lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(libxce): bug-1600 -- makeGroup() freed rtti makeString() pointer via raw free()

Browse source 
makeGroup()'s existing-group update path (hit whenever a config-push
re-applies a group name that already has members, e.g. a retried config
push during controller failover) released xce_g_member_t.u.name via
FREEUP() (plain free()). u.name is allocated by makeString(), an
rtti-managed, refcounted pointer that is not a malloc()-base address --
freeing it directly corrupts the heap. group_killer() in the same file
already releases the identical field correctly via dereference().

Switch both FREEUP(m->u.name) call sites to dereference(m->u.name) to
match. Add a regression test that re-applies config for the same group
name twice, reproducing the exact ASAN bad-free at group.c:234 pre-fix.

This is the root cause of the reproducible xce_scheduler
"free(): invalid pointer" SIGABRT crashes seen during 3-attempt
controller-failover config-push retries (8 confirmed core dumps).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Rongsong Shen 2026-08-20 04:06:05 +00:00
parent 6522a73459
commit ddee884c1b
No known key found for this signature in database
GPG key ID: 5BCDAAE0123E9FE2
4 changed files with 62 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

16
.wolf/memory.md
View file

@ -2493,3 +2493,19 @@
| 20:00 | Edited src/scheduler/testsuite/test_repl_breakpoints_inspection.c | 1→2 lines | ~39 |
| 20:00 | Session end: 59 writes across 21 files (test_repl_breakpoints_inspection.c, test_sim_startup.c, test_sim_event_loop.c, meson.build, test_core_isolation.c) | 56 reads | ~622851 tok |
| 20:02 | Edited .kiro/steering/roadmap.md | 1→2 lines | ~394 |
| 20:03 | Session end: 60 writes across 21 files (test_repl_breakpoints_inspection.c, test_sim_startup.c, test_sim_event_loop.c, meson.build, test_core_isolation.c) | 56 reads | ~623792 tok |
| 20:21 | Session end: 60 writes across 21 files (test_repl_breakpoints_inspection.c, test_sim_startup.c, test_sim_event_loop.c, meson.build, test_core_isolation.c) | 56 reads | ~623792 tok |
| 20:26 | Session end: 60 writes across 21 files (test_repl_breakpoints_inspection.c, test_sim_startup.c, test_sim_event_loop.c, meson.build, test_core_isolation.c) | 57 reads | ~635646 tok |
| 20:29 | Session end: 60 writes across 21 files (test_repl_breakpoints_inspection.c, test_sim_startup.c, test_sim_event_loop.c, meson.build, test_core_isolation.c) | 59 reads | ~635646 tok |
| 20:37 | Session end: 60 writes across 21 files (test_repl_breakpoints_inspection.c, test_sim_startup.c, test_sim_event_loop.c, meson.build, test_core_isolation.c) | 60 reads | ~644876 tok |
## Session: 2026-08-20 20:42
| Time | Action | File(s) | Outcome | ~Tokens |
|------|--------|---------|---------|--------|
| 20:55 | Edited src/lib/testsuite/test_group.c | modified test_reconfigure_same_group_members() | ~370 |
| 20:55 | Session end: 1 writes across 1 files (test_group.c) | 19 reads | ~25243 tok |
| 20:57 | Session end: 1 writes across 1 files (test_group.c) | 19 reads | ~25243 tok |
| 21:01 | Edited src/lib/group.c | FREEUP() → dereference() | ~24 |
| 21:02 | Session end: 2 writes across 2 files (test_group.c, group.c) | 19 reads | ~25269 tok |
| 21:06 | Fixed production heap-corruption crash: makeGroup() FREEUP() vs dereference() allocator mismatch | src/lib/group.c, src/lib/testsuite/test_group.c | RED->GREEN confirmed via ASAN, logged bug-1600 | ~15000 |