chore(buglog): bug-1900 fixed (e6c484a0)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
parent
e6c484a0e7
commit
36c2c243d6
GPG key ID:
80533536B0EB651C
2 changed files with 83 additions and 0 deletions
|
|
@ -16747,6 +16747,34 @@
|
|||
],
|
||||
"fix_commits": [],
|
||||
"record": ".wolf/bugs/bug-1899.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1900",
|
||||
"status": "fixed",
|
||||
"status_updated": "2026-10-01",
|
||||
"status_note": "",
|
||||
"component": "controller",
|
||||
"severity": "crash",
|
||||
"timestamp": "2026-10-01T09:44:27Z",
|
||||
"last_seen": "2026-10-01T09:44:27Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "controller crashes on a jobsub with array_size 0: payload build overflows calloc\n\n**Observed:** found during task 2.1 of spec job-array-one-based-index, while capturing the RED phase. With the pre-fix `handle_jobsubmit`, a submission with `array_size == 0` passed the duplicate checks (an empty range never overlaps) and reached payload building, which crashed:\n```\n==ERROR: AddressSanitizer: calloc parameters overflow: count * size (-171944536 * 8)\n in build_job_submit_payloads ... handle_jobsubmit (src/controller/job.c)\n```\n**Expected:** a submission with element count 0 is rejected with an error and stores nothing (requirement 7.4 of job-array-one-based-index).\n**Impact:** crash: any client (or a corrupt/malicious request) sending `OPCode_jobsub` with `array_size = 0` brings down the controller's handler under ASAN; in a non-ASAN build the oversized calloc returns NULL or the request is left unanswered. The controller must never die on an operational input (ha-async-io.md).\n**Found by:** test (RED phase of task 2.1, test_jobsubmit_index0_size0_start0 / size-0 classification)",
|
||||
"file": "src/controller/job.c",
|
||||
"root_cause": "`handle_jobsubmit` had no check on the element count: an empty range passes `jobid_range_exists` and `inflight_range_try_add` (an empty range never overlaps), and payload building computes an allocation from `array_size - 1`-style arithmetic that underflows for 0, so calloc is asked for a huge count. Present since array submission was introduced (job-array-single-wal-record).",
|
||||
"fix": "`jobsubmit_classify()` now runs first in `handle_jobsubmit` and classifies a size-0 submission as invalid (7.4), so it is answered `-EINVAL` before any registry, table or payload work.\n\nVerification:\n- Test: `test_jobsubmit_index0_size0_start0` and the size-0 rows of `test_jobsubmit_classify_table` / `test_jobsubmit_invalid_classes_einval` in `src/controller/testsuite/test_jobsubmit_validate.c`: RED (ASAN calloc overflow) before, GREEN after\n- Suites: controller ASAN suite 1263 tests 0 failures (build.jai), 2026-10-01\n- Live: n/a (input validation; unit-level reproduction is exact)",
|
||||
"tags": [
|
||||
"controller",
|
||||
"jobsubmit",
|
||||
"job-array",
|
||||
"asan"
|
||||
],
|
||||
"related_bugs": [
|
||||
"bug-1896"
|
||||
],
|
||||
"fix_commits": [
|
||||
"e6c484a0"
|
||||
],
|
||||
"record": ".wolf/bugs/bug-1900.md"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
|
|||
55
.wolf/bugs/bug-1900.md
Normal file
55
.wolf/bugs/bug-1900.md
Normal file
|
|
@ -0,0 +1,55 @@
|
|||
---
|
||||
id: "bug-1900"
|
||||
status: "fixed"
|
||||
status_updated: "2026-10-01"
|
||||
status_note: ""
|
||||
component: "controller"
|
||||
severity: "crash"
|
||||
timestamp: "2026-10-01T09:44:27Z"
|
||||
last_seen: "2026-10-01T09:44:27Z"
|
||||
occurrences: 1
|
||||
files: ["src/controller/job.c"]
|
||||
tags: ["controller", "jobsubmit", "job-array", "asan"]
|
||||
related: ["bug-1896"]
|
||||
fix_commits: ["e6c484a0"]
|
||||
---
|
||||
|
||||
# bug-1900: controller crashes on a jobsub with array_size 0: payload build overflows calloc
|
||||
|
||||
## Description
|
||||
**Observed:** found during task 2.1 of spec job-array-one-based-index, while capturing the RED phase. With the pre-fix `handle_jobsubmit`, a submission with `array_size == 0` passed the duplicate checks (an empty range never overlaps) and reached payload building, which crashed:
|
||||
```
|
||||
==ERROR: AddressSanitizer: calloc parameters overflow: count * size (-171944536 * 8)
|
||||
in build_job_submit_payloads ... handle_jobsubmit (src/controller/job.c)
|
||||
```
|
||||
**Expected:** a submission with element count 0 is rejected with an error and stores nothing (requirement 7.4 of job-array-one-based-index).
|
||||
**Impact:** crash: any client (or a corrupt/malicious request) sending `OPCode_jobsub` with `array_size = 0` brings down the controller's handler under ASAN; in a non-ASAN build the oversized calloc returns NULL or the request is left unanswered. The controller must never die on an operational input (ha-async-io.md).
|
||||
**Found by:** test (RED phase of task 2.1, test_jobsubmit_index0_size0_start0 / size-0 classification)
|
||||
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (src/build.jai)
|
||||
- Code: scheduler-framework @ ef728435 (pre-fix handler)
|
||||
- Deployment: none (controller_unit_test; reachable from any client sending a jobsub)
|
||||
|
||||
## Reproduction
|
||||
1. On ef728435, in `src/controller/testsuite`, call `handle_jobsubmit` with an `xce_job_submit_t` whose `array_size` is 0 (as `test_jobsubmit_validate.c` does).
|
||||
2. Run `controller_unit_test` from an ASAN build: AddressSanitizer reports `calloc parameters overflow`.
|
||||
- Frequency: deterministic (1/1, 2026-10-01)
|
||||
- Evidence: not kept (reproduced by the RED phase of task 2.1; the test now guards it)
|
||||
|
||||
## Root cause
|
||||
`handle_jobsubmit` had no check on the element count: an empty range passes `jobid_range_exists` and `inflight_range_try_add` (an empty range never overlaps), and payload building computes an allocation from `array_size - 1`-style arithmetic that underflows for 0, so calloc is asked for a huge count. Present since array submission was introduced (job-array-single-wal-record).
|
||||
|
||||
## Fix
|
||||
`jobsubmit_classify()` now runs first in `handle_jobsubmit` and classifies a size-0 submission as invalid (7.4), so it is answered `-EINVAL` before any registry, table or payload work.
|
||||
|
||||
## Verification
|
||||
- Test: `test_jobsubmit_index0_size0_start0` and the size-0 rows of `test_jobsubmit_classify_table` / `test_jobsubmit_invalid_classes_einval` in `src/controller/testsuite/test_jobsubmit_validate.c`: RED (ASAN calloc overflow) before, GREEN after
|
||||
- Suites: controller ASAN suite 1263 tests 0 failures (build.jai), 2026-10-01
|
||||
- Live: n/a (input validation; unit-level reproduction is exact)
|
||||
|
||||
## References
|
||||
- Related: bug-1896 (found by its spec's task 2.1)
|
||||
Loading…
Add table
Add a link
Reference in a new issue