/* * test_limit_plugin.c - white-box regression test for bug-1685: a live * SIGABRT (glibc malloc_printerr, "double free or corruption"-class heap * corruption abort) in limit_update_config() (../src/plugins/limit.c) * whenever a scheduler config update contains two xce_limit_config_t * entries with the SAME limit name. * * Root cause: privdata->limits is a kvmgr created with * .datakiller = kill_limit (limit_priv_data_init(), limit.c). key_add() on * that kvmgr dispatches to xkvmgr_add() (../../lib/kvmgr.c), which -- when * the SECOND, kvtab-level key_add() fails (e.g. -EEXIST for a duplicate * name, after the value has already been vstore()'d) -- itself rolls back * via vclear(kvm->data, idx). vclear() dispatches to xzarray_clear() * (../../lib/zarray.c), which fires the configured killer (kill_limit) on * the just-stored value exactly once as part of that rollback. Before this * fix, limit_update_config()'s own error path called kill_limit(limit) a * SECOND time on the same already-freed pointer -- a double free that * glibc's malloc_printerr aborts on. The fix removes that second, * redundant kill_limit() call from limit_update_config()'s error path (see * that function's own comment for the full mechanism and the accepted, * documented residual gap for the separate vstore()-failure sub-case). * * RED (pre-fix): running test_duplicate_limit_name_no_double_free() * against a limit_update_config() that still calls kill_limit(limit) in * its error path crashes with a real SIGABRT ("double free or corruption") * on the second (duplicate-name) config entry -- not a clean * TEST_ASSERT failure, an actual process abort, matching bug-1685's * captured live crash signature (malloc_printerr <- kill_limit <- * limit_update_config, rc=-17/-EEXIST at the crash frame). * GREEN (post-fix): limit_update_config() returns a negative rc (-EEXIST) * on the duplicate-name collision, with no crash and no double free. * * #include's the real ../src/plugins/limit.c (white-box, same convention * as test_plugin_picker_registration.c/test_handlers.c/ * test_job_array_expand.c) so this test exercises the real * limit_update_config()/limit_priv_data_init()/limit_init() -- not a * re-implementation of any of them. All three are `static`; limit_init()/ * limit_priv_data_init() are otherwise unreachable outside this TU, and * limit_update_config() is reachable in production only via * plugin_config_update()'s hooks.config_hook fan-out (plugin.c) -- calling * it directly here is the same "drive the static entry point directly" * convention test_job_update.c/test_handlers.c use for their own static * targets. * * Stubs: limit.c's limit_job_election()/limit_prepare_allocation() * (neither exercised by this test -- only limit_update_config() is) * reference reset_sched_obj() (../src/schedobj.c) and get_resvals()/ * put_resvals() (../src/resource.c), none of which is part of this * white-box TU. Stubbed as no-ops purely to satisfy the linker -- same * pattern test_plugin_picker_registration.c uses for its * sched_fill_limit_requests() stub. */ #include #include #include #include #include "group.h" #include "kvmgr.h" #include "scheduler.h" #include "xce/types.h" #include "xcelimit.h" void reset_sched_obj(xce_sched_obj_t* obj) { (void)obj; } int get_resvals(zarray_t* array, int nres, int* idxs, float* vals) { (void)array; (void)nres; (void)idxs; (void)vals; return 0; } int put_resvals(zarray_t* array, int nres, int* idxs, float* vals) { (void)array; (void)nres; (void)idxs; (void)vals; return 0; } /* register_limit() (limit.c, the plugin's public entry point) calls * plugin_register() (../src/plugin.c, not part of this TU); this test * never calls register_limit() itself (it drives limit_init()/ * limit_update_config() directly), so a no-op stub is sufficient purely * to satisfy the linker -- same rationale as the other stubs above. */ int plugin_register(void* sched, void* plugin) { (void)sched; (void)plugin; return 0; } #include "../src/plugins/limit.c" void setUp(void) { return; } void tearDown(void) { return; } /* ---------------------------------------------------------------------- */ /* Fixture: a real xce_scheduler_t with real group managers for * core.ugmgr/qgmgr/pgmgr/hgmgr (build_limit()'s build_consumer() calls * get_group(mgr, "all") for every consumer type our test configs leave * NULL -- same minimal setup ../../lib/testsuite/test_limit.c's own * test_build_limit_ok1() uses for build_limit() directly), plus a real * limit plugin (limit_init()) so plugin.data is a real * limit_plugin_data_t with privdata->limits configured with * .datakiller = kill_limit -- the exact kvmgr shape bug-1685 crashed on. * ---------------------------------------------------------------------- */ static void fixture_init(xce_scheduler_t* sched, xce_sched_plugin_t* plugin) { int rc; memset(sched, 0, sizeof(*sched)); groupmgr_init(&(sched->core.ugmgr), 4, 4); groupmgr_init(&(sched->core.qgmgr), 4, 4); groupmgr_init(&(sched->core.pgmgr), 4, 4); groupmgr_init(&(sched->core.hgmgr), 4, 4); TEST_ASSERT_NOT_NULL(sched->core.ugmgr); TEST_ASSERT_NOT_NULL(sched->core.qgmgr); TEST_ASSERT_NOT_NULL(sched->core.pgmgr); TEST_ASSERT_NOT_NULL(sched->core.hgmgr); memset(plugin, 0, sizeof(*plugin)); plugin->sched = sched; rc = limit_init(plugin); TEST_ASSERT_EQUAL_INT(0, rc); TEST_ASSERT_NOT_NULL(plugin->data); } /* A minimal, heap-allocated xce_limit_config_t: no per-consumer groups * (per_user/per_queue/per_project/per_host all 0, users/queues/projects/ * hosts all NULL), so build_limit()'s build_consumer() falls back to * get_group(mgr, "all") for every consumer -- the same "all"-group path * ../../lib/testsuite/test_limit.c's own fixtures rely on. `name` is * expected to be a string literal (build_limit() strdup()s it into the * built xce_limit_t, so no ownership is transferred here). */ static xce_limit_config_t* make_limit_config(const char* name) { xce_limit_config_t* cfg = (xce_limit_config_t*)calloc(1, sizeof(*cfg)); xce_limit_val_t* val = (xce_limit_val_t*)calloc(1, sizeof(*val)); TEST_ASSERT_NOT_NULL(cfg); TEST_ASSERT_NOT_NULL(val); val->resname = "mem"; val->percent = 0; val->val = 10.0; cfg->name = (char*)name; cfg->val = val; return cfg; } static void free_limit_config(xce_limit_config_t* cfg) { FREEUP(cfg->val); FREEUP(cfg); } /* * THE regression: a config update with TWO xce_limit_config_t entries * sharing the SAME name ("dup_limit") -- the exact duplicate-name * collision bug-1685's live crash captured (rc=-17/-EEXIST at the crash * frame, on/near the first limit of a 7-limit config). Pre-fix, this * aborts the process (SIGABRT, "double free or corruption"); post-fix, * limit_update_config() must return a negative rc cleanly, with no crash. * Under ASAN, a double free is caught unconditionally regardless of * whether this test also makes an explicit assertion about it -- the * absence of an abort IS the proof (same rationale the task description * for this test uses: "that's literally what caught the original bug"). */ static void test_duplicate_limit_name_no_double_free(void) { xce_scheduler_t sched; xce_sched_plugin_t plugin; xce_limit_config_t* limits[2]; xce_conf4sched_t config; int rc; fixture_init(&sched, &plugin); limits[0] = make_limit_config("dup_limit"); limits[1] = make_limit_config("dup_limit"); memset(&config, 0, sizeof(config)); config.nlimits = 2; config.limits = limits; rc = limit_update_config(&plugin, &config); TEST_ASSERT_LESS_THAN_INT(0, rc); TEST_ASSERT_EQUAL_INT(-EEXIST, rc); free_limit_config(limits[0]); free_limit_config(limits[1]); } /* * Control case: a config update with DISTINCT limit names succeeds for * both entries, proving the fix didn't just suppress freeing on failure * in general -- it only stopped the redundant free on THIS specific * (kvtab-key_add-failure) rollback path. Both built xce_limit_t values * are now owned by privdata->limits (torn down, if at all, only by the * kvmgr's own datakiller at process exit -- suite convention: * ASAN_OPTIONS=detect_leaks=0, fixtures are never explicitly torn down, * see meson.build). */ static void test_distinct_limit_names_both_succeed(void) { xce_scheduler_t sched; xce_sched_plugin_t plugin; xce_limit_config_t* limits[2]; xce_conf4sched_t config; int rc; fixture_init(&sched, &plugin); limits[0] = make_limit_config("limit_a"); limits[1] = make_limit_config("limit_b"); memset(&config, 0, sizeof(config)); config.nlimits = 2; config.limits = limits; rc = limit_update_config(&plugin, &config); TEST_ASSERT_EQUAL_INT(0, rc); free_limit_config(limits[0]); free_limit_config(limits[1]); } int main(void) { UNITY_BEGIN(); RUN_TEST(test_duplicate_limit_name_no_double_free); RUN_TEST(test_distinct_limit_names_both_succeed); return UNITY_END(); }