lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(libxce): bug-1077 ctrlstatus crash from shared reply-union type confusion

Browse source 
ctx->reply.u is a single untagged union shared across opcodes (debugmsg /
get(dataset_t*) / jobid / clusterconf / ctrlstatus alias the same 8 bytes).
Commit 61e1391 added speculative free-guards
`if (ctx->reply.u.ctrlstatus) free_CtrlStatus_ptr(...)` (and the clusterconf
twin). A non-NULL slot does NOT imply a CtrlStatus*: a failover-aborted
reslist/joblist leaves ctx->reply.u.get == &getreply (a dead STACK pointer)
because xce_get_with_condition/xce_resval only cleared the slot on the success
path, not the xce_get_req<0 / cbuf_get<0 early returns. The next ctrlstatus
reply (worker thread) freed that foreign pointer as a CtrlStatus -> ASan
SEGV / stack-use-after-return in free_CtrlStatus (controller.capnp.c:11638).

Fix (root cause, both layers):
- Revert the unsafe free-guards in xce_handle_reply: MOVE_PTR overwrite only,
  never free/deref an untagged union slot by type.
- Clear ctx->reply.u.get = NULL on ALL exit paths of xce_get_with_condition
  and xce_resval via a single `goto done` cleanup (forget-proof; the bug was
  one forgotten failover path). Also drops the now-unused controller.capnp.h.
- Defense-in-depth: handle_get_reply drops a reply when the slot is NULL.

Regression: expose xce_handle_reply and add
test_handle_reply_ctrlstatus_does_not_free_foreign_slot, which poisons the
shared slot with a foreign heap value and proves the ctrlstatus reply handler
does not free it (RED reproduced the exact free_CtrlStatus_ptr double-free;
GREEN after fix). xcelib_test 244/0, controller_unit_test 166/0, all binaries
build clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MSxwb2Xt5F84ATgiAZnH8V
This commit is contained in:
Rongsong Shen 2026-06-24 09:44:43 +00:00
parent 61e1391cd0
commit 8da8fd03dd
7 changed files with 943 additions and 767 deletions
Download patch file Download diff file Expand all files Collapse all files

26
.wolf/memory.md
View file

@ -2797,3 +2797,29 @@
| Time | Action | File(s) | Outcome | ~Tokens |
|------|--------|---------|---------|--------|
| 02:18 | Edited src/lib/xcectx.c | modified xce_handle_reply() | ~77 |
| 02:18 | Edited src/lib/xcectx.c | inline fix | ~18 |
| 02:19 | Edited src/include/xcectx.h | expanded (+6 lines) | ~111 |
| 02:19 | Edited src/lib/testsuite/test_ctrlstatus.c | modified test_handle_reply_ctrlstatus_does_not_free_foreign_slot() | ~727 |
| 02:19 | Edited src/lib/testsuite/test_ctrlstatus.c | 4→5 lines | ~50 |
| 02:22 | Edited src/lib/xcectx.c | modified if() | ~333 |
| 02:23 | Edited src/lib/xcectx.c | added 1 condition(s) | ~149 |
| 02:23 | Edited src/lib/xceapi.c | modified if() | ~214 |
| 02:23 | Edited src/lib/xceapi.c | modified if() | ~150 |
## Session 2026-06-24 (bug-1077 — ctrlstatus ASan crash) — summary
| HH:MM | description | file(s) | outcome | ~tokens |
| 17:30 | Root-caused ASan SEGV/use-after-return in free_CtrlStatus via handle_reply on `ctrlstatus` after failover | src/lib/xcectx.c, xceapi.c | union type-confusion: ctx->reply.u shared/untagged; free-guards added in 61e1391 freed a foreign (dead-stack) value | ~4k |
| 17:35 | Logged bug-1077 to buglog | .wolf/buglog.json | appended | ~1k |
| 17:45 | TDD: exposed xce_handle_reply, wrote deterministic regression test (foreign slot must not be freed) | src/lib/testsuite/test_ctrlstatus.c, include/xcectx.h | RED reproduced (ASan double-free, same free_CtrlStatus_ptr path) | ~3k |
| 17:55 | Fix: reverted unsafe free-guards (clusterconf+ctrlstatus) + clear ctx->reply.u.get on ALL exits of xce_get_with_condition/xce_resval + NULL-guard handle_get_reply | src/lib/xcectx.c, xceapi.c | GREEN: xcelib_test 244/0, controller_unit_test 166/0; all binaries build clean | ~3k |
| 02:27 | Created ../../../../../claude/.claude/projects/-home-rshen-projects-xce-xce/memory/project_bug1077_reply_union_type_confusion.md | — | ~474 |
| 02:27 | Edited ../../../../../claude/.claude/projects/-home-rshen-projects-xce-xce/memory/project_bug1077_reply_union_type_confusion.md | inline fix | ~17 |
| 02:28 | Session end: 11 writes across 5 files (xcectx.c, xcectx.h, test_ctrlstatus.c, xceapi.c, project_bug1077_reply_union_type_confusion.md) | 7 reads | ~13701 tok |
| 17:32 | Edited src/lib/xcectx.c | 3→4 lines | ~32 |
| 17:32 | Edited src/lib/xcectx.c | dereferenced() → free_CtrlStatus_ptr() | ~89 |
| 17:36 | VERIFIED bug-1077 (libxce reply-union type confusion): confirmed 3-layer fix in tree (revert free-guards + NULL slot on every consumer early-return + handle_get_reply NULL-check); RED→GREEN proven by re-injecting free-guard → ASan double-free at test_ctrlstatus.c:384, restored → GREEN; full libxce suite 291/0, 0 ASan errors | src/lib/xcectx.c, xceapi.c, testsuite/test_ctrlstatus.c | VERIFIED PASS | ~60 |
| 17:36 | Session end: 13 writes across 5 files (xcectx.c, xcectx.h, test_ctrlstatus.c, xceapi.c, project_bug1077_reply_union_type_confusion.md) | 7 reads | ~13942 tok |
| 02:40 | Edited src/controller/config_repl.c | expanded (+16 lines) | ~346 |
| 18:10 | Added NOTICE at config-upgrade restart site: upgrade must snapshot current state (entity-bearing) at config-marker (term,lsn) boundary + install on all members, not per-node WAL re-derive (bug-857) | src/controller/config_repl.c (step 9, do_upgrade_config_with_bytes) | comment-only; refs config-upgrade-snapshot spec + entity-bearing-snapshots hard dep | ~1k |
| 02:41 | Session end: 14 writes across 6 files (xcectx.c, xcectx.h, test_ctrlstatus.c, xceapi.c, project_bug1077_reply_union_type_confusion.md) | 8 reads | ~39719 tok |