feat(sigsafe): allocate safely inside intercepted libc calls - #596

Part of #605 — this lands the malloc-class fix (the largest of the hazards there); the lazy-dlsym, hot-path panic, TLS reentrancy, and posix_spawn-thread items remain follow-ups.

The benchmark suite that prices this change merged in #602.

Motivation

The preload library runs inside libc calls such as open, stat, and execve. Programs are allowed to make these calls from a signal handler, or in the child of fork() in a program with many threads. In both situations, using libc's malloc can hang the program forever: the lock inside malloc may be held by a thread that is paused or no longer exists. The preload library still allocates through malloc today, so a traced program can hang in exactly these situations.

What this does

Adds a new crate, sigsafe: Unix syscall wrappers that are safe to call where libc is not — in signal handlers, in fork children, before libc has finished initializing. Its README states the three rules everything in it follows: syscalls only (never through libc on Linux), no locks and no hidden state, and no global allocation.

The no-libc rule is enforced at compile time. rustix can be built with a libc backend, and anything in the dependency graph — including crates outside this repository — can select it; no build script can detect the feature-unification case. So sigsafe's lib.rs references rustix::runtime, a module that exists only in rustix's raw-syscall build: selecting the libc backend makes the crate fail to compile instead of silently losing the guarantee.

On top of the first wrappers (mm::mmap_anonymous, mm::munmap, param::page_size) sits sigsafe::alloc, allocation that never touches malloc, in three layers with only the top exposed:

• MmapAllocator — every allocation asks the kernel for fresh memory pages through sigsafe::mm. It keeps no state of its own, so there is nothing a signal or a fork() can catch locked or half-written.
• ChunkPool — keeps up to 64 freed 64 KiB chunks in a fixed array of atomic pointers, so the next call can reuse memory without asking the kernel again. Taking or returning a chunk is one atomic swap per slot, never a lock, and a thread that disappears mid-operation can strand at most the one chunk it held.
• alloc::arena() — the only public function. It hands one intercepted call its own bump arena (a bump_scope::Bump) that draws chunks from the pool and returns them when the call ends. Values allocated in the arena cannot outlive the call; the borrow checker enforces it.

Uses the arena in one place to start: RawExec::to_c_str_array, which builds the NULL-terminated argv/envp pointer arrays that an intercepted exec hands to the real call, then drops them when it returns. That temporary's lifetime is already exactly a bump arena's, so the change is nine lines and adds no unsafe.

It has to come off malloc because exec runs in the child of fork() in multithreaded programs — posix_spawn forks then execs — where malloc's lock may be held by a thread that no longer exists. Both platforms take this path on every intercepted exec.

The strings the array points at are still owned by Exec and still come from malloc, as does the rest of the preload; converting them is follow-up. This change establishes the crate, the layers, and the lifetime discipline in the smallest place all three apply.

Benchmark

The access-relative suite (#602) was added while this PR still used the arena for the fd-relative join, and it earned its keep twice: an early run showed +29% on Linux, which turned out to be the preload building without optimizations (fixed by #597), and the corrected runs showed the arena join costing ~+3% over PathBuf::push — which is why the join reverted and the arena moved to execveat. The investigation is written up in this comment's thread. With the join reverted, both suites should sit at baseline.

Commits

The first commit is an earlier version of the allocator — one lock-free size-class allocator installed as the preload's #[global_allocator] — kept so the two designs can be compared; #599 measured that design end to end and lost. The second commit replaces it with the arena design above. The third moves the allocator into the new sigsafe crate as sigsafe::alloc, adds mm/param and the compile-time backend enforcement, and adds the README. The fourth moves the arena use from the join to execveat and fixes the dangling pointer there.

🤖 Generated with Claude Code