fix(fspy): keep execveat's resolved path alive across the exec, in the per-call arena

The arena's first user moves from the fd-relative path join to execveat,
for two reasons.

The join was the wrong showcase: the benchmark suite added for it showed
the arena costing ~3% on that lane, because the code it replaced is
nearly free — getcwd() already returns a buffer with room to append, so
PathBuf::push rarely allocates at all. That code comes back unchanged.

execveat is the right one. Its resolved absolute path must be copied
into fresh NUL-terminated storage, exec runs in the child of fork() in
multithreaded programs (posix_spawn does exactly that) where malloc can
deadlock on a lock held by a vanished thread — and the previous code had
a use-after-free: it built a CString, moved it into a match arm that
extracted the raw pointer, dropped it at the arm's end, and passed the
dangling pointer to the real exec. The arena copy is borrowed from a
binding that provably outlives the exec call, and dropping CString::new
also drops its interior-NUL panic path from an interception.

execveat currently has no test coverage — which is how the dangling
pointer survived. That gap is left for a follow-up.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: wan9chi

crates/fspy_preload_unix/src/client/convert.rs

@@ -1,7 +1,7 @@
 #[cfg(target_os = "linux")]
 use std::ffi::CString;
 use std::{
-    ffi::CStr,
+    ffi::{CStr, OsStr},
     os::{fd::RawFd, unix::ffi::OsStrExt as _},
     path::PathBuf,
 };
@@ -71,27 +71,13 @@ impl ToAbsolutePath for PathAt {
         if pathname.first().copied() == Some(b'/') {
             f(pathname.into())
         } else {
-            let Some(dir) = get_fd_path(self.0)? else {
+            let Some(mut abs_path) = get_fd_path(self.0)? else {
                 return f(None);
             };
-            // Join `dir` and the relative `pathname` in a per-call bump
-            // arena instead of `PathBuf::push` on the global allocator. This
-            // runs on every fd-relative open/stat, including inside signal
-            // handlers and fork children, where the global allocator's locks
-            // are unsafe to take. The joined path only lives for the `f`
-            // call — nothing escapes the arena.
-            let arena = sigsafe::alloc::arena();
-            let mut joined = allocator_api2::vec::Vec::new_in(&arena);
-            joined.extend_from_slice(dir.as_os_str().as_bytes());
             if !pathname.is_empty() {
-                // Mirror `PathBuf::push`: exactly one separator between the
-                // (absolute, non-empty) dir and the relative pathname.
-                if joined.last() != Some(&b'/') {
-                    joined.push(b'/');
-                }
-                joined.extend_from_slice(pathname);
+                abs_path.push(OsStr::from_bytes(pathname));
             }
-            f(Some(joined.as_bstr()))
+            f(Some(abs_path.as_os_str().as_bytes().as_bstr()))
         }
     }
 }

crates/fspy_preload_unix/src/interceptions/spawn/exec/mod.rs

@@ -1,8 +1,5 @@
 mod with_argv;
 
-#[cfg(target_os = "linux")]
-use std::ffi::CString;
-
 use fspy_shared_unix::exec::ExecResolveConfig;
 use libc::{c_char, c_int};
 use with_argv::with_argv;
@@ -195,21 +192,40 @@ mod linux_only {
             reason = "suppresses unused warning on *::original"
         )]
         let _unused = execveat::original;
+        // One bump arena for this intercepted call. The NUL-terminated copy
+        // of the resolved path made below must not go through libc malloc:
+        // programs exec from the child of `fork()` in multithreaded
+        // processes (posix_spawn does exactly that), where malloc's lock may
+        // be held by a thread that no longer exists.
+        let arena = sigsafe::alloc::arena();
         // SAFETY: PathAt wraps a valid dirfd and pathname pointer from the interposed execveat call
         let abs_path_result = unsafe {
             PathAt(dirfd, pathname).to_absolute_path(|path| {
                 let Some(path) = path else {
                     return Ok(None);
                 };
-                Ok(Some(CString::new(&**path).unwrap()))
+                // The resolved path plus a NUL terminator, allocated in the
+                // arena so it stays valid past this callback. Interior NULs
+                // cannot occur: the bytes come from NUL-terminated C strings
+                // and fd symlink targets.
+                let mut abs_path =
+                    allocator_api2::vec::Vec::with_capacity_in(path.len() + 1, &arena);
+                abs_path.extend_from_slice(path);
+                abs_path.push(0);
+                Ok(Some(abs_path))
             })
         };
         let abs_path = match abs_path_result {
             Ok(None) => {
                 // SAFETY: forwarding the original arguments to the real execveat syscall
                 return unsafe { execveat::original()(dirfd, pathname, argv, envp, flags) };
             }
-            Ok(Some(path)) => path.as_ptr(),
+            // Borrowed out of `abs_path_result`, which lives until the end
+            // of the function — past the `handle_exec` below that reads the
+            // pointer. (The previous version built a `CString`, moved it
+            // into this match arm, and dropped it here — `handle_exec` then
+            // read freed memory.)
+            Ok(Some(ref path)) => path.as_ptr().cast(),
             Err(errno) => {
                 errno.set();
                 return -1;