diff --git a/.wolf/buglog.json b/.wolf/buglog.json index aafdf660..95143cc9 100644 --- a/.wolf/buglog.json +++ b/.wolf/buglog.json @@ -168,6 +168,30 @@ "76ddd75f" ], "record": ".wolf/bugs/bug-1976.md" + }, + { + "id": "bug-1977", + "status": "fixed", + "status_updated": "2026-10-28", + "status_note": "", + "component": "controller", + "severity": "crash", + "timestamp": "2026-10-28T11:56:58Z", + "last_seen": "2026-10-28T11:56:58Z", + "occurrences": 1, + "error_message": "crr_build_config callers' stack arrays smaller than builder -- ASAN stack overflow\n\n**Observed:**\n```\nERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc...\nWRITE of size 8 at 0x7ffc... thread T0\n #0 crr_build_config testsuite/test_config_resource_reconcile.c:126 (dists[3] = &d4)\n #1 test_reconcile_resources_registers_and_seeds_shared_pools testsuite/test_config_resource_reconcile.c:161\n```\nEvery test in the file that calls `crr_build_config` crashes the same way;\nthe full controller suite reports 137/137 FAIL (meson reports each fixture\ncrash as its own failure).\n\n**Expected:** all four callers pass arrays large enough for the builder's\nfixtures; the suite stays green.\n\n**Impact:** the whole controller testsuite was unrunnable under ASAN since the\nexternal-license-resources test fixtures landed (commit 2fcacac2) -- any\nregression in the suite was invisible behind the deterministic crash.\n\n**Found by:** ASAN -- full regression build for the license-resource feature\n(`src/tools/xce-build.sh controller`, profile=asan).", + "file": "src/controller/testsuite/test_config_resource_reconcile.c", + "root_cause": "`crr_build_config` (test_config_resource_reconcile.c:70) registers FIVE\nresources (lic1/hostres/dyn1/extlic/slots -> writes `resources[4]`) and FOUR\ndistributions (writes `dists[3]`) and FIVE vals (writes `vals[4]`). The four\ncaller test functions declared only\n`resources[4] / dists[3] / vals[4]`, so the builder's writes to index 4 / 3 /\n4 overflowed the callers' stack arrays. When the extlic E2 tests were added to\nthe builder's fixture set (2fcacac2), none of the caller declarations were\nresized. (Earlier builds of this branch compiled only a worker-focused subset\n-- `test_config_resource_reconcile` was not linked -- so the overflow went\nunnoticed until the full controller suite was built.)", + "fix": "Resize all four caller arrays to match the builder: `resources[5]`,\n`dists[4]`, `vals[5]`, each with a bug-1977 comment pointing at the sizing\ncontract. Files: src/controller/testsuite/test_config_resource_reconcile.c\n(test_reconcile_resources_registers_and_seeds_shared_pools,\ntest_reconcile_resources_registers_new_defs_past_eexist,\ntest_reconcile_resources_hot_applies_changed_definition,\ntest_reconcile_resources_is_idempotent_and_hot_applies).\n\nVerification:\n- Test: whole-file suite `controller - xce:controller test` (meson): RED\n 137/137 before the fix, GREEN after.\n- Suites: `src/tools/xce-build.sh controller` profile=asan: 6/6 OK\n (sched push, sched worker change, apiserver push, host runusage, no-fork\n rule, controller 91s).\n- Live: n/a (testsuite-only defect; no production code touched).", + "tags": [ + "testsuite", + "asan" + ], + "related_bugs": [], + "fix_commits": [ + "8c1995c2" + ], + "record": ".wolf/bugs/bug-1977.md" } ] } diff --git a/.wolf/bugs/bug-1977.md b/.wolf/bugs/bug-1977.md new file mode 100644 index 00000000..90d6d57a --- /dev/null +++ b/.wolf/bugs/bug-1977.md @@ -0,0 +1,85 @@ +--- +id: "bug-1977" +status: "fixed" +status_updated: "2026-10-28" +status_note: "" +component: "controller" +severity: "crash" +timestamp: "2026-10-28T11:56:58Z" +last_seen: "2026-10-28T11:56:58Z" +occurrences: 1 +files: ["src/controller/testsuite/test_config_resource_reconcile.c"] +tags: ["testsuite", "asan"] +related: [] +fix_commits: ["8c1995c2"] +--- + +# bug-1977: crr_build_config callers' stack arrays smaller than builder -- ASAN stack overflow + +## Description +**Observed:** +``` +ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffc... +WRITE of size 8 at 0x7ffc... thread T0 + #0 crr_build_config testsuite/test_config_resource_reconcile.c:126 (dists[3] = &d4) + #1 test_reconcile_resources_registers_and_seeds_shared_pools testsuite/test_config_resource_reconcile.c:161 +``` +Every test in the file that calls `crr_build_config` crashes the same way; +the full controller suite reports 137/137 FAIL (meson reports each fixture +crash as its own failure). + +**Expected:** all four callers pass arrays large enough for the builder's +fixtures; the suite stays green. + +**Impact:** the whole controller testsuite was unrunnable under ASAN since the +external-license-resources test fixtures landed (commit 2fcacac2) -- any +regression in the suite was invisible behind the deterministic crash. + +**Found by:** ASAN -- full regression build for the license-resource feature +(`src/tools/xce-build.sh controller`, profile=asan). + +## Environment +- OS: Ubuntu 24.04.2 LTS; kernel Linux 6.8.0-147-generic x86_64 +- libc: host ldd reports glibc 2.39 +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (xce.build) +- Code: feature/license-resources @ 30c51ea1-dirty (introduced by 2fcacac2) +- Deployment: n/a (unit testsuite only) + +## Reproduction +1. `src/tools/xce-build.sh controller` (asan profile) -- meson test crashes: + `controller - xce:controller test` FAIL with the stack-buffer-overflow above. +- Frequency: deterministic +- Evidence: src/testlogs.archive/xce.build/this-20261028-114408-rc1/meson-logs/testlog.txt (bug-1971 failure-preservation mechanism) + +## Root cause +`crr_build_config` (test_config_resource_reconcile.c:70) registers FIVE +resources (lic1/hostres/dyn1/extlic/slots -> writes `resources[4]`) and FOUR +distributions (writes `dists[3]`) and FIVE vals (writes `vals[4]`). The four +caller test functions declared only +`resources[4] / dists[3] / vals[4]`, so the builder's writes to index 4 / 3 / +4 overflowed the callers' stack arrays. When the extlic E2 tests were added to +the builder's fixture set (2fcacac2), none of the caller declarations were +resized. (Earlier builds of this branch compiled only a worker-focused subset +-- `test_config_resource_reconcile` was not linked -- so the overflow went +unnoticed until the full controller suite was built.) + +## Fix +Resize all four caller arrays to match the builder: `resources[5]`, +`dists[4]`, `vals[5]`, each with a bug-1977 comment pointing at the sizing +contract. Files: src/controller/testsuite/test_config_resource_reconcile.c +(test_reconcile_resources_registers_and_seeds_shared_pools, +test_reconcile_resources_registers_new_defs_past_eexist, +test_reconcile_resources_hot_applies_changed_definition, +test_reconcile_resources_is_idempotent_and_hot_applies). + +## Verification +- Test: whole-file suite `controller - xce:controller test` (meson): RED + 137/137 before the fix, GREEN after. +- Suites: `src/tools/xce-build.sh controller` profile=asan: 6/6 OK + (sched push, sched worker change, apiserver push, host runusage, no-fork + rule, controller 91s). +- Live: n/a (testsuite-only defect; no production code touched). + +## References +- Related: none diff --git a/src/controller/testsuite/test_config_resource_reconcile.c b/src/controller/testsuite/test_config_resource_reconcile.c index 8cc4dbac..fd747923 100644 --- a/src/controller/testsuite/test_config_resource_reconcile.c +++ b/src/controller/testsuite/test_config_resource_reconcile.c @@ -142,9 +142,13 @@ static void test_reconcile_resources_registers_and_seeds_shared_pools(void) cluster_t c; myconf_t conf; cluster_config_t cfg; - xce_resource_t* resources[4]; - res_distribution_t* dists[3]; - xce_val_t* vals[4]; + /* bug-1977: the builder registers FIVE resources (indices 0..4) and + * FOUR distributions (indices 0..3) -- the caller arrays must match, + * or the builder's resources[4]/dists[3]/vals[4] writes overflow these + * stacks (ASAN stack-buffer-overflow, deterministic). */ + xce_resource_t* resources[5]; + res_distribution_t* dists[4]; + xce_val_t* vals[5]; xce_resource_t* r; if (makeString((char*)"crr-probe") == NULL) @@ -230,9 +234,11 @@ static void test_reconcile_resources_registers_new_defs_past_eexist(void) cluster_t c; myconf_t conf; cluster_config_t cfg; - xce_resource_t* resources[4]; - res_distribution_t* dists[3]; - xce_val_t* vals[4]; + /* bug-1977: the builder writes resources[0..4]/dists[0..3]/vals[0..4] -- + * caller arrays must match its sizing. */ + xce_resource_t* resources[5]; + res_distribution_t* dists[4]; + xce_val_t* vals[5]; xce_resource_t* r; xce_val_t* v; @@ -304,9 +310,11 @@ static void test_reconcile_resources_hot_applies_changed_definition(void) cluster_t c; myconf_t conf; cluster_config_t cfg; - xce_resource_t* resources[4]; - res_distribution_t* dists[3]; - xce_val_t* vals[4]; + /* bug-1977: the builder writes resources[0..4]/dists[0..3]/vals[0..4] -- + * caller arrays must match its sizing. */ + xce_resource_t* resources[5]; + res_distribution_t* dists[4]; + xce_val_t* vals[5]; xce_resource_t* r; static xce_resource_t old_extlic; @@ -363,9 +371,11 @@ static void test_reconcile_resources_is_idempotent_and_hot_applies(void) cluster_t c; myconf_t conf; cluster_config_t cfg; - xce_resource_t* resources[4]; - res_distribution_t* dists[3]; - xce_val_t* vals[4]; + /* bug-1977: the builder writes resources[0..4]/dists[0..3]/vals[0..4] -- + * caller arrays must match its sizing. */ + xce_resource_t* resources[5]; + res_distribution_t* dists[4]; + xce_val_t* vals[5]; xce_resource_t* r; xce_val_t* v;