fix(controller): reject submissions to closed or unknown queues (bug-1960)

Cause: handle_jobsubmit() never looked at the target queue, so a
submission that bypassed the apiserver's check (libxce, harness
xce_test, or a REST submit without a queue name) was accepted into a
closed queue, an unknown queue, or the reserved lost_and_found queue.

Fix: jobsubmit_check_queue() reads the queue's in-memory state under the
qmgr/queue read locks. handle_jobsubmit() calls it after the field
checks and before the in-flight jobid registry and any WAL append, for
single jobs and job arrays. It replies -E_XCE_QUEUE_CLOSED (new code,
"queue is closed") for a closed queue and -E_XCE_BAD_QUEUE for an
unknown or reserved one. Apply/replay (restore_job) is unchanged, so
committed submit facts for a now-closed queue still apply.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Rongsong Shen 2026-10-10 10:38:12 +00:00
parent 387cc99486
commit b239db5fa3
Signed by untrusted user: rshen
GPG key ID: 80533536B0EB651C
7 changed files with 272 additions and 1 deletions

View file

@ -413,6 +413,15 @@ static void cbrp_setup(uint32_t sync_timeout_ms)
TEST_ASSERT_NOT_NULL(g_hc.resmgr);
zarray_init(&g_hc.sharedinst, 64, NULL);
/* bug-1960: handle_jobsubmit admits only a known, open queue; the
* jobsub fixtures below submit to "normal". */
{
xce_queue_t qdef;
memset(&qdef, 0, sizeof(qdef));
qdef.queue = (char *)"normal";
TEST_ASSERT_NOT_NULL(makeQueue(g_hc.qmgr, &qdef));
}
for (i = 0; i < CBRP_N_RES; i++) {
xce_resource_t rdef;
memset(&rdef, 0, sizeof(rdef));