diff --git a/.wolf/buglog.json b/.wolf/buglog.json index 5960e263..92292027 100644 --- a/.wolf/buglog.json +++ b/.wolf/buglog.json @@ -16775,6 +16775,35 @@ "e6c484a0" ], "record": ".wolf/bugs/bug-1900.md" + }, + { + "id": "bug-1901", + "status": "fixed", + "status_updated": "2026-10-01", + "status_note": "", + "component": "scheduler", + "severity": "crash", + "timestamp": "2026-10-01T10:24:43Z", + "last_seen": "2026-10-01T10:24:43Z", + "occurrences": 1, + "error_message": "scheduler crashes on an array push whose size overflows: expansion calloc overflow\n\n**Observed:** found during task 3.1 of spec job-array-one-based-index (RED phase). The pre-fix `translate_one_pending_update` (`XCE_SCHED_OP_UPDATE_JOB_ARRAY`) expanded any array push without checking it, allocating one slot per element:\n```\nERROR: AddressSanitizer: calloc parameters overflow: count * size (-1 * 8)\nSUMMARY: AddressSanitizer: calloc-overflow ../src/driver.c:469 in translate_one_pending_update\n```\nfor `array_size = UINT64_MAX`; an untagged first ID or a size running past the 32768-element block was also expanded.\n**Expected:** a malformed array push (untagged, or size beyond the block) is logged and not expanded; the scheduler never crashes on it.\n**Impact:** crash: a malformed or corrupted array push from the controller brings down the scheduler's driver thread (ASAN), or allocates/expands nonsense element IDs that spill into other arrays' blocks.\n**Found by:** test (RED phase of task 3.1, `test_translate_job_array_max_u64_size_not_expanded`)", + "file": "src/scheduler/src/driver.c", + "root_cause": "The array-push translation trusted the descriptor: no check that the first ID carries the array tag or that `first + size - 1` stays inside the 32768-element block, so `calloc(array_size, ...)` was called with an arbitrary 64-bit count. The controller never sends such a push today, so it is only reachable through a corrupted or foreign push.", + "fix": "`translate_one_pending_update` now expands only when `is_array_tag(first)` and `array_size <= 32768 - array_idx(first)` (no addition, so no wrap), checked before the allocation; otherwise it logs an ERROR naming the array identity and expands nothing.\n\nVerification:\n- Test: `test_translate_job_array_max_u64_size_not_expanded`, `..._untagged_first_not_expanded`, `..._overflowing_block_not_expanded` in `src/scheduler/testsuite/test_driver_translate.c`: RED (ASAN calloc overflow / wrong expansion) before, GREEN after\n- Suites: scheduler ASAN suite 97/97 (build.jai), 2026-10-01\n- Live: n/a (defensive input validation; unit reproduction is exact)", + "tags": [ + "scheduler", + "driver", + "job-array", + "asan" + ], + "related_bugs": [ + "bug-1900", + "bug-1896" + ], + "fix_commits": [ + "4f44a689" + ], + "record": ".wolf/bugs/bug-1901.md" } ] } diff --git a/.wolf/bugs/bug-1901.md b/.wolf/bugs/bug-1901.md new file mode 100644 index 00000000..caf7526b --- /dev/null +++ b/.wolf/bugs/bug-1901.md @@ -0,0 +1,56 @@ +--- +id: "bug-1901" +status: "fixed" +status_updated: "2026-10-01" +status_note: "" +component: "scheduler" +severity: "crash" +timestamp: "2026-10-01T10:24:43Z" +last_seen: "2026-10-01T10:24:43Z" +occurrences: 1 +files: ["src/scheduler/src/driver.c"] +tags: ["scheduler", "driver", "job-array", "asan"] +related: ["bug-1900", "bug-1896"] +fix_commits: ["4f44a689"] +--- + +# bug-1901: scheduler crashes on an array push whose size overflows: expansion calloc overflow + +## Description +**Observed:** found during task 3.1 of spec job-array-one-based-index (RED phase). The pre-fix `translate_one_pending_update` (`XCE_SCHED_OP_UPDATE_JOB_ARRAY`) expanded any array push without checking it, allocating one slot per element: +``` +ERROR: AddressSanitizer: calloc parameters overflow: count * size (-1 * 8) +SUMMARY: AddressSanitizer: calloc-overflow ../src/driver.c:469 in translate_one_pending_update +``` +for `array_size = UINT64_MAX`; an untagged first ID or a size running past the 32768-element block was also expanded. +**Expected:** a malformed array push (untagged, or size beyond the block) is logged and not expanded; the scheduler never crashes on it. +**Impact:** crash: a malformed or corrupted array push from the controller brings down the scheduler's driver thread (ASAN), or allocates/expands nonsense element IDs that spill into other arrays' blocks. +**Found by:** test (RED phase of task 3.1, `test_translate_job_array_max_u64_size_not_expanded`) + +## Environment +- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64 +- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2) +- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1 +- Build: asan (src/build.jai) +- Code: scheduler-framework @ fe5ddc98 (pre-fix driver) +- Deployment: none (sched_driver_translate_test; reachable from any array push) + +## Reproduction +1. On fe5ddc98, feed `translate_one_pending_update` an `XCE_SCHED_OP_UPDATE_JOB_ARRAY` request whose descriptor has `array_size = UINT64_MAX` (as `test_driver_translate.c` now does). +2. Run `sched_driver_translate_test` from an ASAN build: `calloc-overflow` at `driver.c:469`. +- Frequency: deterministic (1/1, 2026-10-01) +- Evidence: not kept (the new test guards it) + +## Root cause +The array-push translation trusted the descriptor: no check that the first ID carries the array tag or that `first + size - 1` stays inside the 32768-element block, so `calloc(array_size, ...)` was called with an arbitrary 64-bit count. The controller never sends such a push today, so it is only reachable through a corrupted or foreign push. + +## Fix +`translate_one_pending_update` now expands only when `is_array_tag(first)` and `array_size <= 32768 - array_idx(first)` (no addition, so no wrap), checked before the allocation; otherwise it logs an ERROR naming the array identity and expands nothing. + +## Verification +- Test: `test_translate_job_array_max_u64_size_not_expanded`, `..._untagged_first_not_expanded`, `..._overflowing_block_not_expanded` in `src/scheduler/testsuite/test_driver_translate.c`: RED (ASAN calloc overflow / wrong expansion) before, GREEN after +- Suites: scheduler ASAN suite 97/97 (build.jai), 2026-10-01 +- Live: n/a (defensive input validation; unit reproduction is exact) + +## References +- Related: bug-1900 (same class in the controller), bug-1896 (found by its spec's task 3.1)