Repository navigation
ci(msan): lower mmap ASLR entropy on the host before the MSan suite - #2962
Merged
Merged
Conversation
Since the hosted runner image changed on 2026-11-11 the MSan lane aborts before any test runs: MemorySanitizer: CHECK failed: msan_linux.cpp:193 "((personality(old_personality | ADDR_NO_RANDOMIZE))) != ((-1))" The runner kernel now randomizes mmap with more bits than MSan's shadow layout tolerates, so the runtime tries to re-exec itself with ADDR_NO_RANDOMIZE; inside the lane's container the default seccomp profile refuses that personality() call. The last green MSan run was 2026-11-11 01:28Z (run 42939151247); every PR run with the lane since 18:45Z failed this way (runs 43080749803, 43081615012), independent of the change under test. The TSan leg hit the same kernel behaviour earlier and lowers vm.mmap_rnd_bits to 28 on Linux before its suite. Do the same on the host before the MSan container starts; the container shares the host kernel, so MSan's layout fits again without disabling ASLR in the container. `|| true` keeps the step from failing where sysctl is not permitted, exactly as in the TSan step. Signed-off-by: Martin Vogel <[email protected]>
DeusData
added a commit
to htarnacki/codebase-memory-mcp
that referenced
this pull request
Nov 12, 2026
Bring DeusData#2360 up to date with main b3ec08d (DeusData#2427 registry test verdict, DeusData#2962 MSan CI, DeusData#2952 Windows stdio guard). The merge is clean and needs no follow-up edit: DeusData#2360's code makes no cbm_registry_add* call and never used is_test_qn, and Scala definitions register through the shared seeders in pass_definitions.c, pass_parallel.c and pipeline_incremental.c, which DeusData#2427 already passes the extractor verdict through for every language. The branch's own change against main is byte-identical to 28948f2's against f5d5746. Signed-off-by: Martin Vogel <[email protected]>
DeusData
added a commit
to ankitsusheel/codebase-memory-mcp
that referenced
this pull request
Nov 12, 2026
Brings the branch up to main b3ec08d (DeusData#2962, DeusData#2427). Conflict in src/pipeline/registry.c: main (DeusData#2427) threads the extractor's test verdict through cbm_registry_add_lang_in_module into index_under_name, while this branch records each VB.NET definition's spelling for the case-insensitive retry right after that call. Resolved by keeping both: index_under_name takes main's `is_test`, and vb_index_folded still follows it for VB.NET. VB.NET registrations get the verdict the way every language does: the three registry seeders pass the definition's is_test, which the extractor sets from the file's test-ness, and the *Test.vb / *Tests.vb rule of this branch feeds that. Adapted with the merge, per DeusData#2427's convention: the VB.NET registry tests register with `, false`, and vb_test_file_names now also checks that a method of OrderTests.vb is extracted with is_test set and one of Order.vb without it. Signed-off-by: Martin Vogel <[email protected]>
DeusData
added a commit
that referenced
this pull request
Nov 12, 2026
Brings in #2957 (sql became a self-maintained fork), #2959 and #2962. Both sides added a self-maintained grammar fork, so every conflict keeps both additions: - MANIFEST.md summary: 164 grammars = 139 vendored-from-upstream + 20 self-maintained (sql moved over on main, vba added here) + 5 registry-disagreement; the ABI tally stays 9/78/77 (sql stayed ABI 15). The notes and the forks table carry both the sql and the vba rows. - THIRD_PARTY.md: thirteen further self-maintained forks including sql and vba; main's sql paragraph, then this branch's tree-sitter-vba section. - tests/test_parse_coverage.c: both test blocks and both sets of RUN_TEST registrations. - scripts/vendored-checksums.txt: regenerated with security-vendored.sh --update; against main only the MANIFEST.md line and the five vba files differ. Signed-off-by: Martin Vogel <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The MSan lane fails on every PR that runs it since the hosted runner image changed on 2026-11-11, before a single test runs:
The runner kernel now randomizes mmap with more bits than MSan's shadow layout tolerates, so the MSan runtime tries to re-exec itself with
ADDR_NO_RANDOMIZE; inside the lane's container the default seccomp profile refuses thatpersonality()call. Last green MSan run: 2026-11-11 01:28Z (42939151247). Failing since 18:45Z regardless of the change under test (43080749803, 43081615012).Fix
One step, mirroring the TSan leg, which hit the same kernel behaviour earlier:
sudo sysctl -w vm.mmap_rnd_bits=28 || trueon the host beforescripts/ci/msan-lane.sh run. The container shares the host kernel, so MSan's layout fits again; ASLR stays on.CI scope
.github/workflows/_test.yml, jobtest-msan, the suite step only (one hostsysctlline plus a comment).ci-okwhere its tier runs it).|| truematches the TSan step.test-msanjob is the proof (the local arm64 MSan lane runs on a different kernel and never hit it).Lane wiring and venue parity contracts pass.