lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(apiserver): don't free client config C-strings that the C library retains (bug-1501)

Browse source 
tryConnect built the xce_client_config_t with C.CString(host/from/key), then a
defer freed all three. But xcecli_ctx_init stores the config POINTER
(ctx->conf = config), not a copy — client_failover.c dereferences
config->masters/from/key for the client's ENTIRE lifetime (e.g.
xce_failover_next_target strncpy's a master host on every write-fail/redirect).
Freeing the strings left config->masters[0] dangling → ASAN heap-use-after-free
(strncpy in the background C thread) after a few submits.

Fix: keep the three C strings for the process lifetime (tryConnect runs once at
startup, gCtx is a process-global); free them only on the init-failure path.

Verified: 6 consecutive job submits, apiserver stays up, 0 ASAN errors
(previously crashed after ~2-3 submits).

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
lei.chen 2026-08-04 08:59:06 +00:00
parent 5b47ee603f
commit ff2d784ca9
2 changed files with 33 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

18
.wolf/buglog.json
View file

@ -14738,5 +14738,23 @@
"related_bugs": [],
"occurrences": 3,
"last_seen": "2026-08-04"
},
{
"id": "bug-1501",
"timestamp": "2026-08-04",
"error_message": "apiserver ASAN heap-use-after-free: strncpy (\u540e\u53f0 C \u7ebf\u7a0b, xce_failover_next_target) \u8bfb\u53d6\u4e3b\u7ebf\u7a0b\u5df2\u91ca\u653e\u7684 host \u5b57\u7b26\u4e32 (READ of size 3), \u63d0\u4ea4\u591a\u4e2a\u4f5c\u4e1a\u540e\u95f4\u6b47\u5d29\u6e83",
"file": "src/frontend/apiserver/backend/clib.go (tryConnect)",
"root_cause": "tryConnect \u7528 defer C.free() \u91ca\u653e\u4e86 cAddr/cFrom/cKey, \u4f46 xcecli_ctx_init \u53ea\u5b58 config \u6307\u9488 (ctx->conf=config), client_failover.c \u7ec8\u8eab\u5f15\u7528 config->masters/from/key. \u4e4b\u540e\u4efb\u610f\u5199\u5931\u8d25/\u91cd\u5b9a\u5411\u65f6 xce_failover_next_target strncpy \u5df2\u91ca\u653e\u7684 master host \u2192 use-after-free",
"fix": "FIXED: \u521d\u59cb\u5316\u6210\u529f\u540e\u4e0d\u518d\u91ca\u653e\u8fd9\u4e09\u4e2a C \u5b57\u7b26\u4e32 (\u8fdb\u7a0b\u751f\u547d\u5468\u671f, tryConnect \u4e00\u6b21\u6027\u8c03\u7528, gCtx \u662f\u8fdb\u7a0b\u5168\u5c40); \u4ec5\u521d\u59cb\u5316\u5931\u8d25\u65f6\u91ca\u653e\u9632\u6cc4\u6f0f. \u9a8c\u8bc1: \u8fde\u7eed 6 \u4e2a\u4f5c\u4e1a\u63d0\u4ea4, apiserver \u5b58\u6d3b, 0 ASAN \u9519\u8bef",
"tags": [
"apiserver",
"use-after-free",
"cgo",
"failover",
"fixed"
],
"related_bugs": [],
"occurrences": 1,
"last_seen": "2026-08-04"
}
]