Detect unpublished data on macos after fork

Author: cataphract

Cargo.lock

@@ -40,6 +40,9 @@ serial_test = "3.2"
 memfd = { version = "0.6" }
 libc = "0.2"
 
+[target.'cfg(target_os = "macos")'.dependencies]
+portable-atomic = { version = "1.9.0", default-features = false }
+
 [lints.clippy]
 std_instead_of_alloc = "warn"
 std_instead_of_core = "warn"

libdd-library-config/Cargo.toml

@@ -2,7 +2,10 @@
 // SPDX-License-Identifier: Apache-2.0
 extern crate alloc;
 
-#[cfg(any(feature = "process-context-reader", feature = "process-context-writer"))]
+#[cfg(all(
+    any(feature = "process-context-reader", feature = "process-context-writer"),
+    any(target_os = "linux", target_os = "macos", target_os = "windows")
+))]
 pub mod otel_process_ctx;
 pub mod tracer_metadata;
 

libdd-library-config/src/lib.rs

@@ -33,6 +33,8 @@ mod writer;
 compile_error!("OTel process context requires 64-bit atomics on Linux");
 #[cfg(target_os = "linux")]
 pub mod linux;
+#[cfg(target_os = "macos")]
+mod macos;
 
 #[cfg(feature = "process-context-reader")]
 pub use reader::ProcessContextSelfReader;
@@ -92,16 +94,50 @@ mod tests {
         }
     }
 
-    #[cfg(any(target_os = "macos", target_os = "windows"))]
-    mod non_linux {
-        use super::super::MappingHeaderSnapshot;
+    #[cfg(target_os = "macos")]
+    mod macos {
         use core::{ptr, sync::atomic::Ordering};
         use std::io;
 
-        #[cfg(target_os = "macos")]
-        use super::super::writer::macos::otel_process_ctx_v2;
-        #[cfg(target_os = "windows")]
-        use super::super::writer::windows::otel_process_ctx_v2;
+        use super::super::{
+            macos::{HEADER_ADDRESS_MASK, PUBLISHER_PID_SHIFT},
+            writer::macos::otel_process_ctx_v2,
+            MappingHeaderSnapshot,
+        };
+
+        fn published_header() -> *mut u8 {
+            let value = otel_process_ctx_v2.load(Ordering::Acquire);
+            let publisher_pid = (value >> PUBLISHER_PID_SHIFT) as u32;
+            if publisher_pid != std::process::id() {
+                return ptr::null_mut();
+            }
+
+            let header_address = (value & HEADER_ADDRESS_MASK) as usize;
+            ptr::with_exposed_provenance_mut(header_address)
+        }
+
+        pub(super) fn read_process_context() -> io::Result<MappingHeaderSnapshot> {
+            let header_ptr: *const MappingHeaderSnapshot = published_header().cast();
+            if header_ptr.is_null() {
+                return Err(io::Error::new(
+                    io::ErrorKind::NotFound,
+                    "no process context is published",
+                ));
+            }
+            Ok(unsafe { ptr::read(header_ptr) })
+        }
+
+        pub(super) fn is_published() -> bool {
+            !published_header().is_null()
+        }
+    }
+
+    #[cfg(target_os = "windows")]
+    mod windows {
+        use core::{ptr, sync::atomic::Ordering};
+        use std::io;
+
+        use super::super::{writer::windows::otel_process_ctx_v2, MappingHeaderSnapshot};
 
         pub(super) fn read_process_context() -> io::Result<MappingHeaderSnapshot> {
             let header_ptr: *const MappingHeaderSnapshot =
@@ -122,8 +158,10 @@ mod tests {
 
     #[cfg(target_os = "linux")]
     use linux::{is_published, read_process_context};
-    #[cfg(any(target_os = "macos", target_os = "windows"))]
-    use non_linux::{is_published, read_process_context};
+    #[cfg(target_os = "macos")]
+    use macos::{is_published, read_process_context};
+    #[cfg(target_os = "windows")]
+    use windows::{is_published, read_process_context};
 
     #[test]
     #[cfg_attr(miri, ignore)]

libdd-library-config/src/otel_process_ctx.rs

@@ -0,0 +1,26 @@
+// Copyright 2026-Present Datadog, Inc. https://www.datadoghq.com/
+// SPDX-License-Identifier: Apache-2.0
+
+use portable_atomic::AtomicU128;
+
+#[cfg(not(any(target_arch = "aarch64", target_arch = "x86_64")))]
+compile_error!("OTel process context only supports aarch64 and x86_64 on macOS");
+#[cfg(not(target_endian = "little"))]
+compile_error!("OTel process context requires a little-endian macOS target");
+
+pub(super) type AtomicPublishedHeader = AtomicU128;
+
+const _: () = {
+    // Both supported macOS architectures have native 128-bit atomics. Keep this assertion so a
+    // target change cannot silently select portable-atomic's software-lock fallback.
+    assert!(AtomicPublishedHeader::is_always_lock_free());
+    assert!(size_of::<AtomicPublishedHeader>() == size_of::<u128>());
+    assert!(align_of::<AtomicPublishedHeader>() == 16);
+    assert!(size_of::<usize>() == size_of::<u64>());
+};
+
+// The low 64 bits contain the header address and the next 32 bits contain the publisher PID.
+// Keeping them in one value lets readers observe both through a single atomic load.
+#[cfg(feature = "process-context-reader")]
+pub(super) const HEADER_ADDRESS_MASK: u128 = u64::MAX as u128;
+pub(super) const PUBLISHER_PID_SHIFT: u32 = u64::BITS;

libdd-library-config/src/otel_process_ctx/macos.rs

@@ -2,33 +2,52 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use core::{
-    ptr::NonNull,
-    sync::atomic::{AtomicPtr, Ordering},
+    ptr::{self, NonNull},
+    sync::atomic::Ordering,
 };
 use std::io;
 #[cfg(not(feature = "process-context-writer"))]
 use std::sync::OnceLock;
 
 use super::ReaderPlatform;
+use crate::otel_process_ctx::macos::{
+    AtomicPublishedHeader, HEADER_ADDRESS_MASK, PUBLISHER_PID_SHIFT,
+};
 
 pub(super) struct HeaderDiscovery;
 
 impl ReaderPlatform for HeaderDiscovery {
     fn discover_header() -> io::Result<NonNull<u8>> {
-        let header = process_context_global()?.load(Ordering::Acquire);
-        NonNull::new(header).ok_or_else(|| {
-            io::Error::new(io::ErrorKind::NotFound, "no process context is published")
-        })
+        let global = process_context_global()?;
+        let current_pid = std::process::id();
+
+        let value = global.load(Ordering::Acquire);
+        let (publisher_pid, header) = unpack_published_header(value);
+
+        // After fork, the global retains the parent's publication even if the mapping itself was
+        // excluded from inheritance. Treat that stale publication exactly like an unpublished one.
+        if publisher_pid != current_pid {
+            return Err(not_found());
+        }
+
+        NonNull::new(header).ok_or_else(not_found)
     }
 }
 
+fn not_found() -> io::Error {
+    io::Error::new(
+        io::ErrorKind::NotFound,
+        "no process context is published by the current process",
+    )
+}
+
 #[cfg(feature = "process-context-writer")]
-fn process_context_global() -> io::Result<&'static AtomicPtr<u8>> {
+fn process_context_global() -> io::Result<&'static AtomicPublishedHeader> {
     Ok(&crate::otel_process_ctx::writer::macos::otel_process_ctx_v2)
 }
 
 #[cfg(not(feature = "process-context-writer"))]
-fn process_context_global() -> io::Result<&'static AtomicPtr<u8>> {
+fn process_context_global() -> io::Result<&'static AtomicPublishedHeader> {
     static SYMBOL_ADDRESS: OnceLock<usize> = OnceLock::new();
 
     let address = match SYMBOL_ADDRESS.get() {
@@ -53,27 +72,34 @@ fn process_context_global() -> io::Result<&'static AtomicPtr<u8>> {
         }
     };
 
-    // SAFETY: dlsym returned the address of the exported AtomicPtr<u8>. Successful addresses are
-    // cached only for the lifetime of the process.
-    Ok(unsafe { &*(address as *const AtomicPtr<u8>) })
+    // SAFETY: dlsym returned the address of the exported AtomicPublishedHeader. Successful
+    // addresses are cached only for the lifetime of the process.
+    Ok(unsafe { &*(address as *const AtomicPublishedHeader) })
+}
+
+fn unpack_published_header(value: u128) -> (u32, *mut u8) {
+    let publisher_pid = (value >> PUBLISHER_PID_SHIFT) as u32;
+    let header_address = (value & HEADER_ADDRESS_MASK) as usize;
+    (
+        publisher_pid,
+        ptr::with_exposed_provenance_mut(header_address),
+    )
 }
 
 #[cfg(all(test, not(feature = "process-context-writer")))]
 mod tests {
-    use core::{
-        ptr,
-        sync::atomic::{AtomicPtr, Ordering},
-    };
+    use core::{ptr, sync::atomic::Ordering};
 
     use libdd_trace_protobuf::opentelemetry::proto::common::v1::{KeyValue, ProcessContext};
 
     use crate::otel_process_ctx::{
+        macos::{AtomicPublishedHeader, PUBLISHER_PID_SHIFT},
         MappingHeaderSnapshot, ProcessContextSelfReader, PROCESS_CTX_VERSION, SIGNATURE,
     };
 
     #[no_mangle]
     #[allow(non_upper_case_globals)]
-    pub static otel_process_ctx_v2: AtomicPtr<u8> = AtomicPtr::new(ptr::null_mut());
+    pub static otel_process_ctx_v2: AtomicPublishedHeader = AtomicPublishedHeader::new(0);
 
     #[test]
     fn reads_context_from_exported_global() {
@@ -93,11 +119,13 @@ mod tests {
             monotonic_published_at_ns: 1,
             payload_ptr: payload.as_ptr(),
         };
-        otel_process_ctx_v2.store(ptr::from_ref(&header).cast_mut().cast(), Ordering::Release);
+        let published_header = (u128::from(std::process::id()) << PUBLISHER_PID_SHIFT)
+            | ptr::from_ref(&header).expose_provenance() as u128;
+        otel_process_ctx_v2.store(published_header, Ordering::Release);
 
         let reader = ProcessContextSelfReader::new().expect("reader creation should succeed");
         assert_eq!(reader.read().expect("read should succeed"), expected);
 
-        otel_process_ctx_v2.store(ptr::null_mut(), Ordering::Relaxed);
+        otel_process_ctx_v2.store(0, Ordering::Relaxed);
     }
 }

libdd-library-config/src/otel_process_ctx/reader/macos.rs

@@ -8,15 +8,18 @@ use core::{
     ffi::c_void,
     mem::forget,
     ptr::{self, NonNull},
-    sync::atomic::{fence, AtomicPtr, Ordering},
+    sync::atomic::{fence, Ordering},
 };
 use std::io;
 
 use super::{HeaderMemoryHolder, MappingHeader, MonotonicTime};
+use crate::otel_process_ctx::macos::{AtomicPublishedHeader, PUBLISHER_PID_SHIFT};
 
+// A child inherits this global after fork even when minherit excludes the header mapping. Store
+// the publisher PID with the pointer so the child cannot discover its parent's unmapped address.
 #[no_mangle]
 #[allow(non_upper_case_globals)]
-pub static otel_process_ctx_v2: AtomicPtr<u8> = AtomicPtr::new(ptr::null_mut());
+pub static otel_process_ctx_v2: AtomicPublishedHeader = AtomicPublishedHeader::new(0);
 
 // From <mach/vm_inherit.h>; the libc crate does not expose this constant.
 const VM_INHERIT_NONE: libc::c_int = 2;
@@ -80,11 +83,12 @@ impl HeaderMemoryHolder for VmRegion {
     }
 
     fn make_discoverable(&mut self) {
-        otel_process_ctx_v2.store(self.start_addr.as_ptr().cast(), Ordering::Release);
+        let value = pack_published_header(std::process::id(), self.start_addr.as_ptr().cast());
+        otel_process_ctx_v2.store(value, Ordering::Release);
     }
 
     fn unpublish_and_release(mut self) -> io::Result<()> {
-        otel_process_ctx_v2.store(ptr::null_mut(), Ordering::Relaxed);
+        otel_process_ctx_v2.store(0, Ordering::Relaxed);
         // Make it slightly more likely that a reader will observe the unavailability.
         fence(Ordering::SeqCst);
         self.unmap()?;
@@ -97,6 +101,10 @@ impl HeaderMemoryHolder for VmRegion {
     }
 }
 
+fn pack_published_header(publisher_pid: u32, header: *mut u8) -> u128 {
+    (u128::from(publisher_pid) << PUBLISHER_PID_SHIFT) | header.expose_provenance() as u128
+}
+
 impl MonotonicTime for MonotonicClock {
     fn monotonic_time_ns() -> io::Result<u64> {
         // SAFETY: CLOCK_MONOTONIC_RAW is a valid clock ID and this function has no pointer