util: report back child errors to parent and throw by ViniciusCestarii · Pull Request #312 · bitcoin-core/libmultiprocess

ViniciusCestarii · 2026-07-20T18:32:01Z

Report execvp() and close() failures to the parent via a socket and throw from SpawnProcess.

Previously the parent didn't have a way of knowing whether the child process successfully execute or not without polling for it or waiting for it.

Now SpawnProcess waits for the exec() to happen before returning and before throwing it also reaps the child, preventing zombie process.

Also make post-fork child not rely on on perror(), which is not async-signal-safe.

This addresses the TODO on commit 69652f0

DrahtBot · 2026-07-20T18:32:14Z

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Reviews

See the guideline and AI policy for information on the review process.

Type	Reviewers
ACK	xyzconstant, ryanofsky
Concept ACK	enirox001

If your review is incorrectly listed, please copy-paste  into the comment that the bot should ignore.

Conflicts

Reviewers, this pull request conflicts with the following ones:

#231 (Add windows support by ryanofsky)

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

ryanofsky

Concept ACK dee4383. I plan to review more and left a suggestion below.

I think PR description might be underselling the change, because it describes the main advantage as avoiding a perror call that is not signal safe (so could hang). But I think a bigger improvement is translating the execvp failure in the child into an exception in the parent. Previously the parent didn't have a way of knowing whether the child process successfully execute or not without polling for it or waiting for it.

ViniciusCestarii · 2026-07-20T20:45:27Z

Thanks for reviewing @ryanofsky! I updated the PR description to sell this PR more and I will address your comment.

xyzconstant

Concept ACK dee4383

Left some comments about descriptor leaks on the error paths. Planning to review more once you update on ryanofsky's feedback.

Sjors · 2026-07-21T08:28:18Z

Note that this change happens very close to the code touched by #311, but does seem orthogonal at first glance.

ViniciusCestarii · 2026-07-21T13:50:02Z

Thanks @xyzconstant for reviewing! I have force-pushed d417706 and pushed a761aca and updated PR title and description.

I have addresed:

@xyzconstant comment about leaking fds and throwing wrong errno and @ryanofsky comment for reporting a struct ChildError to cover execv and close errors on d417706.
@xyzconstant comment that this PR could benefit with a function for reading the error from child so I added ReadSpawnResult on a761aca and also renamed ChildError to SpawnError to cover the parent error on reading from socket.

I believe this now conflicts with #311 but it should be a simple rebase for whichever PR merges second.

I also noticed that there are several throws after fork that could benefit from reaping the child to prevent zombie process, but I believe this could be a follow up.

ryanofsky

Code review ACK a761aca. Nice changes that should substantially improve error reporting.

I left some suggestions below but they are not important, this should already be an improvement over current code. Also I think #311 will be merged first and this will need to be rebased, but the two pr's should complement each other and not conflict very much.

Would note that even with #311 there is a still a race condition since CLOEXEC flag is not applied right away and even with this PR there are still errors not handled like connect_info_to_args or KJ_SYSCALL syscall throwing which could cause leaks, so more improvements could be made as followups.

The posix code is definitely getting more complicated as a result of these error handling improvements (especially compared to the windows code) but it seems like there might not be a way to avoid this with current Bitcoin core code which is not applying CLOEXEC flags, so file descriptors will leak into child processes. This prevents using posix_spawn instead of fork/exec.

ViniciusCestarii · 2026-07-30T15:10:08Z

Thanks again for the reviews! Forced-push eecda07 squashing into a single commit and basing these changes on #311. I also addressed @ryanofsky comments.

ryanofsky

Code review ACK eecda07. Left minor suggests below but this looks good as-is.

Might want to note in commit messages or PR description that this does change SpawnProcess behavior a little bit beyond error reporting since it now waits for the exec() to happen before returning instead of just the fork() so it might be a little slower (not that it should matter in practice)

ryanofsky · 2026-08-03T16:48:09Z

+    (void)close(error_fds[1]);
+    if (error) {
+        (void)close(fds[1]);
+        throw std::system_error(error->err, std::system_category(), SpawnErrorName(error->which));


In commit "util: report back child error to parent and throw" (eecda07)

In the places there this function is throwing after calling fork() and it returns a child pid (lines 248, 289, and 296) it looks like this code will leak the pid and leave behind a zombie process. I think it would make sense to call waitpid these places, with the pid and maybe with NOHANG.

Good catch. Fixed it in a separate commit: 3f05b11

I went with SIGKILL followed by a blocking wait rather than NOHANG because at some places the child may still be alive and racing toward exec, so NOHANG would usually return 0 and leave the zombie behind. After a SIGKILL the wait is guaranteed to reap and returns immediately.

re: #312 (comment)

Make sense sense. IIUC if NOHANG approach was used it might appear to work but could still be racy and leave behind zombie processes.

ViniciusCestarii · 2026-08-03T20:07:13Z

Thanks for the review! Forced push 3f05b11 addressing #312 (comment) adding a note on function ReadSpawnResult and #312 (comment) by adding the function KillAndReapChild and calling it before throwing.

Updated PR description with: SpawnProcess waits for the exec() to happen before returning and before throwing it also reaps the child, preventing zombie process.

xyzconstant · 2026-08-05T18:03:16Z

LGTM. ACK 3f05b11

enirox001

Concept ACK

ryanofsky

Code review ACK 3f05b11. Looks great and makes the libmultiprocess library more competent at spawning processes, actually providing specific error information if this fails

ryanofsky · 2026-08-11T19:05:44Z

+            _exit(126);
        }

        execvp(argv[0], argv.data());


In commit "util: report back child error to parent and throw" (4a56c18)

Might be good to comment above that execvp line, that if execvp succeeds, this will automatically close error_fds[0] (because it is FD_CLOEXEC), sending EOF (success) to the parent process.

I didn't actually realize until now that this whole approach depends on FD_CLOEXEC and couldn't work without it.

ryanofsky · 2026-08-11T19:08:51Z

+    (void)close(error_fds[1]);
+    if (error) {
+        (void)close(fds[1]);
+        throw std::system_error(error->err, std::system_category(), SpawnErrorName(error->which));


re: #312 (comment)

Make sense sense. IIUC if NOHANG approach was used it might appear to work but could still be racy and leave behind zombie processes.

ryanofsky · 2026-08-11T19:11:35Z

+        (void)close(fds[0]);
+        (void)close(fds[1]);


In commit "util: report back child error to parent and throw" (4a56c18)

Just noting since I didn't see it noted elsewhere that these two close calls fix a leak that would have happened previously if fork() failed.

d0eea62c58 ci: add Windows cross-compilation config using MinGW and Wine ae6cf017d4 test: Add TCP SocketListener and Windows compat to socketlistener.h 1938c199d7 util: make pthreads optional on Windows to enable MSVC builds 97011d4008 util: Fix Windows SpawnProcess hang when child exits before connecting to named pipe 7861351f24 util: Add Windows support ee09c2b269 util: Add Windows CommandLineFromArgv escaping function 860e2ffb5c util, test: guard Unix-only code for Windows build c79b49afe1 util, test: Replace UnixListener with SocketListener 15aa914f03 util, test: Add CloseSocket, use SocketId be5f87655a util: Improve SpawnProcess API and documentation 390b5f901f Merge bitcoin-core/libmultiprocess#344: test: listen_tests and connect_tests follow-ups e18ca520f4 Merge bitcoin-core/libmultiprocess#343: test: fix race in connect_tests disconnect-deferred-failure test c39c7850c6 doc: note construct() call in valid init interface test b9c36c6175 test: close sockets unconditionally and check errors with KJ_SYSCALL 7eb741e635 test: drop unnecessary KJ_EXPECT(true) 113f1d4d28 test: join server thread unconditionally in connect tests 44bc4630bc test: drop mp:: prefixes in connect tests 038d33eb31 test: share DefaultLogHandler between test files b54a163308 test: drop TestSetup socket members in connect tests 70467c5a72 test: add m_ prefix to TestSetup members in connect tests cc260f2526 test: replace capnp fix link with upstream PR 137a6e4e03 test: fix race in connect_tests disconnect-deferred-failure test 8dab0d4bde Merge bitcoin-core/libmultiprocess#341: ci: add -Wextra-semi to llvm config b3b134eed8 ci: add -Wextra-semi to llvm config bdd0cd6941 Merge bitcoin-core/libmultiprocess#339: refactor: add `[[noreturn]]` attributes a779a09764 ci: add -Wmissing-noreturn 636aaff576 refactor: add missing [[noreturn]] attributes cc11c2b1b4 Merge bitcoin-core/libmultiprocess#338: test: check ReadList return value 2d6e863c77 Merge bitcoin-core/libmultiprocess#334: ci: Set CMAKE_BUILD_PARALLEL_LEVEL to enable parallelism by default d4d10ff98a Merge bitcoin-core/libmultiprocess#332: ci: add -Wextra-semi to default config b540e70f25 Merge bitcoin-core/libmultiprocess#324: proxy: Name threads spawned by the event loop e5e367e785 Merge bitcoin-core/libmultiprocess#312: util: report back child errors to parent and throw 2220df68c9 Merge bitcoin-core/libmultiprocess#298: Fix error handling when creating clients (`mp::ConnectStream`) 51defb79ef Merge bitcoin-core/libmultiprocess#340: ci: Update `capnproto` prerequisites on NetBSD 7e94790b08 ci: Update `capnproto` prerequisites on NetBSD 9f25ffca5b test: Cover OS thread names for worker, pool, and async threads 648a18589c proxy: Name threads spawned by the event loop 49834b2609 ci: add -Wextra-semi to default config fae9a637e3 example: Remove unused kj/async.h include bb473690c9 Fix error handling when creating clients 44d191420c Add test coverage for ConnectStream 231361ae5a Correct stale UnixListener doc comment 060c1a50d0 Extract `UnixListener` class to a dedicated file 62f25af06c test: check ReadList return value ce51d73725 ci: Set CMAKE_BUILD_PARALLEL_LEVEL to enable parallism in build jobs by default 67302cd132 Merge bitcoin-core/libmultiprocess#331: Remove code for Cap'n Proto versions before 0.9 f13c64ab54 Merge bitcoin-core/libmultiprocess#330: ci: Compile with minimum supported g++ in olddeps 8e026f6625 Merge bitcoin-core/libmultiprocess#327: build: avoid unnecessary capnp-rpc dependency for mpgen e5206e9eb5 Merge bitcoin-core/libmultiprocess#325: cmake: Remove `QUIET` option from `find_package(CapnProto ...)` 879efea2bc Merge bitcoin-core/libmultiprocess#321: ci: Roll NetBSD releases to 11.0, drop 9.4 abf127a314 Merge bitcoin-core/libmultiprocess#317: ipc: Fix mpgen capnp tool path for vcpkg/Windows builds c437d7f107 Merge bitcoin-core/libmultiprocess#310: test: cover immediate client disconnects for `ListenConnections` 31bff8a673 Merge bitcoin-core/libmultiprocess#307: refactor: memcpy -> std::ranges::copy f355108b0a Merge bitcoin-core/libmultiprocess#303: type-chrono: Add CustomBuildField/CustomReadField overloads for std::chrono::time_point 2d678177c1 Merge bitcoin-core/libmultiprocess#296: ci: Bump channel to nixos-26.05 3f05b11624 util: kill and reap child on SpawnProcess error 4a56c1837a util: report back child error to parent and throw a9e70dbe77 ci: Add NetBSD release 11.0 2d33b14fb0 ci: Switch to default compiler on NetBSD 9.4 36f7400277 ci: Drop NetBSD release 9.4 bd508311b5 refactor: Drop stray semicolons after function definitions 788f17a850 Remove code for Cap'n Proto versions before 0.9 7402affd0c ci: Pin oldeps config to older nixpkgs channel to compile older cmake with older gcc edf6343562 ci: Compile with minimum supported g++-11 in olddeps fa47449afe cmake: avoid unnecessary capnp-rpc dependency for mpgen a494b764de cmake: Remove `QUIET` option from `find_package(CapnProto ...)` 26452e02d7 refactor: memcpy -> std::ranges::copy e1dcc6eb18 Merge bitcoin-core/libmultiprocess#316: cmake: Fix stale codegen when mpgen binary changes 7a72df02e2 type-chrono: Add CustomBuildField/CustomReadField overloads for std::chrono::time_point 45b685c3f5 type-number, type-chrono: Fix static assert signed/unsigned comparisons 45f6255975 type-number: exclude bool from the integral overload 8d6d464948 Merge bitcoin-core/libmultiprocess#315: Fix startup race in example a6fc80d254 Merge bitcoin-core/libmultiprocess#311: bugfix: clear FD_CLOEXEC in child instead of parent before fork 496fb84e69 test: cover immediate client disconnects for `ListenConnections` 36c6c63520 doc: Document reference-counted EventLoop lifetime 3a997e113c Fix startup race in mpexample f5c15ce33f Merge bitcoin-core/libmultiprocess#323: refactor: access ThreadContext through CurrentThread(), ci: switch Bitcoin Core to master 66298c737f ci: Switch back to Bitcoin Core's master branch 86b4810501 refactor: access ThreadContext through CurrentThread() eea9c64f6e cmake: Fix stale codegen when mpgen binary changes a26a08496b cmake: Fix mpgen capnp tool path for vcpkg/Windows builds 140d9ba6ff test: allow custom log handler in `ListenSetup` 1e0c7ff9a5 util: Clear FD_CLOEXEC in child instead of parent before fork 8550ee6a31 util, refactor: Add ChildFail helper for post-fork child errors 17eab90b52 test: Fix typo in listen_tests.cpp ce865a9ba8 refactor: Directly use value in CustomBuildField 3f221b5bfd Merge bitcoin-core/libmultiprocess#274: Add nonunix platform support 1b0f605606 doc: Remove trailing whitespace d8f8ca3119 ipc: Wrap mpgen main() in try-catch to print errors fbe5a14ad4 ci: Check out bitcoin/bitcoin PR #35084 instead of master 39d3690d83 types: Replace SFINAE with requires clauses to avoid MSVC C2039 error ba68520203 proxy, refactor: Fix C4305 truncation warning in Accessor on MSVC 1d81d47811 util, refactor: Fix PtrOrValue constructor for move-only types on MSVC b883fe1e52 proxy: Fix shutdownWrite() exception handling on macOS with dynamic libraries 0012411ccc proxy: Call shutdownWrite() in Connection destructor 38312ad191 proxy, refactor: Change ConnectStream and ServeStream to accept stream objects e96d5d742a proxy, refactor: Replace EventLoop wakeup fd integers with KJ stream objects db4f9a3d73 cmake: Bump minimum required Cap'n Proto version to 0.9 652934fb79 util, refactor: Add SocketPair() and use it in SpawnProcess 1c6ef7a26c util, refactor: Do not fork() and exec() separately 1389cf3132 util, refactor: Add SpawnConnectInfo type alias and use it c7ca1f00b6 util, refactor: Add SocketId type alias and use it be46a35203 util, refactor: Add ProcessId type alias and use it 91a78db780 doc: Bump version 13 > 14 fa2c56ec27 ci: Bump channel to nixos-26.05 git-subtree-dir: src/ipc/libmultiprocess git-subtree-split: d0eea62c58928f9660b8dc5541a62ea395c565ef

ryanofsky approved these changes Jul 20, 2026

View reviewed changes

Comment thread src/mp/util.cpp Outdated

DrahtBot mentioned this pull request Jul 21, 2026

Add windows support #231

Open

xyzconstant reviewed Jul 21, 2026

View reviewed changes

Comment thread src/mp/util.cpp

Comment thread src/mp/util.cpp

Comment thread src/mp/util.cpp

Comment thread src/mp/util.cpp Outdated

ViniciusCestarii force-pushed the report-spawn-exec-errors branch from dee4383 to d417706 Compare July 21, 2026 13:01

ViniciusCestarii changed the title ~~util: report back child execvp error to parent and throw~~ util: report back child errors to parent and throw Jul 21, 2026

DrahtBot mentioned this pull request Jul 21, 2026

bugfix: clear FD_CLOEXEC in child instead of parent before fork #311

Merged

ryanofsky approved these changes Jul 30, 2026

View reviewed changes

Comment thread src/mp/util.cpp Outdated

Comment thread src/mp/util.cpp Outdated

Comment thread src/mp/util.cpp Outdated

Comment thread src/mp/util.cpp

DrahtBot requested a review from xyzconstant July 30, 2026 12:44

ViniciusCestarii force-pushed the report-spawn-exec-errors branch from a761aca to eecda07 Compare July 30, 2026 15:02

ryanofsky approved these changes Aug 3, 2026

View reviewed changes

util: report back child error to parent and throw

4a56c18

ViniciusCestarii force-pushed the report-spawn-exec-errors branch from eecda07 to a20365c Compare August 3, 2026 19:58

util: kill and reap child on SpawnProcess error

3f05b11

ViniciusCestarii force-pushed the report-spawn-exec-errors branch from a20365c to 3f05b11 Compare August 3, 2026 20:01

DrahtBot requested a review from ryanofsky August 5, 2026 18:03

enirox001 reviewed Aug 6, 2026

View reviewed changes

ryanofsky approved these changes Aug 11, 2026

View reviewed changes

DrahtBot requested a review from enirox001 August 11, 2026 19:16

ryanofsky merged commit e5e367e into bitcoin-core:master Aug 11, 2026
13 checks passed

ryanofsky mentioned this pull request Aug 14, 2026

cmake: Increase cmake policy version #209

Open

Uh oh!

Conversation

ViniciusCestarii commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

DrahtBot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews

Conflicts

Uh oh!

ryanofsky left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ViniciusCestarii commented Jul 20, 2026

Uh oh!

xyzconstant left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Sjors commented Jul 21, 2026

Uh oh!

ViniciusCestarii commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ryanofsky left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ViniciusCestarii commented Jul 30, 2026

Uh oh!

ryanofsky left a comment

Choose a reason for hiding this comment

Uh oh!

ryanofsky Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

ViniciusCestarii Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ryanofsky Aug 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ViniciusCestarii commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

xyzconstant commented Aug 5, 2026

Uh oh!

enirox001 left a comment

Choose a reason for hiding this comment

Uh oh!

ryanofsky left a comment

Choose a reason for hiding this comment

Uh oh!

ryanofsky Aug 11, 2026

Choose a reason for hiding this comment

Uh oh!

ryanofsky Aug 11, 2026

Choose a reason for hiding this comment

Uh oh!

ryanofsky Aug 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

ViniciusCestarii commented Jul 20, 2026 •

edited

Loading

DrahtBot commented Jul 20, 2026 •

edited

Loading

ViniciusCestarii commented Jul 21, 2026 •

edited

Loading

ryanofsky left a comment •

edited

Loading

ViniciusCestarii Aug 3, 2026 •

edited

Loading

ViniciusCestarii commented Aug 3, 2026 •

edited

Loading