lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(testsuite): resize crr_build_config caller arrays -- bug-1977

Browse source 
The external-license-resources E2 fixture builder crr_build_config
registers five resources and four distributions, writing resources[4],
dists[3] and vals[4]. All four caller test functions declared only
resources[4]/dists[3]/vals[4], so every build_config call wrote past
the caller's stack arrays -- deterministic ASAN stack-buffer-overflow,
the whole controller suite (137 fixtures) red since 2fcacac2.

Resize the four caller arrays to match the builder's sizing
(resources[5]/dists[4]/vals[5]) with a bug-1977 comment on the sizing
contract. No production code touched.

Verified: src/tools/xce-build.sh controller (asan) 6/6 OK, controller
suite 91s green; buglog record .wolf/bugs/bug-1977.md.

Co-Authored-By: Claude Code <noreply@anthropic.com>
This commit is contained in:
lei.chen 2026-10-28 11:58:09 +00:00
parent 30c51ea147
commit b38ef6de63
3 changed files with 131 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

24
.wolf/buglog.json
View file

@ -168,6 +168,30 @@
"76ddd75f"
],
"record": ".wolf/bugs/bug-1976.md"
},
{
"id": "bug-1977",
"status": "fixed",
"status_updated": "2026-10-28",
"status_note": "",
"component": "controller",
"severity": "crash",
"timestamp": "2026-10-28T11:56:58Z",
"last_seen": "2026-10-28T11:56:58Z",
"occurrences": 1,
"error_message": "crr_build_config callers' stack arrays smaller than builder -- ASAN stack overflow\n\n**Observed:**\n```\nERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc...\nWRITE of size 8 at 0x7ffc... thread T0\n #0 crr_build_config testsuite/test_config_resource_reconcile.c:126 (dists[3] = &d4)\n #1 test_reconcile_resources_registers_and_seeds_shared_pools testsuite/test_config_resource_reconcile.c:161\n```\nEvery test in the file that calls `crr_build_config` crashes the same way;\nthe full controller suite reports 137/137 FAIL (meson reports each fixture\ncrash as its own failure).\n\n**Expected:** all four callers pass arrays large enough for the builder's\nfixtures; the suite stays green.\n\n**Impact:** the whole controller testsuite was unrunnable under ASAN since the\nexternal-license-resources test fixtures landed (commit 2fcacac2) -- any\nregression in the suite was invisible behind the deterministic crash.\n\n**Found by:** ASAN -- full regression build for the license-resource feature\n(`src/tools/xce-build.sh controller`, profile=asan).",
"file": "src/controller/testsuite/test_config_resource_reconcile.c",
"root_cause": "`crr_build_config` (test_config_resource_reconcile.c:70) registers FIVE\nresources (lic1/hostres/dyn1/extlic/slots -> writes `resources[4]`) and FOUR\ndistributions (writes `dists[3]`) and FIVE vals (writes `vals[4]`). The four\ncaller test functions declared only\n`resources[4] / dists[3] / vals[4]`, so the builder's writes to index 4 / 3 /\n4 overflowed the callers' stack arrays. When the extlic E2 tests were added to\nthe builder's fixture set (2fcacac2), none of the caller declarations were\nresized. (Earlier builds of this branch compiled only a worker-focused subset\n-- `test_config_resource_reconcile` was not linked -- so the overflow went\nunnoticed until the full controller suite was built.)",
"fix": "Resize all four caller arrays to match the builder: `resources[5]`,\n`dists[4]`, `vals[5]`, each with a bug-1977 comment pointing at the sizing\ncontract. Files: src/controller/testsuite/test_config_resource_reconcile.c\n(test_reconcile_resources_registers_and_seeds_shared_pools,\ntest_reconcile_resources_registers_new_defs_past_eexist,\ntest_reconcile_resources_hot_applies_changed_definition,\ntest_reconcile_resources_is_idempotent_and_hot_applies).\n\nVerification:\n- Test: whole-file suite `controller - xce:controller test` (meson): RED\n 137/137 before the fix, GREEN after.\n- Suites: `src/tools/xce-build.sh controller` profile=asan: 6/6 OK\n (sched push, sched worker change, apiserver push, host runusage, no-fork\n rule, controller 91s).\n- Live: n/a (testsuite-only defect; no production code touched).",
"tags": [
"testsuite",
"asan"
],
"related_bugs": [],
"fix_commits": [
"8c1995c2"
],
"record": ".wolf/bugs/bug-1977.md"
}
]
}

85
.wolf/bugs/bug-1977.md Normal file
View file

@ -0,0 +1,85 @@
---
id: "bug-1977"
status: "fixed"
status_updated: "2026-10-28"
status_note: ""
component: "controller"
severity: "crash"
timestamp: "2026-10-28T11:56:58Z"
last_seen: "2026-10-28T11:56:58Z"
occurrences: 1
files: ["src/controller/testsuite/test_config_resource_reconcile.c"]
tags: ["testsuite", "asan"]
related: []
fix_commits: ["8c1995c2"]
---
# bug-1977: crr_build_config callers' stack arrays smaller than builder -- ASAN stack overflow
## Description
**Observed:**
```
ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc...
WRITE of size 8 at 0x7ffc... thread T0
#0 crr_build_config testsuite/test_config_resource_reconcile.c:126 (dists[3] = &d4)
#1 test_reconcile_resources_registers_and_seeds_shared_pools testsuite/test_config_resource_reconcile.c:161
```
Every test in the file that calls `crr_build_config` crashes the same way;
the full controller suite reports 137/137 FAIL (meson reports each fixture
crash as its own failure).
**Expected:** all four callers pass arrays large enough for the builder's
fixtures; the suite stays green.
**Impact:** the whole controller testsuite was unrunnable under ASAN since the
external-license-resources test fixtures landed (commit 2fcacac2) -- any
regression in the suite was invisible behind the deterministic crash.
**Found by:** ASAN -- full regression build for the license-resource feature
(`src/tools/xce-build.sh controller`, profile=asan).
## Environment
- OS: Ubuntu 24.04.2 LTS; kernel Linux 6.8.0-147-generic x86_64
- libc: host ldd reports glibc 2.39
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
- Build: asan (xce.build)
- Code: feature/license-resources @ 30c51ea1-dirty (introduced by 2fcacac2)
- Deployment: n/a (unit testsuite only)
## Reproduction
1. `src/tools/xce-build.sh controller` (asan profile) -- meson test crashes:
`controller - xce:controller test` FAIL with the stack-buffer-overflow above.
- Frequency: deterministic
- Evidence: src/testlogs.archive/xce.build/this-20261028-114408-rc1/meson-logs/testlog.txt (bug-1971 failure-preservation mechanism)
## Root cause
`crr_build_config` (test_config_resource_reconcile.c:70) registers FIVE
resources (lic1/hostres/dyn1/extlic/slots -> writes `resources[4]`) and FOUR
distributions (writes `dists[3]`) and FIVE vals (writes `vals[4]`). The four
caller test functions declared only
`resources[4] / dists[3] / vals[4]`, so the builder's writes to index 4 / 3 /
4 overflowed the callers' stack arrays. When the extlic E2 tests were added to
the builder's fixture set (2fcacac2), none of the caller declarations were
resized. (Earlier builds of this branch compiled only a worker-focused subset
-- `test_config_resource_reconcile` was not linked -- so the overflow went
unnoticed until the full controller suite was built.)
## Fix
Resize all four caller arrays to match the builder: `resources[5]`,
`dists[4]`, `vals[5]`, each with a bug-1977 comment pointing at the sizing
contract. Files: src/controller/testsuite/test_config_resource_reconcile.c
(test_reconcile_resources_registers_and_seeds_shared_pools,
test_reconcile_resources_registers_new_defs_past_eexist,
test_reconcile_resources_hot_applies_changed_definition,
test_reconcile_resources_is_idempotent_and_hot_applies).
## Verification
- Test: whole-file suite `controller - xce:controller test` (meson): RED
137/137 before the fix, GREEN after.
- Suites: `src/tools/xce-build.sh controller` profile=asan: 6/6 OK
(sched push, sched worker change, apiserver push, host runusage, no-fork
rule, controller 91s).
- Live: n/a (testsuite-only defect; no production code touched).
## References
- Related: none

34
src/controller/testsuite/test_config_resource_reconcile.c
View file

@ -142,9 +142,13 @@ static void test_reconcile_resources_registers_and_seeds_shared_pools(void)
cluster_t c;
myconf_t conf;
cluster_config_t cfg;
xce_resource_t* resources[4];
res_distribution_t* dists[3];
xce_val_t* vals[4];
/* bug-1977: the builder registers FIVE resources (indices 0..4) and
* FOUR distributions (indices 0..3) -- the caller arrays must match,
* or the builder's resources[4]/dists[3]/vals[4] writes overflow these
* stacks (ASAN stack-buffer-overflow, deterministic). */
xce_resource_t* resources[5];
res_distribution_t* dists[4];
xce_val_t* vals[5];
xce_resource_t* r;
if (makeString((char*)"crr-probe") == NULL)
@ -230,9 +234,11 @@ static void test_reconcile_resources_registers_new_defs_past_eexist(void)
cluster_t c;
myconf_t conf;
cluster_config_t cfg;
xce_resource_t* resources[4];
res_distribution_t* dists[3];
xce_val_t* vals[4];
/* bug-1977: the builder writes resources[0..4]/dists[0..3]/vals[0..4] --
* caller arrays must match its sizing. */
xce_resource_t* resources[5];
res_distribution_t* dists[4];
xce_val_t* vals[5];
xce_resource_t* r;
xce_val_t* v;
@ -304,9 +310,11 @@ static void test_reconcile_resources_hot_applies_changed_definition(void)
cluster_t c;
myconf_t conf;
cluster_config_t cfg;
xce_resource_t* resources[4];
res_distribution_t* dists[3];
xce_val_t* vals[4];
/* bug-1977: the builder writes resources[0..4]/dists[0..3]/vals[0..4] --
* caller arrays must match its sizing. */
xce_resource_t* resources[5];
res_distribution_t* dists[4];
xce_val_t* vals[5];
xce_resource_t* r;
static xce_resource_t old_extlic;
@ -363,9 +371,11 @@ static void test_reconcile_resources_is_idempotent_and_hot_applies(void)
cluster_t c;
myconf_t conf;
cluster_config_t cfg;
xce_resource_t* resources[4];
res_distribution_t* dists[3];
xce_val_t* vals[4];
/* bug-1977: the builder writes resources[0..4]/dists[0..3]/vals[0..4] --
* caller arrays must match its sizing. */
xce_resource_t* resources[5];
res_distribution_t* dists[4];
xce_val_t* vals[5];
xce_resource_t* r;
xce_val_t* v;