Harden actor deletion (and some other errors) #273
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Stebalien
commented
Jan 18, 2022
| act.sequence += 1; | ||
| Ok(()) | ||
| })?; | ||
| self.state_tree_mut().mutate_actor_id(sender_id, |act| { |
| .or_error(ExitCode::ErrIllegalArgument)?; | ||
| .or_illegal_argument()?; | ||
|
|
||
| if !is_account_actor(&act.code) { |
There was a problem hiding this comment.
Not directly related to deletion bug. But we would have previously returned a fatal error here if we attempted to "resolve" a non-account ID address.
| @@ -876,6 +900,9 @@ fn verify_seal(vi: &SealVerifyInfo) -> Result<bool> { | |||
| bytes_32(&vi.interactive_randomness.0), | |||
| &vi.proof, | |||
| ) | |||
| .or_fatal() | |||
| .context("failed to verify seal proof") // TODO: Verify that this is actually a fatal error. | |||
| .or_illegal_argument() | |||
| @@ -244,18 +245,17 @@ where | |||
| .into()); | |||
| } | |||
|
|
|||
| // TODO: make sure these are actually fatal. | |||
| let mut from_actor = self | |||
There was a problem hiding this comment.
We can hit this if the actor has been deleted.
fvm/src/machine/default.rs
Outdated
| .ok_or_else(|| anyhow!("receiver actor does not exist in state during transfer")) | ||
| .or_fatal()?; | ||
| .context("cannot transfer to non-existent receiver") | ||
| .ok_error(ExitCode::SysErrInvalidReceiver)?; |
There was a problem hiding this comment.
We probably shouldn't hit this, but it can't hurt.
| @@ -121,7 +121,7 @@ pub trait BlockOps { | |||
| /// Depends on BlockOps to read and write blocks in the state tree. | |||
| pub trait SelfOps: BlockOps { | |||
| /// Get the state root. | |||
| fn root(&self) -> Cid; | |||
| fn root(&self) -> Result<Cid>; | |||
There was a problem hiding this comment.
This needs to return an error if the actor no longer exists in the state-tree.
Stebalien
force-pushed
the
fix/kernel-errors
branch
from
a8c9e5e
to
1f98971
Compare
These cases should be unreachable in our current actors, but would not have been unreachable in user programmable actors. Fixes #185 by _not_ returning fatal errors if the current actor doesn't exist in state. After deletion: 1. Actors have "zero" balance. 2. Getting & setting the root fails with "illegal actor". 3. Sending still works, but sending with a value will fail because the balance is zero. 4. Sending _to_ this actor will fail. Effectively, I'm treating "deletion" as "unlinking" the actor in the state-tree. It still _exists_ until it returns, it just can't be looked-up or linked back into the state.
Stebalien
force-pushed
the
fix/kernel-errors
branch
from
1f98971
to
a7319ab
Compare
arajasek
reviewed
Jan 18, 2022
arajasek
approved these changes
Jan 19, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
These cases should be unreachable in our current actors, but would not have been unreachable in user programmable actors.
Fixes #185 by not returning fatal errors if the current actor doesn't exist in state.
After deletion:
Effectively, I'm treating "deletion" as "unlinking" the actor in the state-tree. It still exists until it returns, it just can't be looked-up or linked back into the state.
NOTE: the exact error codes will change with filecoin-project/fvm-specs#53.