lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(buglog): bug-1901 fixed (4f44a689)

Browse source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Rongsong Shen 2026-10-01 10:24:45 +00:00
parent 4f44a68973
commit c60946c097
Signed by untrusted user: rshen
GPG key ID: 80533536B0EB651C
2 changed files with 85 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

29
.wolf/buglog.json
View file

@ -16775,6 +16775,35 @@
"e6c484a0"
],
"record": ".wolf/bugs/bug-1900.md"
},
{
"id": "bug-1901",
"status": "fixed",
"status_updated": "2026-10-01",
"status_note": "",
"component": "scheduler",
"severity": "crash",
"timestamp": "2026-10-01T10:24:43Z",
"last_seen": "2026-10-01T10:24:43Z",
"occurrences": 1,
"error_message": "scheduler crashes on an array push whose size overflows: expansion calloc overflow\n\n**Observed:** found during task 3.1 of spec job-array-one-based-index (RED phase). The pre-fix `translate_one_pending_update` (`XCE_SCHED_OP_UPDATE_JOB_ARRAY`) expanded any array push without checking it, allocating one slot per element:\n```\nERROR: AddressSanitizer: calloc parameters overflow: count * size (-1 * 8)\nSUMMARY: AddressSanitizer: calloc-overflow ../src/driver.c:469 in translate_one_pending_update\n```\nfor `array_size = UINT64_MAX`; an untagged first ID or a size running past the 32768-element block was also expanded.\n**Expected:** a malformed array push (untagged, or size beyond the block) is logged and not expanded; the scheduler never crashes on it.\n**Impact:** crash: a malformed or corrupted array push from the controller brings down the scheduler's driver thread (ASAN), or allocates/expands nonsense element IDs that spill into other arrays' blocks.\n**Found by:** test (RED phase of task 3.1, `test_translate_job_array_max_u64_size_not_expanded`)",
"file": "src/scheduler/src/driver.c",
"root_cause": "The array-push translation trusted the descriptor: no check that the first ID carries the array tag or that `first + size - 1` stays inside the 32768-element block, so `calloc(array_size, ...)` was called with an arbitrary 64-bit count. The controller never sends such a push today, so it is only reachable through a corrupted or foreign push.",
"fix": "`translate_one_pending_update` now expands only when `is_array_tag(first)` and `array_size <= 32768 - array_idx(first)` (no addition, so no wrap), checked before the allocation; otherwise it logs an ERROR naming the array identity and expands nothing.\n\nVerification:\n- Test: `test_translate_job_array_max_u64_size_not_expanded`, `..._untagged_first_not_expanded`, `..._overflowing_block_not_expanded` in `src/scheduler/testsuite/test_driver_translate.c`: RED (ASAN calloc overflow / wrong expansion) before, GREEN after\n- Suites: scheduler ASAN suite 97/97 (build.jai), 2026-10-01\n- Live: n/a (defensive input validation; unit reproduction is exact)",
"tags": [
"scheduler",
"driver",
"job-array",
"asan"
],
"related_bugs": [
"bug-1900",
"bug-1896"
],
"fix_commits": [
"4f44a689"
],
"record": ".wolf/bugs/bug-1901.md"
}
]
}