diff --git a/.wolf/buglog.json b/.wolf/buglog.json index 41ac8558..5960e263 100644 --- a/.wolf/buglog.json +++ b/.wolf/buglog.json @@ -16747,6 +16747,34 @@ ], "fix_commits": [], "record": ".wolf/bugs/bug-1899.md" + }, + { + "id": "bug-1900", + "status": "fixed", + "status_updated": "2026-10-01", + "status_note": "", + "component": "controller", + "severity": "crash", + "timestamp": "2026-10-01T09:44:27Z", + "last_seen": "2026-10-01T09:44:27Z", + "occurrences": 1, + "error_message": "controller crashes on a jobsub with array_size 0: payload build overflows calloc\n\n**Observed:** found during task 2.1 of spec job-array-one-based-index, while capturing the RED phase. With the pre-fix `handle_jobsubmit`, a submission with `array_size == 0` passed the duplicate checks (an empty range never overlaps) and reached payload building, which crashed:\n```\n==ERROR: AddressSanitizer: calloc parameters overflow: count * size (-171944536 * 8)\n in build_job_submit_payloads ... handle_jobsubmit (src/controller/job.c)\n```\n**Expected:** a submission with element count 0 is rejected with an error and stores nothing (requirement 7.4 of job-array-one-based-index).\n**Impact:** crash: any client (or a corrupt/malicious request) sending `OPCode_jobsub` with `array_size = 0` brings down the controller's handler under ASAN; in a non-ASAN build the oversized calloc returns NULL or the request is left unanswered. The controller must never die on an operational input (ha-async-io.md).\n**Found by:** test (RED phase of task 2.1, test_jobsubmit_index0_size0_start0 / size-0 classification)", + "file": "src/controller/job.c", + "root_cause": "`handle_jobsubmit` had no check on the element count: an empty range passes `jobid_range_exists` and `inflight_range_try_add` (an empty range never overlaps), and payload building computes an allocation from `array_size - 1`-style arithmetic that underflows for 0, so calloc is asked for a huge count. Present since array submission was introduced (job-array-single-wal-record).", + "fix": "`jobsubmit_classify()` now runs first in `handle_jobsubmit` and classifies a size-0 submission as invalid (7.4), so it is answered `-EINVAL` before any registry, table or payload work.\n\nVerification:\n- Test: `test_jobsubmit_index0_size0_start0` and the size-0 rows of `test_jobsubmit_classify_table` / `test_jobsubmit_invalid_classes_einval` in `src/controller/testsuite/test_jobsubmit_validate.c`: RED (ASAN calloc overflow) before, GREEN after\n- Suites: controller ASAN suite 1263 tests 0 failures (build.jai), 2026-10-01\n- Live: n/a (input validation; unit-level reproduction is exact)", + "tags": [ + "controller", + "jobsubmit", + "job-array", + "asan" + ], + "related_bugs": [ + "bug-1896" + ], + "fix_commits": [ + "e6c484a0" + ], + "record": ".wolf/bugs/bug-1900.md" } ] } diff --git a/.wolf/bugs/bug-1900.md b/.wolf/bugs/bug-1900.md new file mode 100644 index 00000000..da261d65 --- /dev/null +++ b/.wolf/bugs/bug-1900.md @@ -0,0 +1,55 @@ +--- +id: "bug-1900" +status: "fixed" +status_updated: "2026-10-01" +status_note: "" +component: "controller" +severity: "crash" +timestamp: "2026-10-01T09:44:27Z" +last_seen: "2026-10-01T09:44:27Z" +occurrences: 1 +files: ["src/controller/job.c"] +tags: ["controller", "jobsubmit", "job-array", "asan"] +related: ["bug-1896"] +fix_commits: ["e6c484a0"] +--- + +# bug-1900: controller crashes on a jobsub with array_size 0: payload build overflows calloc + +## Description +**Observed:** found during task 2.1 of spec job-array-one-based-index, while capturing the RED phase. With the pre-fix `handle_jobsubmit`, a submission with `array_size == 0` passed the duplicate checks (an empty range never overlaps) and reached payload building, which crashed: +``` +==ERROR: AddressSanitizer: calloc parameters overflow: count * size (-171944536 * 8) + in build_job_submit_payloads ... handle_jobsubmit (src/controller/job.c) +``` +**Expected:** a submission with element count 0 is rejected with an error and stores nothing (requirement 7.4 of job-array-one-based-index). +**Impact:** crash: any client (or a corrupt/malicious request) sending `OPCode_jobsub` with `array_size = 0` brings down the controller's handler under ASAN; in a non-ASAN build the oversized calloc returns NULL or the request is left unanswered. The controller must never die on an operational input (ha-async-io.md). +**Found by:** test (RED phase of task 2.1, test_jobsubmit_index0_size0_start0 / size-0 classification) + +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (src/build.jai) +- Code: scheduler-framework @ ef728435 (pre-fix handler) +- Deployment: none (controller_unit_test; reachable from any client sending a jobsub) + +## Reproduction +1. On ef728435, in `src/controller/testsuite`, call `handle_jobsubmit` with an `xce_job_submit_t` whose `array_size` is 0 (as `test_jobsubmit_validate.c` does). +2. Run `controller_unit_test` from an ASAN build: AddressSanitizer reports `calloc parameters overflow`. +- Frequency: deterministic (1/1, 2026-10-01) +- Evidence: not kept (reproduced by the RED phase of task 2.1; the test now guards it) + +## Root cause +`handle_jobsubmit` had no check on the element count: an empty range passes `jobid_range_exists` and `inflight_range_try_add` (an empty range never overlaps), and payload building computes an allocation from `array_size - 1`-style arithmetic that underflows for 0, so calloc is asked for a huge count. Present since array submission was introduced (job-array-single-wal-record). + +## Fix +`jobsubmit_classify()` now runs first in `handle_jobsubmit` and classifies a size-0 submission as invalid (7.4), so it is answered `-EINVAL` before any registry, table or payload work. + +## Verification +- Test: `test_jobsubmit_index0_size0_start0` and the size-0 rows of `test_jobsubmit_classify_table` / `test_jobsubmit_invalid_classes_einval` in `src/controller/testsuite/test_jobsubmit_validate.c`: RED (ASAN calloc overflow) before, GREEN after +- Suites: controller ASAN suite 1263 tests 0 failures (build.jai), 2026-10-01 +- Live: n/a (input validation; unit-level reproduction is exact) + +## References +- Related: bug-1896 (found by its spec's task 2.1)