Annotate intentional handler fallthrough #19

Merged
andrew merged 4 commits from 18 into main 2026-08-03 12:14:31 -04:00
Collaborator

Fixes #18.

  • Adds a GCC/Clang fallthrough annotation at the public HANDLE_GROUP case boundary.
  • Compiles the existing grouped-handler test with -Werror=implicit-fallthrough on GCC and Clang, so the consumer warning cannot return unnoticed.

Verified with GCC 13: a -Wextra build and all 36 CTest tests pass.

Fixes #18. - Adds a GCC/Clang fallthrough annotation at the public `HANDLE_GROUP` case boundary. - Compiles the existing grouped-handler test with `-Werror=implicit-fallthrough` on GCC and Clang, so the consumer warning cannot return unnoticed. Verified with GCC 13: a `-Wextra` build and all 36 CTest tests pass.
tachikoma added 1 commit 2026-08-02 23:53:45 -04:00
Annotate intentional handler fallthrough
Some checks failed
libakerror CI Build / coverage (push) Successful in 2m51s
libakerror CI Build / cmake_build (push) Successful in 2m53s
libakerror CI Build / thread_sanitizer (push) Failing after 5m53s
libakerror CI Build / mutation_test (push) Successful in 37m49s
a902c95155
Co-authored-by: Andrew Kesterson <andrew@aklabs.net>
Owner

@tachikoma the thread sanitizer is failing

@tachikoma the thread sanitizer is failing
Author
Collaborator

Acknowledged. PR #19 has no assignee, so I have not changed branch 18. Assign it to Tachikoma if you want me to diagnose and fix the ThreadSanitizer failure.

Acknowledged. PR #19 has no assignee, so I have not changed branch `18`. Assign it to Tachikoma if you want me to diagnose and fix the ThreadSanitizer failure.
tachikoma was assigned by andrew 2026-08-03 06:41:36 -04:00
Author
Collaborator

Status: started ThreadSanitizer diagnosis on branch 18 in response to Andrew’s report. I will reproduce the sanitizer failure, correct the cause on this PR branch, and rerun the focused and complete verification.

Status: started ThreadSanitizer diagnosis on branch `18` in response to Andrew’s report. I will reproduce the sanitizer failure, correct the cause on this PR branch, and rerun the focused and complete verification.
tachikoma added 1 commit 2026-08-03 07:29:00 -04:00
Run ThreadSanitizer tests without ASLR
Some checks failed
libakerror CI Build / coverage (push) Successful in 2m49s
libakerror CI Build / thread_sanitizer (push) Failing after 2m54s
libakerror CI Build / cmake_build (push) Successful in 3m3s
libakerror CI Build / mutation_test (push) Has been cancelled
0a6cb303f5
Co-authored-by: Andrew Kesterson <andrew@aklabs.net>
Author
Collaborator

Status: fixed and pushed as 0a6cb30 (Run ThreadSanitizer tests without ASLR).

Diagnosis: ThreadSanitizer was aborting before main() in every affected executable with unexpected memory mapping; this was its Linux shadow-memory reservation colliding with ASLR, not a reported data race. Linux AKERR_SANITIZE=thread CTest invocations now use setarch <architecture> -R; configure fails clearly if setarch is unavailable.

Verification:

  • ThreadSanitizer: 36/36 CTest passed.
  • GCC 13 -Wextra: 36/36 CTest passed.
Status: fixed and pushed as `0a6cb30` (`Run ThreadSanitizer tests without ASLR`). Diagnosis: ThreadSanitizer was aborting before `main()` in every affected executable with `unexpected memory mapping`; this was its Linux shadow-memory reservation colliding with ASLR, not a reported data race. Linux `AKERR_SANITIZE=thread` CTest invocations now use `setarch <architecture> -R`; configure fails clearly if `setarch` is unavailable. Verification: - ThreadSanitizer: 36/36 CTest passed. - GCC 13 `-Wextra`: 36/36 CTest passed.
tachikoma added 1 commit 2026-08-03 07:49:44 -04:00
Install the ThreadSanitizer ASLR runner
Some checks failed
libakerror CI Build / cmake_build (push) Successful in 2m53s
libakerror CI Build / coverage (push) Successful in 2m52s
libakerror CI Build / thread_sanitizer (push) Failing after 2m52s
libakerror CI Build / mutation_test (push) Successful in 43m58s
997828116b
Co-authored-by: Andrew Kesterson <andrew@aklabs.net>
Author
Collaborator

Status: pushed CI fix 9978281 (Install the ThreadSanitizer ASLR runner).

The failing sanitizer job is also red on the current main commit, while its normal build and coverage checks are green. The ThreadSanitizer workflow documented setarch as required to avoid its ASLR mapping abort, but did not install the util-linux package that provides it; the script therefore fell back to an unsandboxed TSan run. The job now installs util-linux explicitly.

Verification: the exact scripts/thread_test.sh build/thread-ci-verify --output-junit ... CI command passed 36/36 locally. The new Forge Actions result is pending; I have not claimed it green yet.

Status: pushed CI fix `9978281` (`Install the ThreadSanitizer ASLR runner`). The failing sanitizer job is also red on the current `main` commit, while its normal build and coverage checks are green. The ThreadSanitizer workflow documented `setarch` as required to avoid its ASLR mapping abort, but did not install the `util-linux` package that provides it; the script therefore fell back to an unsandboxed TSan run. The job now installs `util-linux` explicitly. Verification: the exact `scripts/thread_test.sh build/thread-ci-verify --output-junit ...` CI command passed 36/36 locally. The new Forge Actions result is pending; I have not claimed it green yet.
Author
Collaborator

Status: run 45 still fails its ThreadSanitizer job. I exhausted the Forge Action-log API (the server denies log access to this collaborator token and tea cannot use the pre-1.26 log endpoint), then reproduced the runner constraint from the current configuration.

This is a runner-level failure, not a library test failure: Gitea maps ubuntu-latest to a Docker job container, and Docker’s default seccomp profile blocks the personality syscall used by setarch -R. That is the ASLR control ThreadSanitizer requires on this kernel. The same job is red on current main; normal build and coverage are green.

9978281 makes the required setarch package explicit and the exact sanitizer script passes 36/36 locally, but a repository workflow cannot grant Docker permission to call personality. The required next action is to configure the Starfort runner with a host or seccomp-permitting label, then select that known label for the ThreadSanitizer job. I have not guessed a label or weakened the runner security from this PR.

Status: run 45 still fails its ThreadSanitizer job. I exhausted the Forge Action-log API (the server denies log access to this collaborator token and `tea` cannot use the pre-1.26 log endpoint), then reproduced the runner constraint from the current configuration. This is a runner-level failure, not a library test failure: Gitea maps `ubuntu-latest` to a Docker job container, and Docker’s default seccomp profile blocks the `personality` syscall used by `setarch -R`. That is the ASLR control ThreadSanitizer requires on this kernel. The same job is red on current `main`; normal build and coverage are green. `9978281` makes the required `setarch` package explicit and the exact sanitizer script passes 36/36 locally, but a repository workflow cannot grant Docker permission to call `personality`. The required next action is to configure the Starfort runner with a host or seccomp-permitting label, then select that known label for the ThreadSanitizer job. I have not guessed a label or weakened the runner security from this PR.
tachikoma was unassigned by andrew 2026-08-03 08:43:56 -04:00
logikoma was assigned by andrew 2026-08-03 08:43:57 -04:00
Collaborator

Validation complete: GCC 13 built this branch with -Wextra and all 36 CTest programs passed. The HANDLE_GROUP annotation removes the implicit-fallthrough warning as intended. Clang is not installed in this environment, so I could not repeat that half of the matrix.

This PR also contains unrelated ThreadSanitizer/ASLR and CI dependency changes in CMakeLists.txt and .gitea/workflows/ci.yaml. #18 is the public handler-warning defect; please split those changes into their own ticket and PR so this branch remains focused.

Validation complete: GCC 13 built this branch with -Wextra and all 36 CTest programs passed. The HANDLE_GROUP annotation removes the implicit-fallthrough warning as intended. Clang is not installed in this environment, so I could not repeat that half of the matrix. This PR also contains unrelated ThreadSanitizer/ASLR and CI dependency changes in CMakeLists.txt and .gitea/workflows/ci.yaml. #18 is the public handler-warning defect; please split those changes into their own ticket and PR so this branch remains focused.
Owner

@logikoma if all we need is some packages installed, that can be handled by modifying the gitea workflow in the repository.

@logikoma if all we need is some packages installed, that can be handled by modifying the gitea workflow in the repository.
Collaborator

Correct. Commit 9978281 already installs util-linux in the repository workflow. Run 45 still has only thread_sanitizer failed; cmake, coverage, and mutation checks succeeded. The package is therefore present but not sufficient: the Docker runner blocks the personality syscall that setarch -R needs to disable ASLR for ThreadSanitizer. This needs a runner-level seccomp/label change; no further repository package change will grant that permission.

Correct. Commit 9978281 already installs `util-linux` in the repository workflow. Run 45 still has only `thread_sanitizer` failed; cmake, coverage, and mutation checks succeeded. The package is therefore present but not sufficient: the Docker runner blocks the `personality` syscall that `setarch -R` needs to disable ASLR for ThreadSanitizer. This needs a runner-level seccomp/label change; no further repository package change will grant that permission.
Owner

@logikoma open a new issue with details around the setarch problem you're seeing on the gitea runner, then remove the thread sanitizer from the default build until that issue is resolved, commit that fix to this branch

@logikoma open a new issue with details around the setarch problem you're seeing on the gitea runner, then remove the thread sanitizer from the default build until that issue is resolved, commit that fix to this branch
Collaborator

Status: beginning Andrew-requested follow-up. I am filing the Gitea runner setarch/personality constraint as a separate issue, then I will remove ThreadSanitizer from the default CI workflow on branch 18, commit the focused change, and run the available verification.

Status: beginning Andrew-requested follow-up. I am filing the Gitea runner `setarch`/`personality` constraint as a separate issue, then I will remove ThreadSanitizer from the default CI workflow on branch `18`, commit the focused change, and run the available verification.
logikoma added 1 commit 2026-08-03 09:32:33 -04:00
Disable ThreadSanitizer CI pending runner fix
All checks were successful
libakerror CI Build / cmake_build (push) Successful in 2m53s
libakerror CI Build / coverage (push) Successful in 2m50s
libakerror CI Build / mutation_test (push) Successful in 37m30s
7d0e467181
Co-authored-by: Andrew Kesterson <andrew@aklabs.net>
Author
Collaborator

Standing down on this PR. #18 and this PR are both assigned to @logikoma, who has taken Andrew's instruction in comment 899 and is committing to branch 18. I am not pushing to that branch so we do not collide.

For the record of what is already on it from me: 0a6cb30 (setarch -R for ThreadSanitizer's shadow-mapping abort) and 9978281 (install util-linux so setarch exists in CI). Both are the ThreadSanitizer/CI work logikoma flagged in comment 882 as out of scope for the handler-warning defect, so they are the changes that move if that split happens.

Reassign to Tachikoma if you want me back on it.

Standing down on this PR. #18 and this PR are both assigned to @logikoma, who has taken Andrew's instruction in comment 899 and is committing to branch `18`. I am not pushing to that branch so we do not collide. For the record of what is already on it from me: `0a6cb30` (`setarch -R` for ThreadSanitizer's shadow-mapping abort) and `9978281` (install `util-linux` so `setarch` exists in CI). Both are the ThreadSanitizer/CI work logikoma flagged in comment 882 as out of scope for the handler-warning defect, so they are the changes that move if that split happens. Reassign to Tachikoma if you want me back on it.
Collaborator

Status: completed Andrew-requested follow-up in 7d0e467 (Disable ThreadSanitizer CI pending runner fix).

  • Filed #20 for the Gitea Docker runner constraint: setarch -R requires the personality syscall, which the default seccomp profile denies.
  • Removed the default thread_sanitizer workflow job until #20 supplies a runner label/policy that permits it.
  • Verified git diff --check, GCC 13 configure/build, and 36/36 CTest programs passed.

The commit is pushed to branch 18; Forge Actions has been triggered by that push.

Status: completed Andrew-requested follow-up in 7d0e467 (`Disable ThreadSanitizer CI pending runner fix`). - Filed #20 for the Gitea Docker runner constraint: `setarch -R` requires the `personality` syscall, which the default seccomp profile denies. - Removed the default `thread_sanitizer` workflow job until #20 supplies a runner label/policy that permits it. - Verified `git diff --check`, GCC 13 configure/build, and 36/36 CTest programs passed. The commit is pushed to branch `18`; Forge Actions has been triggered by that push.
andrew merged commit fdb8ffaad0 into main 2026-08-03 12:14:31 -04:00
Sign in to join this conversation.