sets (binaryProcessors).err appropriately
• binaryProcessors exposes a Wait() or Done() function that blocks until the underlying command completes and the error is updated

Steps to reproduce the issue

1. Create a binary that reads from stdin and then writes an error to stderr and exits with a non-zero code
2. Register it as under "stream_processors" in the containerd.toml
3. Call it from a plugin and check the error status.

Describe the results you received and expected

(binaryProcessors).Err returns nil even if the binary processor exited with a non-zero code and wrote an error to its stderr

What version of containerd are you using?

1.6

Any other relevant information

No response

Show configuration if it is related to CRI plugin.

No response