Fix memory-safety and correctness bugs surfaced by Coverity audit (part 1) - #22266

…rt 1) (#22266)

* daemon: remove machine guid access precheck

Coverity CID 457948 (TOCTOU): machine_guid_get_or_create() checked the
registry path with access() before calling mkdir() while startup still runs
with elevated privileges. Use mkdir() with EEXIST handling directly, matching
existing Netdata directory-creation idioms and removing the check/use race.

* sqlite: clamp alert non_clear_duration for aclk

Coverity CID 440042 (INTEGER_OVERFLOW): health_alarm_log_populate() read
non_clear_duration from SQLite directly into the uint32_t ACLK field.
Clamp negative values to 0 and oversized values to UINT32_MAX before
serializing alert log entries.

* worker_utilization: handle JudyHSDel failure

Coverity CID 468190 (CHECKED_RETURN): worker_unregister() freed the last workname even when JudyHSDel() failed, which can leave a freed workname still indexed in the JudyHS table. Only free and account away the workname after a successful delete, and log unexpected JudyHS delete failures.

* daemon: verify machine guid path is a directory on EEXIST

mkdir() returning EEXIST can mean either an existing directory (the case
we want to accept) or an existing non-directory file at the same path.
Treat the latter as a failure so callers get a clear error instead of
ENOTDIR on subsequent writes.

* worker_utilization: zero-initialize JError_t on the JudyHSDel path

Initialize the local `JError_t` so the `JU_ERRNO` / `JU_ERRID` values
logged on a JudyHSDel() JERR return are always defined, even if Judy
leaves the struct partially populated in some future path.

* sqlite: free metadata cleanup list on shutdown

Coverity CID 455300 (RESOURCE_LEAK): start_metadata_hosts() skipped
store_ctx_cleanup_list() once shutdown was requested, leaving a
worker-owned Judy list unreleased after ownership moved out of
metadata_event_loop(). Call the helper unconditionally so shutdown still
frees the list while its internal guard suppresses database work.

* sqlite: fix pending uuid deletion leak on shutdown

Coverity CID 471887 (RESOURCE_LEAK): metadata workers transferred
pending_uuid_deletion out of the event loop, but skipped
do_pending_uuid_deletion() after shutdown started. Always run the helper
so shutdown still frees the Judy list and queued UUIDs, while keeping
metadata cleanup disabled during shutdown.

* dbengine: close migrated journal fds on failure

Coverity CID 405474 (RESOURCE_LEAK): initialize `fd_v2` before
`nd_mmap_advanced()` and close it on both migration failure paths.
This keeps the success-path ownership transfer through
`journalfile_v2_data_set()` unchanged while preventing leaked file
descriptors when mmap setup or journal build fails.

* systemd-journal: fix duplicate scan dir handle leak

Coverity CID 459644 (RESOURCE_LEAK): nd_journal_directory_scan_recursively()
opened a directory before checking whether it had already been scanned.
Close the duplicate-path DIR handle on the early-return path so repeated
directories do not leak file descriptors.

* health: fix malformed ${label:...} parsing

Coverity CID 439996 (INTEGER_OVERFLOW): only process `${label:...}` placeholders when the token is complete and ends with `}`. This prevents the label-name truncation math from indexing before the local buffer on unterminated placeholders.

* systemd-journal: guard dictionary_set() NULL return in recursive scan

Treat a NULL return from dictionary_set() the same as an existing entry:
close the opendir() handle and return, so the directory descriptor is not
leaked if the dict insertion fails.

* contexts: clone alert config keys to avoid stack-escape UAF

alerts_v2_insert_callback() created `t->configs` with
DICT_OPTION_NAME_LINK_DONT_CLONE. alerts_v2_add() then inserted a UUID
derived from nd_uuid_unparse_full() into the dictionary — but the buffer
holding that UUID was a local on the caller's stack. In
LINK_DONT_CLONE mode the dictionary stores the caller pointer verbatim,
so every inserted key became a dangling stack reference as soon as
alerts_v2_add() returned. Later dictionary operations (including
dictionary_destroy()) would then dereference freed stack memory via
strlen(item->caller_name), a use-after-free on the /api/v2/alerts path.

Drop DICT_OPTION_NAME_LINK_DONT_CLONE from the `t->configs` dictionary so
names are cloned into stable storage. `t->nodes` is left unchanged
because its names come from persistent rrdhost->machine_guid strings, not
from stack buffers.

Related: Coverity CID 414658 flagged an OVERRUN on the insertion line;
the trace itself was a tool-model FP against the commented-out XXH3
hashtable path, but investigating it surfaced this real stack-escape
lifetime bug.

* claim: free split-file claim buffers

Coverity CID 442342 (RESOURCE_LEAK): release the token and rooms
buffers returned by read_by_filename() after
claim_agent_from_split_files() finishes using them.

This normal-exit cleanup also fixes sibling CID 442346, which
reports the same leak root cause for rooms.

* daemon: fix thread id in deadly signal log

Coverity CID 457745 (STRING_OVERFLOW): the reported overflow is not real
because strcatz() bounds the buffer, but the same log path dropped the
thread id by not advancing len after print_uint64(). Update len after the
integer write so the fatal signal message preserves the thread id.

* functions_evloop: make workers_exit checks atomic

Coverity CID 425867 (MISSING_LOCK): use atomic load/store for the shared workers_exit latch in the worker event loop. This removes the unlocked cross-thread race without changing the existing mutex and condition-variable flow.

---------

Co-authored-by: Costa Tsaousis <costa@netdata.cloud>
(cherry picked from commit a50db9c)