Fixes a race condition in killing Sandboxes #959
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
simongdavies
requested review from
danbugs,
dblnz,
devigned,
jprendes,
ludfjig,
marosset and
syntactically
as code owners
simongdavies
force-pushed
the
fix-race-1
branch
3 times, most recently
from
96a6fce to
d200c7c
Compare
jsturtevant
reviewed
Oct 17, 2025
jsturtevant
reviewed
Oct 18, 2025
jsturtevant
reviewed
Oct 18, 2025
simongdavies
force-pushed
the
fix-race-1
branch
from
4e211f2 to
4de305a
Compare
ludfjig
reviewed
Oct 21, 2025
simongdavies
force-pushed
the
fix-race-1
branch
from
cf14cfd to
f1aef3e
Compare
ludfjig
reviewed
Oct 23, 2025
ludfjig
reviewed
Oct 23, 2025
ludfjig
reviewed
Oct 23, 2025
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR fixes a race condition where a sandbox kill could arrive after a guest call completes, incorrectly causing the next guest call to be canceled. The fix introduces generation tracking to ensure kill() only affects the intended guest call.
Key changes:
- Generation tracking prevents stale kills from affecting new guest calls
- Added
call_activeflag to prevent "kill-in-advance" scenario - Breaking change: kill() now only affects actively running guest calls, not future ones
Reviewed Changes
Copilot reviewed 10 out of 11 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| src/tests/rust_guests/simpleguest/src/main.rs | Adds SpinForMs guest function for timing-sensitive tests |
| src/hyperlight_host/tests/integration_test.rs | Updates interrupt tests to reflect new behavior and adds comprehensive stress test |
| src/hyperlight_host/src/sandbox/initialized_multi_use.rs | Introduces CallActiveGuard RAII guard to manage call_active flag |
| src/hyperlight_host/src/mem/shared_mem.rs | Fixes test invocation to properly scope guard page crash tests |
| src/hyperlight_host/src/hypervisor/mod.rs | Adds generation tracking to InterruptHandle trait with extensive documentation |
| src/hyperlight_host/src/hypervisor/kvm.rs | Implements generation-aware interrupt handling for KVM |
| src/hyperlight_host/src/hypervisor/hyperv_windows.rs | Implements generation-aware interrupt handling for Windows Hyper-V |
| src/hyperlight_host/src/hypervisor/hyperv_linux.rs | Implements generation-aware interrupt handling for Linux Hyper-V |
| src/hyperlight_host/Cargo.toml | Updates dependency versions and adds Windows feature flags |
| Justfile | Separates stress test execution to show output clearly |
simongdavies
force-pushed
the
fix-race-1
branch
from
ab3ce0a to
10dae15
Compare
ludfjig
reviewed
Oct 27, 2025
Contributor
ludfjig
left a comment
ludfjig
left a comment
There was a problem hiding this comment.
looks ok but still not convinced about the call_active flag.
ludfjig
reviewed
Oct 27, 2025
jsturtevant
reviewed
Oct 27, 2025
jsturtevant
reviewed
Oct 27, 2025
jsturtevant
reviewed
Oct 27, 2025
simongdavies
force-pushed
the
fix-race-1
branch
from
898cbee to
031641d
Compare
simongdavies
force-pushed
the
fix-race-1
branch
2 times, most recently
from
f9b9edd to
3a271df
Compare
jsturtevant
previously approved these changes
Oct 27, 2025
simongdavies
force-pushed
the
fix-race-1
branch
from
3a271df to
d83b9aa
Compare
jsturtevant
previously approved these changes
Oct 27, 2025
simongdavies
force-pushed
the
fix-race-1
branch
3 times, most recently
from
161701a to
d3c790b
Compare
Signed-off-by: Simon Davies <simongdavies@users.noreply.github.com>
simongdavies
force-pushed
the
fix-race-1
branch
from
d3c790b to
932285a
Compare
jsturtevant
approved these changes
Oct 28, 2025
ludfjig
pushed a commit
to ludfjig/hyperlight
that referenced
this pull request
Oct 28, 2025
Signed-off-by: Simon Davies <simongdavies@users.noreply.github.com>
simongdavies
added a commit
that referenced
this pull request
Oct 29, 2025
* Add poison state to sandbox to prevent misuse (#931) Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com> * Fixes a race condition in killing Sandboxes (#959) Signed-off-by: Simon Davies <simongdavies@users.noreply.github.com> * Update common workflow to 1.8.0 Signed-off-by: Simon Davies <simongdavies@users.noreply.github.com> * Fixes issues from merge and splits trait to expose only public method (#994) Signed-off-by: Simon Davies <simongdavies@users.noreply.github.com> * updates to change log and crate version for v0.9.1 Signed-off-by: Simon Davies <simongdavies@users.noreply.github.com> --------- Signed-off-by: Ludvig Liljenberg <4257730+ludfjig@users.noreply.github.com> Signed-off-by: Simon Davies <simongdavies@users.noreply.github.com> Co-authored-by: Simon Davies <simongdavies@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes a race condition where a sandbox kill arrives after a sandbox has successfully exited causing the subsequent run to fail.
There is a breaking change in this PR, previously if kill was called on an
InterruptHandlebefore or while a guest call was not in progress the next guest call made on theSandboxwould be cancelled , now this scenario is a no-op. kill only takes effect if there is a guest call running.