From 250f7d1ac28b75433f5373b88c9bc8a9712f59e3 Mon Sep 17 00:00:00 2001 From: Rongsong Shen Date: Fri, 25 Sep 2026 03:08:46 +0000 Subject: [PATCH] chore(buglog): bug-1862 fixed (f0762962) Co-Authored-By: Claude Opus 5.5 (1M context) --- .wolf/buglog.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.wolf/buglog.json b/.wolf/buglog.json index ed75cedc..5315621e 100644 --- a/.wolf/buglog.json +++ b/.wolf/buglog.json @@ -27932,14 +27932,14 @@ }, { "id": "bug-1862", - "status": "open", - "status_updated": "2026-09-24", - "status_note": "resync query (vtask thread) walks worker list while main loop frees entries; no lock", + "status": "fixed", + "status_updated": "2026-09-25", + "status_note": "f0762962", "timestamp": "2026-09-24T15:24:57Z", "error_message": "xcecd_virtual ASAN heap-use-after-free in find_worker_by_jobid (xcecd_worker_utils.c:702) <- xcecd_resync_classify_job (xcecd_resync.c:33) <- xcecd_resync_build_report <- handle_jobstatequery (controller_connector.c:1662) on a vtask thread; freed by remove_worker (xcecd_worker_utils.c:283) <- cleanup_worker_list <- main loop (main.c:652). Worker aborted mid chaotic HA soak (2026-09-24, run 1 of 3), so later rounds lost worker-resync coverage.", "file": "src/worker/src/xcecd_resync.c,src/worker/src/xcecd_worker_utils.c,src/worker/src/controller_connector.c,src/worker/src/main.c", "root_cause": "The worker's live job list is mutated by the main loop (add_worker / cleanup_worker_list -> remove_worker) with no lock, while the controller's OPCode_jobStateQuery is answered on a vtask thread (myreq_handler) that walks the same list. Any rejoin resync overlapping a job reap reads a freed node.", - "fix": "", + "fix": "UPDATE (2026-09-25): Fix (uncommitted): xcecd_worker_utils.c gains a worker-list mutex (xcecd_worker_list_lock/unlock). add_worker takes it around linking a fully-built entry; remove_worker unlinks under it and frees after. Readers on vtask threads: handle_jobstatequery holds it from reading the list head through the whole query page (report build walks the list several times; the send is a non-blocking xce_request); the job-control handler copies job_status under it and re-finds the entry under it to set killed_signal; remote task start strdup's the five fields it sends under it and frees them after xcecli_runtask. The finished-job retention store (appended by the main loop, read by resync) gets its own internal mutex via public wrappers around *_locked_ bodies. Main-thread-only traversals (uv_ipc.c find_worker_by_pid, cleanup/update) need no lock. Test: test_xcecd_resync.c test_build_report_safe_against_concurrent_list_mutation (mutator thread add/remove/retain vs 20000 locked report builds) -- heap-use-after-free in find_worker_by_jobid 3/3 with no-op lock stubs, clean 5/5 with the fix; worker suite 10/10.", "tags": [ "worker", "asan",