Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(image): resolve scan deadlock when error occurs in slow mode #4336

Merged
merged 3 commits into from
May 21, 2023
Merged

fix(image): resolve scan deadlock when error occurs in slow mode #4336

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e4b54a7
Fix scan deadlock when error in slow mode
mpoindexter May 11, 2023
48fff72
Move semaphore into goroutine
mpoindexter May 15, 2023
891cb4b
Use errgroup
mpoindexter May 16, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 29 additions & 20 deletions pkg/fanal/artifact/image/image.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,6 +214,10 @@ func (a Artifact) consolidateCreatedBy(diffIDs, layerKeys []string, configFile *

func (a Artifact) inspect(ctx context.Context, missingImage string, layerKeys, baseDiffIDs []string,
layerKeyMap map[string]LayerInfo, configFile *v1.ConfigFile) error {

ctx, cancel := context.WithCancel(ctx)
defer cancel()

done := make(chan struct{})
errCh := make(chan error)
limit := semaphore.New(a.artifactOption.Slow)
Expand All @@ -225,31 +229,36 @@ func (a Artifact) inspect(ctx context.Context, missingImage string, layerKeys, b
}

go func(ctx context.Context, layerKey string) {
var err error
defer func() {
limit.Release(1)
if err != nil {
errCh <- err
}
done <- struct{}{}
}()

layer := layerKeyMap[layerKey]

// If it is a base layer, secret scanning should not be performed.
var disabledAnalyers []analyzer.Type
if slices.Contains(baseDiffIDs, layer.DiffID) {
disabledAnalyers = append(disabledAnalyers, analyzer.TypeSecret)
}

layerInfo, err := a.inspectLayer(ctx, layer, disabledAnalyers)
if err != nil {
errCh <- xerrors.Errorf("failed to analyze layer (%s): %w", layer.DiffID, err)
return
}
if err = a.cache.PutBlob(layerKey, layerInfo); err != nil {
errCh <- xerrors.Errorf("failed to store layer: %s in cache: %w", layerKey, err)
return
}
if lo.IsNotEmpty(layerInfo.OS) {
osFound = layerInfo.OS
}
err = func() error {
layer := layerKeyMap[layerKey]

// If it is a base layer, secret scanning should not be performed.
var disabledAnalyers []analyzer.Type
if slices.Contains(baseDiffIDs, layer.DiffID) {
disabledAnalyers = append(disabledAnalyers, analyzer.TypeSecret)
}

layerInfo, err := a.inspectLayer(ctx, layer, disabledAnalyers)
if err != nil {
return xerrors.Errorf("failed to analyze layer (%s): %w", layer.DiffID, err)
}
if err = a.cache.PutBlob(layerKey, layerInfo); err != nil {
return xerrors.Errorf("failed to store layer: %s in cache: %w", layerKey, err)
}
if lo.IsNotEmpty(layerInfo.OS) {
osFound = layerInfo.OS
}
return nil
}()
}(ctx, k)
}

Expand Down
73 changes: 73 additions & 0 deletions pkg/fanal/artifact/image/image_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1829,6 +1829,79 @@ func TestArtifact_Inspect(t *testing.T) {
},
wantErr: "put layer failed",
},
{
name: "sad path, PutBlob returns an error with multiple layers and Slow enabled",
imagePath: "../../test/testdata/vuln-image.tar.gz",
artifactOpt: artifact.Option{
Slow: true,
},
missingBlobsExpectation: cache.ArtifactCacheMissingBlobsExpectation{
Args: cache.ArtifactCacheMissingBlobsArgs{
ArtifactID: "sha256:33f9415ed2cd5a9cef5d5144333619745b9ec0f851f0684dd45fa79c6b26a650",
BlobIDs: []string{
"sha256:1d02588865377e478a263c4ef2b020d8bf8d9919fdbd14243283b35249b91d4a",
"sha256:7b2d1df7e78b9e5c851676d9cc04bad8d7e86deb2661f0e15ff3d7f37bf53d53",
"sha256:57508fe06ce45edcad30f95a9da631edf746914b0ffa32fa13b83a133529828e",
"sha256:f8d6b5b326b6bad89cf20b94e1c98380187e536ec34795d18c00907f9a35aeb5",
},
},
Returns: cache.ArtifactCacheMissingBlobsReturns{
MissingBlobIDs: []string{
"sha256:1d02588865377e478a263c4ef2b020d8bf8d9919fdbd14243283b35249b91d4a",
"sha256:7b2d1df7e78b9e5c851676d9cc04bad8d7e86deb2661f0e15ff3d7f37bf53d53",
"sha256:57508fe06ce45edcad30f95a9da631edf746914b0ffa32fa13b83a133529828e",
"sha256:f8d6b5b326b6bad89cf20b94e1c98380187e536ec34795d18c00907f9a35aeb5",
},
},
},
putBlobExpectations: []cache.ArtifactCachePutBlobExpectation{
{

Args: cache.ArtifactCachePutBlobArgs{
BlobID: "sha256:1d02588865377e478a263c4ef2b020d8bf8d9919fdbd14243283b35249b91d4a",
BlobInfoAnything: true,
},

Returns: cache.ArtifactCachePutBlobReturns{
Err: errors.New("put layer failed"),
},
},
{

Args: cache.ArtifactCachePutBlobArgs{
BlobID: "sha256:7b2d1df7e78b9e5c851676d9cc04bad8d7e86deb2661f0e15ff3d7f37bf53d53",
BlobInfoAnything: true,
},

Returns: cache.ArtifactCachePutBlobReturns{
Err: errors.New("put layer failed"),
},
},
{

Args: cache.ArtifactCachePutBlobArgs{
BlobID: "sha256:57508fe06ce45edcad30f95a9da631edf746914b0ffa32fa13b83a133529828e",
BlobInfoAnything: true,
},

Returns: cache.ArtifactCachePutBlobReturns{
Err: errors.New("put layer failed"),
},
},
{

Args: cache.ArtifactCachePutBlobArgs{
BlobID: "sha256:f8d6b5b326b6bad89cf20b94e1c98380187e536ec34795d18c00907f9a35aeb5",
BlobInfoAnything: true,
},

Returns: cache.ArtifactCachePutBlobReturns{
Err: errors.New("put layer failed"),
},
},
},
wantErr: "put layer failed",
},
{
name: "sad path, PutArtifact returns an error",
imagePath: "../../test/testdata/alpine-311.tar.gz",
Expand Down