wdgzyjx/myxce
1
0
Fork 0
forked from lei.chen/myxce
Code Pull requests Activity
myxce/.wolf
History
Rongsong Shen 8da8fd03dd fix(libxce): bug-1077 ctrlstatus crash from shared reply-union type confusion 
ctx->reply.u is a single untagged union shared across opcodes (debugmsg /
get(dataset_t*) / jobid / clusterconf / ctrlstatus alias the same 8 bytes).
Commit 61e1391 added speculative free-guards
`if (ctx->reply.u.ctrlstatus) free_CtrlStatus_ptr(...)` (and the clusterconf
twin). A non-NULL slot does NOT imply a CtrlStatus*: a failover-aborted
reslist/joblist leaves ctx->reply.u.get == &getreply (a dead STACK pointer)
because xce_get_with_condition/xce_resval only cleared the slot on the success
path, not the xce_get_req<0 / cbuf_get<0 early returns. The next ctrlstatus
reply (worker thread) freed that foreign pointer as a CtrlStatus -> ASan
SEGV / stack-use-after-return in free_CtrlStatus (controller.capnp.c:11638).

Fix (root cause, both layers):
- Revert the unsafe free-guards in xce_handle_reply: MOVE_PTR overwrite only,
  never free/deref an untagged union slot by type.
- Clear ctx->reply.u.get = NULL on ALL exit paths of xce_get_with_condition
  and xce_resval via a single `goto done` cleanup (forget-proof; the bug was
  one forgotten failover path). Also drops the now-unused controller.capnp.h.
- Defense-in-depth: handle_get_reply drops a reply when the slot is NULL.

Regression: expose xce_handle_reply and add
test_handle_reply_ctrlstatus_does_not_free_foreign_slot, which poisons the
shared slot with a foreign heap value and proves the ctrlstatus reply handler
does not free it (RED reproduced the exact free_CtrlStatus_ptr double-free;
GREEN after fix). xcelib_test 244/0, controller_unit_test 166/0, all binaries
build clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MSxwb2Xt5F84ATgiAZnH8V
2026-06-24 09:44:43 +00:00
..
hooks fix bug-1060 bug-1067 2026-06-24 17:05:43 +08:00
anatomy.md fix bug-1060 bug-1067 2026-06-24 17:05:43 +08:00
buglog.json fix(libxce): bug-1077 ctrlstatus crash from shared reply-union type confusion 2026-06-24 09:44:43 +00:00
cerebrum.md fix(libxce): bug-1077 ctrlstatus crash from shared reply-union type confusion 2026-06-24 09:44:43 +00:00
config.json chore: checkpoint all prior work for clean state 2026-06-04 13:04:16 +00:00
cron-manifest.json chore: checkpoint all prior work for clean state 2026-06-04 13:04:16 +00:00
cron-state.json feat(libxce-failover): foundation — per-ctx failover state, redirect-hint fields, remove orphaned retry primitive (task 1.1) 2026-06-17 00:05:41 +00:00
daemon.log commit missed 2026-06-16 15:42:43 +08:00
designqc-report.json chore: checkpoint all prior work for clean state 2026-06-04 13:04:16 +00:00
identity.md chore: checkpoint all prior work for clean state 2026-06-04 13:04:16 +00:00
memory.md fix(libxce): bug-1077 ctrlstatus crash from shared reply-union type confusion 2026-06-24 09:44:43 +00:00
OPENWOLF.md chore: checkpoint all prior work for clean state 2026-06-04 13:04:16 +00:00
reframe-frameworks.md chore: checkpoint all prior work for clean state 2026-06-04 13:04:16 +00:00
suggestions.json chore: checkpoint all prior work for clean state 2026-06-04 13:04:16 +00:00
token-ledger.json fix bug-1060 bug-1067 2026-06-24 17:05:43 +08:00