55 lines
3.3 KiB
Markdown
55 lines
3.3 KiB
Markdown
---
|
|
id: "bug-1900"
|
|
status: "fixed"
|
|
status_updated: "2026-10-01"
|
|
status_note: ""
|
|
component: "controller"
|
|
severity: "crash"
|
|
timestamp: "2026-10-01T09:44:27Z"
|
|
last_seen: "2026-10-01T09:44:27Z"
|
|
occurrences: 1
|
|
files: ["src/controller/job.c"]
|
|
tags: ["controller", "jobsubmit", "job-array", "asan"]
|
|
related: ["bug-1896"]
|
|
fix_commits: ["e6c484a0"]
|
|
---
|
|
|
|
# bug-1900: controller crashes on a jobsub with array_size 0: payload build overflows calloc
|
|
|
|
## Description
|
|
**Observed:** found during task 2.1 of spec job-array-one-based-index, while capturing the RED phase. With the pre-fix `handle_jobsubmit`, a submission with `array_size == 0` passed the duplicate checks (an empty range never overlaps) and reached payload building, which crashed:
|
|
```
|
|
==ERROR: AddressSanitizer: calloc parameters overflow: count * size (-171944536 * 8)
|
|
in build_job_submit_payloads ... handle_jobsubmit (src/controller/job.c)
|
|
```
|
|
**Expected:** a submission with element count 0 is rejected with an error and stores nothing (requirement 7.4 of job-array-one-based-index).
|
|
**Impact:** crash: any client (or a corrupt/malicious request) sending `OPCode_jobsub` with `array_size = 0` brings down the controller's handler under ASAN; in a non-ASAN build the oversized calloc returns NULL or the request is left unanswered. The controller must never die on an operational input (ha-async-io.md).
|
|
**Found by:** test (RED phase of task 2.1, test_jobsubmit_index0_size0_start0 / size-0 classification)
|
|
|
|
## Environment
|
|
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
|
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
|
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
|
- Build: asan (src/build.jai)
|
|
- Code: scheduler-framework @ ef728435 (pre-fix handler)
|
|
- Deployment: none (controller_unit_test; reachable from any client sending a jobsub)
|
|
|
|
## Reproduction
|
|
1. On ef728435, in `src/controller/testsuite`, call `handle_jobsubmit` with an `xce_job_submit_t` whose `array_size` is 0 (as `test_jobsubmit_validate.c` does).
|
|
2. Run `controller_unit_test` from an ASAN build: AddressSanitizer reports `calloc parameters overflow`.
|
|
- Frequency: deterministic (1/1, 2026-10-01)
|
|
- Evidence: not kept (reproduced by the RED phase of task 2.1; the test now guards it)
|
|
|
|
## Root cause
|
|
`handle_jobsubmit` had no check on the element count: an empty range passes `jobid_range_exists` and `inflight_range_try_add` (an empty range never overlaps), and payload building computes an allocation from `array_size - 1`-style arithmetic that underflows for 0, so calloc is asked for a huge count. Present since array submission was introduced (job-array-single-wal-record).
|
|
|
|
## Fix
|
|
`jobsubmit_classify()` now runs first in `handle_jobsubmit` and classifies a size-0 submission as invalid (7.4), so it is answered `-EINVAL` before any registry, table or payload work.
|
|
|
|
## Verification
|
|
- Test: `test_jobsubmit_index0_size0_start0` and the size-0 rows of `test_jobsubmit_classify_table` / `test_jobsubmit_invalid_classes_einval` in `src/controller/testsuite/test_jobsubmit_validate.c`: RED (ASAN calloc overflow) before, GREEN after
|
|
- Suites: controller ASAN suite 1263 tests 0 failures (build.jai), 2026-10-01
|
|
- Live: n/a (input validation; unit-level reproduction is exact)
|
|
|
|
## References
|
|
- Related: bug-1896 (found by its spec's task 2.1)
|