56 lines
3.3 KiB
Markdown
56 lines
3.3 KiB
Markdown
---
|
|
id: "bug-1901"
|
|
status: "fixed"
|
|
status_updated: "2026-10-01"
|
|
status_note: ""
|
|
component: "scheduler"
|
|
severity: "crash"
|
|
timestamp: "2026-10-01T10:24:43Z"
|
|
last_seen: "2026-10-01T10:24:43Z"
|
|
occurrences: 1
|
|
files: ["src/scheduler/src/driver.c"]
|
|
tags: ["scheduler", "driver", "job-array", "asan"]
|
|
related: ["bug-1900", "bug-1896"]
|
|
fix_commits: ["4f44a689"]
|
|
---
|
|
|
|
# bug-1901: scheduler crashes on an array push whose size overflows: expansion calloc overflow
|
|
|
|
## Description
|
|
**Observed:** found during task 3.1 of spec job-array-one-based-index (RED phase). The pre-fix `translate_one_pending_update` (`XCE_SCHED_OP_UPDATE_JOB_ARRAY`) expanded any array push without checking it, allocating one slot per element:
|
|
```
|
|
ERROR: AddressSanitizer: calloc parameters overflow: count * size (-1 * 8)
|
|
SUMMARY: AddressSanitizer: calloc-overflow ../src/driver.c:469 in translate_one_pending_update
|
|
```
|
|
for `array_size = UINT64_MAX`; an untagged first ID or a size running past the 32768-element block was also expanded.
|
|
**Expected:** a malformed array push (untagged, or size beyond the block) is logged and not expanded; the scheduler never crashes on it.
|
|
**Impact:** crash: a malformed or corrupted array push from the controller brings down the scheduler's driver thread (ASAN), or allocates/expands nonsense element IDs that spill into other arrays' blocks.
|
|
**Found by:** test (RED phase of task 3.1, `test_translate_job_array_max_u64_size_not_expanded`)
|
|
|
|
## Environment
|
|
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
|
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
|
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
|
- Build: asan (src/build.jai)
|
|
- Code: scheduler-framework @ fe5ddc98 (pre-fix driver)
|
|
- Deployment: none (sched_driver_translate_test; reachable from any array push)
|
|
|
|
## Reproduction
|
|
1. On fe5ddc98, feed `translate_one_pending_update` an `XCE_SCHED_OP_UPDATE_JOB_ARRAY` request whose descriptor has `array_size = UINT64_MAX` (as `test_driver_translate.c` now does).
|
|
2. Run `sched_driver_translate_test` from an ASAN build: `calloc-overflow` at `driver.c:469`.
|
|
- Frequency: deterministic (1/1, 2026-10-01)
|
|
- Evidence: not kept (the new test guards it)
|
|
|
|
## Root cause
|
|
The array-push translation trusted the descriptor: no check that the first ID carries the array tag or that `first + size - 1` stays inside the 32768-element block, so `calloc(array_size, ...)` was called with an arbitrary 64-bit count. The controller never sends such a push today, so it is only reachable through a corrupted or foreign push.
|
|
|
|
## Fix
|
|
`translate_one_pending_update` now expands only when `is_array_tag(first)` and `array_size <= 32768 - array_idx(first)` (no addition, so no wrap), checked before the allocation; otherwise it logs an ERROR naming the array identity and expands nothing.
|
|
|
|
## Verification
|
|
- Test: `test_translate_job_array_max_u64_size_not_expanded`, `..._untagged_first_not_expanded`, `..._overflowing_block_not_expanded` in `src/scheduler/testsuite/test_driver_translate.c`: RED (ASAN calloc overflow / wrong expansion) before, GREEN after
|
|
- Suites: scheduler ASAN suite 97/97 (build.jai), 2026-10-01
|
|
- Live: n/a (defensive input validation; unit reproduction is exact)
|
|
|
|
## References
|
|
- Related: bug-1900 (same class in the controller), bug-1896 (found by its spec's task 3.1)
|