fix(journal): improve journal file access error handling and validation - #22310

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

sequenceDiagram
    participant RE as RRDEngine
    participant J2 as JournalV2 (mmap)
    participant Mem as Protected Memory Area
    participant Log as Logger

    Note over RE, Mem: Retention Scan: find_uuid_first_time loop

    RE->>J2: NEW: journalfile_v2_data_acquire_with_hint()
    J2-->>RE: Return j2_header pointer & NEW: journal_v2_file_size

    alt Header acquisition failed
        RE->>RE: Skip to next datafile
    end

    RE->>RE: PROTECTED_ACCESS_SETUP (mmap guards)

    alt Access Signal (SIGBUS/SIGSEGV) or no_signal_received is false
        RE->>Log: CHANGED: "failed to access journalfile"
    else Access Successful
        RE->>Mem: CHANGED: Read header fields (start_time, offsets, count)
        
        Note over RE: NEW: Strict Bounds Validation
        RE->>RE: Check __builtin_mul_overflow(metric_count, size)
        
        alt NEW: Validation Error (Offset/Size > File Size)
            RE->>Log: NEW: "metric list exceeds journal file size"
            RE->>RE: Set journal_access_failed = true
        else Validation Success
            loop For each UUID entry
                RE->>RE: NEW: Check if journal_search_start >= metric_count
                RE->>Mem: Access uuid_list[index]
                Note right of Mem: Binary search or direct access
            end
        end
    end

    RE->>J2: journalfile_v2_data_release()

    opt NEW: Access Failure skip
        RE->>RE: Skip early-release logic
        RE->>RE: Continue to next datafile
    end

    RE->>RE: datafile_release_and_acquire_next_for_retention()

Pull request overview

This PR adjusts rrdengine’s journal v2 scanning so journal header fields are accessed only after PROTECTED_ACCESS_SETUP, and adds additional bounds validation when walking the journal metric list (to better handle corrupted/unreadable journal files).

Changes:

• Pass data_size to journalfile_v2_data_acquire_with_hint() and use it for validating metric-list bounds.
• Move journal header reads (start_time_ut, metric_offset, metric_count) under PROTECTED_ACCESS_SETUP.
• Add guard logic for running past metric_count and skip journals when protected access / validation fails.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Pull request overview

Improves robustness of journal v2 file access during retention scanning by performing header/metric list validation under protected access and skipping truncated/invalid journals safely.

Changes:

• Read header fields only after PROTECTED_ACCESS_SETUP and treat protection failures as access failures.
• Validate metric_offset/metric_count against the journal file size using overflow-safe arithmetic and skip invalid files.
• Guard against journal_search_start >= journal_metric_count to avoid invalid indexing.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Pull request overview

Hardens journal v2 access during DBENGINE retention scanning by moving header-derived reads under protected access and validating metric directory bounds against the mapped file size to avoid out-of-bounds access on truncated/corrupt journals.

Changes:

• Acquire journal v2 mapped size via journalfile_v2_data_acquire_with_hint() and validate metric_offset/metric_count with overflow-safe arithmetic before indexing.
• Read header fields (start_time_ut, metric_offset, metric_count) only under PROTECTED_ACCESS_SETUP and treat access faults as “skip and continue”.
• Add guard for journal_search_start >= journal_metric_count to prevent invalid indexing during the scan loop.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

No issues found during runtime, LGTM!