| id |
status |
status_updated |
status_note |
component |
severity |
timestamp |
last_seen |
occurrences |
files |
tags |
related |
fix_commits |
| bug-1901 |
fixed |
2026-10-01 |
|
scheduler |
crash |
2026-10-01T10:24:43Z |
2026-10-01T10:24:43Z |
1 |
| src/scheduler/src/driver.c |
|
| scheduler |
| driver |
| job-array |
| asan |
|
|
|
bug-1901: scheduler crashes on an array push whose size overflows: expansion calloc overflow
Description
Observed: found during task 3.1 of spec job-array-one-based-index (RED phase). The pre-fix translate_one_pending_update (XCE_SCHED_OP_UPDATE_JOB_ARRAY) expanded any array push without checking it, allocating one slot per element:
ERROR: AddressSanitizer: calloc parameters overflow: count * size (-1 * 8)
SUMMARY: AddressSanitizer: calloc-overflow ../src/driver.c:469 in translate_one_pending_update
for array_size = UINT64_MAX; an untagged first ID or a size running past the 32768-element block was also expanded.
Expected: a malformed array push (untagged, or size beyond the block) is logged and not expanded; the scheduler never crashes on it.
Impact: crash: a malformed or corrupted array push from the controller brings down the scheduler's driver thread (ASAN), or allocates/expands nonsense element IDs that spill into other arrays' blocks.
Found by: test (RED phase of task 3.1, test_translate_job_array_max_u64_size_not_expanded)
Environment
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
- Build: asan (src/build.jai)
- Code: scheduler-framework @
fe5ddc98 (pre-fix driver)
- Deployment: none (sched_driver_translate_test; reachable from any array push)
Reproduction
- On
fe5ddc98, feed translate_one_pending_update an XCE_SCHED_OP_UPDATE_JOB_ARRAY request whose descriptor has array_size = UINT64_MAX (as test_driver_translate.c now does).
- Run
sched_driver_translate_test from an ASAN build: calloc-overflow at driver.c:469.
- Frequency: deterministic (1/1, 2026-10-01)
- Evidence: not kept (the new test guards it)
Root cause
The array-push translation trusted the descriptor: no check that the first ID carries the array tag or that first + size - 1 stays inside the 32768-element block, so calloc(array_size, ...) was called with an arbitrary 64-bit count. The controller never sends such a push today, so it is only reachable through a corrupted or foreign push.
Fix
translate_one_pending_update now expands only when is_array_tag(first) and array_size <= 32768 - array_idx(first) (no addition, so no wrap), checked before the allocation; otherwise it logs an ERROR naming the array identity and expands nothing.
Verification
- Test:
test_translate_job_array_max_u64_size_not_expanded, ..._untagged_first_not_expanded, ..._overflowing_block_not_expanded in src/scheduler/testsuite/test_driver_translate.c: RED (ASAN calloc overflow / wrong expansion) before, GREEN after
- Suites: scheduler ASAN suite 97/97 (build.jai), 2026-10-01
- Live: n/a (defensive input validation; unit reproduction is exact)
References
- Related: bug-1900 (same class in the controller), bug-1896 (found by its spec's task 3.1)
