Rongsong Shen
b040dfc068
User-reported live crash: xce_scheduler SIGABRT via glibc malloc_printerr (heap corruption) inside kill_limit(), called from limit_update_config() during a live config reload. limit_update_config() called kill_limit(limit) in its error path after a failed key_add(privdata->limits, ...). But privdata->limits is a kvmgr created with .datakiller = kill_limit, so on a kvtab-level failure (e.g. -EEXIST for a duplicate limit name -- exactly the rc=-17 captured in the crash's own backtrace), xkvmgr_add() already rolls back via vclear() -> xzarray_clear(), which fires kill_limit(limit) once automatically. The caller's explicit second call was a double free. Removed the redundant call; the kvmgr's own configured datakiller already owns cleanup on this failure path (mirrors the ownership asymmetry job.c's restore_job_array() already documents for the opposite case, where its kvmgr has no datakiller configured and the caller must free failed items itself). One accepted, documented residual gap: a vstore()- level OOM failure (never reaching the kvtab step) would leak `limit` instead -- vanishingly rare, and a leak is strictly better than the guaranteed crash on the common duplicate-name case; xkvmgr_add's return code doesn't distinguish which sub-case occurred, so there's no clean way to free conditionally without a kvmgr API change (out of scope). New test_limit_plugin.c (this plugin had zero test coverage before) -- RED-phase independently reproduced a genuine ASAN heap-use-after-free matching the live crash's exact call chain; GREEN confirms 0 failures. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AgYRU3zDTqNGV5Jk8aiKLg |
||
|---|---|---|
| .. | ||
| hooks | ||
| _scan-state.json | ||
| anatomy-index.json | ||
| anatomy.md | ||
| buglog.json | ||
| cerebrum.md | ||
| config.json | ||
| cron-manifest.json | ||
| cron-state.json | ||
| daemon.log | ||
| designqc-report.json | ||
| identity.md | ||
| memory.md | ||
| OPENWOLF.md | ||
| reframe-frameworks.md | ||
| suggestions.json | ||
| token-ledger.json | ||