Files: public share password attempt tests fail under parallel load #1236

Open
opened 2026-10-06 22:02:00 +00:00 by kayg · 3 comments
Owner

Two Files tests fail when the crate runs in parallel (--test-threads=4) on a loaded host and pass when run serially:

  • public_password_attempts_are_reserved_before_parallel_checks
  • public_password_rejection_does_not_wait_for_data_mutation_lock
    Seen on branch job/proflog-1204 (head 99b62c6de, log-label change only, no password code touched): test result: FAILED. 257 passed; 2 failed; 4 ignored.

These tests guard the public share password attempt limit. Decide whether this is a timing-only test flake or a real race where parallel wrong-password attempts can exceed the limit (or a correct attempt waits on the mutation lock). Run each 50 times in parallel under CPU stress (stress-ng or a busy loop) and read the attempt reservation code. If real: fix with a regression test. If a test flake: make the test deterministic (barriers instead of sleeps) without weakening what it proves. Severity: major until shown to be test-only.

Two Files tests fail when the crate runs in parallel (--test-threads=4) on a loaded host and pass when run serially: - public_password_attempts_are_reserved_before_parallel_checks - public_password_rejection_does_not_wait_for_data_mutation_lock Seen on branch job/proflog-1204 (head 99b62c6de, log-label change only, no password code touched): `test result: FAILED. 257 passed; 2 failed; 4 ignored`. These tests guard the public share password attempt limit. Decide whether this is a timing-only test flake or a real race where parallel wrong-password attempts can exceed the limit (or a correct attempt waits on the mutation lock). Run each 50 times in parallel under CPU stress (stress-ng or a busy loop) and read the attempt reservation code. If real: fix with a regression test. If a test flake: make the test deterministic (barriers instead of sleeps) without weakening what it proves. Severity: major until shown to be test-only.
Author
Owner

Started on job/bash-security at ff53d7b8b4. Reading the reservation path and reproducing both tests under bounded CPU load before changing code.

Started on job/bash-security at ff53d7b8b4da5a21f862d57dcc3496f8c019f647. Reading the reservation path and reproducing both tests under bounded CPU load before changing code.
Author
Owner

Static finding: PasswordWork admission saturation and its five-second queue deadline return 429 before reserve_password_attempt. The parallel route test counts every 429 as a pair-limit refusal and then requires five 401 responses. The lock-order test also includes global worker wait and Argon2 time inside a two-second deadline. Added barrier-based exact-counter and no-reservation-on-admission-refusal tests; unchanged route tests are still compiling for the first 50-repetition stressed run. Evidence: artifacts/bash-security/password-initial.log.

Static finding: PasswordWork admission saturation and its five-second queue deadline return 429 before reserve_password_attempt. The parallel route test counts every 429 as a pair-limit refusal and then requires five 401 responses. The lock-order test also includes global worker wait and Argon2 time inside a two-second deadline. Added barrier-based exact-counter and no-reservation-on-admission-refusal tests; unchanged route tests are still compiling for the first 50-repetition stressed run. Evidence: artifacts/bash-security/password-initial.log.
Author
Owner

Reproduced a test-only flake: the original held-lock test failed 25/50 stressed repetitions at its two-second deadline; the parallel cap test passed 50/50. The revised tests passed 50/50 each under the same two-process/two-busy-loop campaign. Added deterministic barrier checks for exactly five reservations and atomic counters, plus a separate admission-refusal check that spends no attempt. Focused password suite: test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 253 filtered out; finished in 13.36s. Fix b6dbec65b keeps production Argon2 parameters, shared admission and reservation SQL unchanged. Merged origin/dev once at e6de39334; final gates and local-server audit are running. Evidence: artifacts/bash-security/findings.md and password stress logs.

Reproduced a test-only flake: the original held-lock test failed 25/50 stressed repetitions at its two-second deadline; the parallel cap test passed 50/50. The revised tests passed 50/50 each under the same two-process/two-busy-loop campaign. Added deterministic barrier checks for exactly five reservations and atomic counters, plus a separate admission-refusal check that spends no attempt. Focused password suite: test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 253 filtered out; finished in 13.36s. Fix b6dbec65b keeps production Argon2 parameters, shared admission and reservation SQL unchanged. Merged origin/dev once at e6de39334; final gates and local-server audit are running. Evidence: artifacts/bash-security/findings.md and password stress logs.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1236
No description provided.