Repository navigation
host: launch watchdog sampling without shell parsing - #829
Closed
thehobbit85 wants to merge 3 commits into
Closed
thehobbit85 wants to merge 3 commits into
thehobbit85 wants to merge 3 commits into
Conversation
thehobbit85
force-pushed
the
codex/watchdog-sample-argv
branch
from
November 1, 2026 03:29
a00be71 to
1ee28cf
Compare
thehobbit85
force-pushed
the
codex/watchdog-sample-argv
branch
4 times, most recently
from
November 1, 2026 12:33
4820ba5 to
568ae94
Compare
thehobbit85
force-pushed
the
codex/watchdog-sample-argv
branch
7 times, most recently
from
November 2, 2026 17:43
20f55b3 to
182793c
Compare
thehobbit85
force-pushed
the
codex/watchdog-sample-argv
branch
2 times, most recently
from
November 3, 2026 03:13
8fc694e to
b34377e
Compare
github-actions
Bot
added
host
seedds
added a commit
that referenced
this pull request
Nov 3, 2026
…syntax in DM_WATCH_SAMPLE stays part of the path (#829) crash.c built "/usr/bin/sample <pid> 1 -f '<path>'" in a 1,200-byte buffer and ran it with system(), so an apostrophe ended the quote and sampling failed, shell syntax in the path ran, and a long path was cut. watch_sample() now posix_spawns /usr/bin/sample with the pid, 1, -f and the path as separate arguments, sends stdout and stderr to /dev/null by file actions, resumes an interrupted waitpid, and reports setup, spawn, wait, exit and signal failures as before; the watchdog still exits with 128 + SIGALRM. The lint baseline drops crash.c's bugprone-command-processor entry. t_watch_sample runs the real watchdog_main with a recording sampler and injected failures (150 checks; system is poisoned so a shell call does not compile). Run against the real /usr/bin/sample, the spawn wrote a 117-line sample to a folder named "John's Mac". No game run: the code runs only after the watchdog fires with DM_WATCH_SAMPLE set. Co-authored-by: Eliran Zach <4012041+thehobbit85@users.noreply.github.com>
Owner
|
Landed unchanged as a05f800 on main, with you as co-author. Thanks! I checked it here: the fixture passes all 150 checks, the docs tests pass, and the spawn code run against the real |
seedds
added a commit
that referenced
this pull request
Nov 3, 2026
…syntax in DM_WATCH_SAMPLE stays part of the path (#829) crash.c built "/usr/bin/sample <pid> 1 -f '<path>'" in a 1,200-byte buffer and ran it with system(), so an apostrophe ended the quote and sampling failed, shell syntax in the path ran, and a long path was cut. watch_sample() now posix_spawns /usr/bin/sample with the pid, 1, -f and the path as separate arguments, sends stdout and stderr to /dev/null by file actions, resumes an interrupted waitpid, and reports setup, spawn, wait, exit and signal failures as before; the watchdog still exits with 128 + SIGALRM. The lint baseline drops crash.c's bugprone-command-processor entry. t_watch_sample runs the real watchdog_main with a recording sampler and injected failures (150 checks; system is poisoned so a shell call does not compile). Run against the real /usr/bin/sample, the spawn wrote a 117-line sample to a folder named "John's Mac". No game run: the code runs only after the watchdog fires with DM_WATCH_SAMPLE set. Co-authored-by: Eliran Zach <4012041+thehobbit85@users.noreply.github.com>
Owner
Know-It-All-Brother
pushed a commit
to Know-It-All-Brother/nxnative
that referenced
this pull request
Nov 9, 2026
…syntax in DM_WATCH_SAMPLE stays part of the path (seedds#829) crash.c built "/usr/bin/sample <pid> 1 -f '<path>'" in a 1,200-byte buffer and ran it with system(), so an apostrophe ended the quote and sampling failed, shell syntax in the path ran, and a long path was cut. watch_sample() now posix_spawns /usr/bin/sample with the pid, 1, -f and the path as separate arguments, sends stdout and stderr to /dev/null by file actions, resumes an interrupted waitpid, and reports setup, spawn, wait, exit and signal failures as before; the watchdog still exits with 128 + SIGALRM. The lint baseline drops crash.c's bugprone-command-processor entry. t_watch_sample runs the real watchdog_main with a recording sampler and injected failures (150 checks; system is poisoned so a shell call does not compile). Run against the real /usr/bin/sample, the spawn wrote a 117-line sample to a folder named "John's Mac". No game run: the code runs only after the watchdog fires with DM_WATCH_SAMPLE set. Co-authored-by: Eliran Zach <4012041+thehobbit85@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Launch watchdog sampling with
posix_spawnand literal arguments instead of interpolatingDM_WATCH_SAMPLEinto a shell command. Apostrophes and shell characters remain literal, long paths are preserved, interrupted waits resume, and sampling duration, redirection, diagnostics and final exit remain unchanged.Addresses the watchdog-path finding in issue #313, not the whole roadmap. Main still uses the vulnerable shell interpolation. The fixture executes the real watchdog with a recorder, never samples user applications, rejects shell calls at compile time and covers an absent optional fault variable. The only lint-baseline removal is the stale production command-processor finding.
Current head
b34377e014fcef9a826d6cf30462e24a70b8ffe1.python3 -m unittest dm.tools.tests.test_docs dm.tools.tests.test_usagepassed on this revision (17 tests). The feature sources, tests and documentation match the previously validated revision8fc694e5d8fabyte for byte.This PR includes main
6136418bcd564f086cf57cb0a59e8f997d36445e. Main still passes watchdog sampling through a shell. The literal argument path and corresponding path-handling tests remain necessary.Local validation on
8fc694e5d8fa.python3 -m unittest dm.tools.tests.test_docs dm.tools.tests.test_usage— 17 tests passed.The watchdog fixture passed 150 assertions. The upstream filesystem fixture and Unreal virtual-span alignment/reallocation control also passed.
GitHub checks for this revision
Earlier local validation on
69a66e168048.python3 -m unittest dm.tools.tests.test_docs dm.tools.tests.test_usage. All 17 tests passed.make -C dm/host/tests GAME=010015100B514000 watch-samplepassed all 150 assertions using a recorder. Earlier ASan/UBSan and analyzer checks were successful. An earlier full local host run failed an audio callback-restart assertion. This revision’s local tests covered the watchdog and documentation.Game impact is confined to watchdog diagnostics, independent of title content. The synthetic fixture covers actual production spawning/waiting without attaching to a game. Prior regression availability checks lacked the required game builds/routes; no fresh game, gameplay, shader-chain, device or performance claim is made. General behavior remains in the threads reference; validation evidence is here. No agent plans, progress records or game data are included.