[release-branch.go1.24] os: hide SetFinalizer from users of Root

Currently Root embeds a root and calls SetFinalizer on &r.root. This
sets the finalizer on the outer root, which is visible to users of
os.Root, and thus they can mutate the finalizer attached to it.

This change modifies Root to not embed its inner root, but rather to
refer to it by pointer. This allows us to set the finalizer on this
independent inner object, preventing users of os.Root from changing the
finalizer. This follows the same pattern as os.File's finalizer.

Fixes #71617.

Change-Id: Ibd199bab1b3c877d5e12ef380fd4647b4e10221f
Reviewed-on: https://go-review.googlesource.com/c/go/+/647876
Auto-Submit: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
(cherry picked from commit a704d39b29dfc21599f644909c0f98bbfa745cb4)
Reviewed-on: https://go-review.googlesource.com/c/go/+/648135
TryBot-Bypass: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>

diff --git a/src/os/root.go b/src/os/root.go
index 04741c02810baa35593f3aafc3f4061a9ea22e47..f91c0f75f30e2aab0b2c31c0a0f206e07d922cd8 100644 (file)
--- a/src/os/root.go
+++ b/src/os/root.go
@@ -60,7 +60,7 @@ func OpenInRoot(dir, name string) (*File, error) {
 //   - When GOOS=plan9 or GOOS=js, Root does not track directories across renames.
 //     On these platforms, a Root references a directory name, not a file descriptor.
 type Root struct {
-       root root
+       root *root
 }
 
 const (

diff --git a/src/os/root_noopenat.go b/src/os/root_noopenat.go
index 8d5ead32b9cd0a7b08d46ccfafab7419d61fd3fa..8be55a029fa2b64afd45ad6e84d2bd30400c5e21 100644 (file)
--- a/src/os/root_noopenat.go
+++ b/src/os/root_noopenat.go
@@ -49,7 +49,7 @@ func newRoot(name string) (*Root, error) {
        if !fi.IsDir() {
                return nil, errors.New("not a directory")
        }
-       return &Root{root{name: name}}, nil
+       return &Root{&root{name: name}}, nil
 }
 
 func (r *root) Close() error {

diff --git a/src/os/root_unix.go b/src/os/root_unix.go
index 4b52b81de71e815682b883dbbaa1defabad44a73..02d3b4bdad007e0de69ebb2ffbd206bf2147cea0 100644 (file)
--- a/src/os/root_unix.go
+++ b/src/os/root_unix.go
@@ -48,11 +48,11 @@ func newRoot(fd int, name string) (*Root, error) {
                syscall.CloseOnExec(fd)
        }
 
-       r := &Root{root{
+       r := &Root{&root{
                fd:   fd,
                name: name,
        }}
-       runtime.SetFinalizer(&r.root, (*root).Close)
+       runtime.SetFinalizer(r.root, (*root).Close)
        return r, nil
 }
 

diff --git a/src/os/root_windows.go b/src/os/root_windows.go
index dcc311cf86f73156a56e48a960f65bbdff0194d2..32dfa070b740fd2577b295dbf3457335c7f9ad0e 100644 (file)
--- a/src/os/root_windows.go
+++ b/src/os/root_windows.go
@@ -105,11 +105,11 @@ func newRoot(fd syscall.Handle, name string) (*Root, error) {
                return nil, &PathError{Op: "open", Path: name, Err: errors.New("not a directory")}
        }
 
-       r := &Root{root{
+       r := &Root{&root{
                fd:   fd,
                name: name,
        }}
-       runtime.SetFinalizer(&r.root, (*root).Close)
+       runtime.SetFinalizer(r.root, (*root).Close)
        return r, nil
 }