Avoid std::terminate in FsUserContext destructor (Plan9)#40417
Open
Avoid std::terminate in FsUserContext destructor (Plan9)#40417
Conversation
FsUserContext::~FsUserContext() used THROW_LAST_ERROR_IF() which throws exceptions. If this destructor runs during stack unwinding from another exception, std::terminate is called immediately. Replace with LOG_LAST_ERROR_IF() to log failures without throwing. These syscalls (setresuid/setresgid/setgroups to restore root) should virtually never fail, but if they do, logging is the appropriate response in a destructor. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens the Linux Plan9 helper RAII cleanup path by preventing FsUserContext teardown from throwing during exception unwinding. It fits the codebase by making temporary UID/GID impersonation cleanup follow the usual destructor-safe logging pattern instead of terminating the process.
Changes:
- Replaced throwing restore syscalls in
FsUserContext::~FsUserContext()withLOG_LAST_ERROR_IF. - Preserved constructor behavior so setup failures still propagate immediately.
- Limited the change to the Plan9 Linux utility cleanup path.
OneBlue
previously approved these changes
May 5, 2026
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
OneBlue
approved these changes
May 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Avoid potential
std::terminatefrom throwing inFsUserContextdestructor.Problem
FsUserContext::~FsUserContext()insrc/linux/plan9/p9util.cppusedTHROW_LAST_ERROR_IF()to validate thatsys_setresuid,sys_setresgid, andsys_setgroupssucceeded when restoring root. If this destructor runs during stack unwinding from another in-flight exception, the second exception triggersstd::terminate()and aborts the process.Fix
Replace
THROW_LAST_ERROR_IFwithLOG_LAST_ERROR_IFfor the three syscalls. Standard pattern for destructors.Notes
THROW_LAST_ERROR_IFcorrectly - failures during setup should propagate.