feat(sigsafe): allocate safely inside intercepted libc calls

[wan9chi]

The benchmark suite that prices this change merged in #602.

Motivation

The preload library runs inside libc calls such as open, stat, and execve. Programs are allowed to make these calls from a signal handler, or in the child of fork() in a program with many threads. In both situations, using libc's malloc can hang the program forever: the lock inside malloc may be held by a thread that is paused or no longer exists. The preload library still allocates through malloc today, so a traced program can hang in exactly these situations.

What this does

Adds a new crate, sigsafe: Unix syscall wrappers that are safe to call where libc is not — in signal handlers, in fork children, before libc has finished initializing. Its README states the three rules everything in it follows: syscalls only (never through libc on Linux), no locks and no hidden state, and no global allocation.

The no-libc rule is enforced at compile time. rustix can be built with a libc backend, and anything in the dependency graph — including crates outside this repository — can select it; no build script can detect the feature-unification case. So sigsafe's lib.rs references rustix::runtime, a module that exists only in rustix's raw-syscall build: selecting the libc backend makes the crate fail to compile instead of silently losing the guarantee.

On top of the first wrappers (mm::mmap_anonymous, mm::munmap, param::page_size) sits sigsafe::alloc, allocation that never touches malloc, in three layers with only the top exposed:

• MmapAllocator — every allocation asks the kernel for fresh memory pages through sigsafe::mm. It keeps no state of its own, so there is nothing a signal or a fork() can catch locked or half-written.
• ChunkPool — keeps up to 64 freed 64 KiB chunks in a fixed array of atomic pointers, so the next call can reuse memory without asking the kernel again. Taking or returning a chunk is one atomic swap per slot, never a lock, and a thread that disappears mid-operation can strand at most the one chunk it held.
• alloc::arena() — the only public function. It hands one intercepted call its own bump arena (a bump_scope::Bump) that draws chunks from the pool and returns them when the call ends. Values allocated in the arena cannot outlive the call; the borrow checker enforces it.

Uses the arena in one place to start: joining a directory and a relative path when the preload library resolves an fd-relative open. This replaces a malloc-backed path join on a path that runs inside intercepted calls. The rest of the preload still uses malloc; converting it is follow-up work, and this change establishes the crate, the layers, and the lifetime discipline first.

Benchmark

Measured with #602's access-relative suite against this PR's base, interleaved on one x86_64 Linux machine, batch median per 8 tracked opens:

access             -3.2%
access-relative    -0.5%

An earlier run of this branch — before it was stacked — showed access-relative +29% on Linux. That was not the arena: the preload library was being built without optimizations, and the arena's generic, inlining-dependent code paid for that far more than the PathBuf join it replaced (which is nearly free, since getcwd already returns a buffer with room to append). #597 fixed the build; on top of it, the arena is no slower than what it replaces. The investigation is written up in this comment's thread.

Commits

The first commit is an earlier version of the allocator — one lock-free size-class allocator installed as the preload's #[global_allocator] — kept so the two designs can be compared; #599 measured that design end to end and lost. The second commit replaces it with the arena design above. The third moves the allocator into the new sigsafe crate as sigsafe::alloc, adds mm/param and the compile-time backend enforcement, and adds the README.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​bump-scope@​2.3.3

View full report

[github-actions]

fspy benchmark

linux

dynamic/launch             change  +0.44%  [ -3.32% ..  +4.11%]  overhead   +55.97%
dynamic/access             change  -0.94%  [ -1.73% ..  -0.27%]  overhead    +5.67%
dynamic/access-relative    change  +3.37%  [ +2.12% ..  +4.40%]  overhead   +59.72%
static/launch              change  +0.74%  [ -3.53% ..  +5.29%]  overhead  +163.11%
static/access              change  -0.18%  [ -0.90% ..  +0.59%]  overhead  +832.55%
static/access-relative     change  +0.26%  [ -0.57% ..  +0.73%]  overhead +1346.69%

macos

dynamic/launch             change  +0.83%  [ -5.14% ..  +5.84%]  overhead  +230.07%
dynamic/access             change  -0.35%  [-55.29% ..  +6.82%]  overhead    +3.99%
dynamic/access-relative    change  +0.30%  [ -2.58% ..  +3.11%]  overhead  +391.73%

windows

dynamic/launch             change  +0.10%  [ -1.47% ..  +1.62%]  overhead   +27.82%
dynamic/access             change  +0.00%  [ -0.77% ..  +0.76%]  overhead    +0.99%
dynamic/access-relative    change  +0.00%  [ -0.77% ..  +0.76%]  overhead    +1.35%

[wan9chi]

Alternative implementation for comparison: #599 installs a lock-free #[global_allocator] in the preload instead of a per-call arena. Both PRs carry the same access-relative benchmark suite and target main, so their benchmark comments can be read side by side. One of the two should be closed once the numbers land.