chore(buglog): bug-1901 fixed (4f44a689)
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
parent
4f44a68973
commit
c60946c097
GPG key ID:
80533536B0EB651C
2 changed files with 85 additions and 0 deletions
|
|
@ -16775,6 +16775,35 @@
|
|||
"e6c484a0"
|
||||
],
|
||||
"record": ".wolf/bugs/bug-1900.md"
|
||||
},
|
||||
{
|
||||
"id": "bug-1901",
|
||||
"status": "fixed",
|
||||
"status_updated": "2026-10-01",
|
||||
"status_note": "",
|
||||
"component": "scheduler",
|
||||
"severity": "crash",
|
||||
"timestamp": "2026-10-01T10:24:43Z",
|
||||
"last_seen": "2026-10-01T10:24:43Z",
|
||||
"occurrences": 1,
|
||||
"error_message": "scheduler crashes on an array push whose size overflows: expansion calloc overflow\n\n**Observed:** found during task 3.1 of spec job-array-one-based-index (RED phase). The pre-fix `translate_one_pending_update` (`XCE_SCHED_OP_UPDATE_JOB_ARRAY`) expanded any array push without checking it, allocating one slot per element:\n```\nERROR: AddressSanitizer: calloc parameters overflow: count * size (-1 * 8)\nSUMMARY: AddressSanitizer: calloc-overflow ../src/driver.c:469 in translate_one_pending_update\n```\nfor `array_size = UINT64_MAX`; an untagged first ID or a size running past the 32768-element block was also expanded.\n**Expected:** a malformed array push (untagged, or size beyond the block) is logged and not expanded; the scheduler never crashes on it.\n**Impact:** crash: a malformed or corrupted array push from the controller brings down the scheduler's driver thread (ASAN), or allocates/expands nonsense element IDs that spill into other arrays' blocks.\n**Found by:** test (RED phase of task 3.1, `test_translate_job_array_max_u64_size_not_expanded`)",
|
||||
"file": "src/scheduler/src/driver.c",
|
||||
"root_cause": "The array-push translation trusted the descriptor: no check that the first ID carries the array tag or that `first + size - 1` stays inside the 32768-element block, so `calloc(array_size, ...)` was called with an arbitrary 64-bit count. The controller never sends such a push today, so it is only reachable through a corrupted or foreign push.",
|
||||
"fix": "`translate_one_pending_update` now expands only when `is_array_tag(first)` and `array_size <= 32768 - array_idx(first)` (no addition, so no wrap), checked before the allocation; otherwise it logs an ERROR naming the array identity and expands nothing.\n\nVerification:\n- Test: `test_translate_job_array_max_u64_size_not_expanded`, `..._untagged_first_not_expanded`, `..._overflowing_block_not_expanded` in `src/scheduler/testsuite/test_driver_translate.c`: RED (ASAN calloc overflow / wrong expansion) before, GREEN after\n- Suites: scheduler ASAN suite 97/97 (build.jai), 2026-10-01\n- Live: n/a (defensive input validation; unit reproduction is exact)",
|
||||
"tags": [
|
||||
"scheduler",
|
||||
"driver",
|
||||
"job-array",
|
||||
"asan"
|
||||
],
|
||||
"related_bugs": [
|
||||
"bug-1900",
|
||||
"bug-1896"
|
||||
],
|
||||
"fix_commits": [
|
||||
"4f44a689"
|
||||
],
|
||||
"record": ".wolf/bugs/bug-1901.md"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
|
|||
56
.wolf/bugs/bug-1901.md
Normal file
56
.wolf/bugs/bug-1901.md
Normal file
|
|
@ -0,0 +1,56 @@
|
|||
---
|
||||
id: "bug-1901"
|
||||
status: "fixed"
|
||||
status_updated: "2026-10-01"
|
||||
status_note: ""
|
||||
component: "scheduler"
|
||||
severity: "crash"
|
||||
timestamp: "2026-10-01T10:24:43Z"
|
||||
last_seen: "2026-10-01T10:24:43Z"
|
||||
occurrences: 1
|
||||
files: ["src/scheduler/src/driver.c"]
|
||||
tags: ["scheduler", "driver", "job-array", "asan"]
|
||||
related: ["bug-1900", "bug-1896"]
|
||||
fix_commits: ["4f44a689"]
|
||||
---
|
||||
|
||||
# bug-1901: scheduler crashes on an array push whose size overflows: expansion calloc overflow
|
||||
|
||||
## Description
|
||||
**Observed:** found during task 3.1 of spec job-array-one-based-index (RED phase). The pre-fix `translate_one_pending_update` (`XCE_SCHED_OP_UPDATE_JOB_ARRAY`) expanded any array push without checking it, allocating one slot per element:
|
||||
```
|
||||
ERROR: AddressSanitizer: calloc parameters overflow: count * size (-1 * 8)
|
||||
SUMMARY: AddressSanitizer: calloc-overflow ../src/driver.c:469 in translate_one_pending_update
|
||||
```
|
||||
for `array_size = UINT64_MAX`; an untagged first ID or a size running past the 32768-element block was also expanded.
|
||||
**Expected:** a malformed array push (untagged, or size beyond the block) is logged and not expanded; the scheduler never crashes on it.
|
||||
**Impact:** crash: a malformed or corrupted array push from the controller brings down the scheduler's driver thread (ASAN), or allocates/expands nonsense element IDs that spill into other arrays' blocks.
|
||||
**Found by:** test (RED phase of task 3.1, `test_translate_job_array_max_u64_size_not_expanded`)
|
||||
|
||||
## Environment
|
||||
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
||||
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
||||
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
||||
- Build: asan (src/build.jai)
|
||||
- Code: scheduler-framework @ fe5ddc98 (pre-fix driver)
|
||||
- Deployment: none (sched_driver_translate_test; reachable from any array push)
|
||||
|
||||
## Reproduction
|
||||
1. On fe5ddc98, feed `translate_one_pending_update` an `XCE_SCHED_OP_UPDATE_JOB_ARRAY` request whose descriptor has `array_size = UINT64_MAX` (as `test_driver_translate.c` now does).
|
||||
2. Run `sched_driver_translate_test` from an ASAN build: `calloc-overflow` at `driver.c:469`.
|
||||
- Frequency: deterministic (1/1, 2026-10-01)
|
||||
- Evidence: not kept (the new test guards it)
|
||||
|
||||
## Root cause
|
||||
The array-push translation trusted the descriptor: no check that the first ID carries the array tag or that `first + size - 1` stays inside the 32768-element block, so `calloc(array_size, ...)` was called with an arbitrary 64-bit count. The controller never sends such a push today, so it is only reachable through a corrupted or foreign push.
|
||||
|
||||
## Fix
|
||||
`translate_one_pending_update` now expands only when `is_array_tag(first)` and `array_size <= 32768 - array_idx(first)` (no addition, so no wrap), checked before the allocation; otherwise it logs an ERROR naming the array identity and expands nothing.
|
||||
|
||||
## Verification
|
||||
- Test: `test_translate_job_array_max_u64_size_not_expanded`, `..._untagged_first_not_expanded`, `..._overflowing_block_not_expanded` in `src/scheduler/testsuite/test_driver_translate.c`: RED (ASAN calloc overflow / wrong expansion) before, GREEN after
|
||||
- Suites: scheduler ASAN suite 97/97 (build.jai), 2026-10-01
|
||||
- Live: n/a (defensive input validation; unit reproduction is exact)
|
||||
|
||||
## References
|
||||
- Related: bug-1900 (same class in the controller), bug-1896 (found by its spec's task 3.1)
|
||||
Loading…
Add table
Add a link
Reference in a new issue