lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(controller,worker): sched worker resval UAF + execuser fallback to nobody

Browse source 
bug-1506 (controller): sched_worker_change pointed w->host.resvals_to_sched
at resvalist.data, then xlist_fini freed it — a concurrent reader (the
WORKER_JOIN hook encoding the worker's resvals) hit an ASAN
heap-use-after-free that crashed the controller and failed every job. Take
ownership of the resval data via MOVE_PTR (mirrors collect_resvals_workers);
the prior array is intentionally leaked (freeing it races the same readers).

bug-1507 (worker): the apiserver's bug-1500 execuser fix sent the submit
user ("admin") as execuser, but that user does not exist in the worker
host's /etc/passwd. systemd failed the worker unit with EXIT_USER (217),
so every job died immediately after submit. job_start_local_task now
checks the execuser with getpwnam() and falls back to "nobody" when the
user does not exist.

Verified with a full job lifecycle (submit -> RUN as nobody -> DONE) on
the clean build: all 4 daemons healthy, zero ASAN.

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
lei.chen 2026-08-05 03:40:09 +00:00
parent c630809116
commit c091a8dae0
4 changed files with 95 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

59
.wolf/buglog.json
View file

@ -14816,5 +14816,64 @@
"related_bugs": [],
"occurrences": 1,
"last_seen": "2026-08-05"
},
{
"id": "bug-1505",
"timestamp": "2026-08-05",
"error_message": "build failed: controller_connector.c:186:12: error: 'xcecd_ctx' undeclared (first use in this function); did you mean 'xcecli_ctx'?",
"file": "src/worker/src/controller_connector.c",
"root_cause": "checking_connection() was changed to loop indefinitely on xcecd_ctx.running && cc_ctx->running, but xcecd_ctx is a global owned by xcecd.c (xcecd_context_t xcecd_ctx) and the extern declaration lives in include/xcecd.h, which controller_connector.c did not include -> undeclared identifier.",
"fix": "added #include \"xcecd.h\" to controller_connector.c (guarded header already declares extern xcecd_context_t xcecd_ctx;). Rebuilt worker/xcecd successfully and deployed.",
"tags": [
"worker",
"build-failure",
"missing-include",
"controller-connector",
"xcecd_ctx",
"deploy"
],
"related_bugs": [],
"occurrences": 1,
"last_seen": "2026-08-05"
},
{
"id": "bug-1506",
"timestamp": "2026-08-05",
"error_message": "controller ASAN heap-use-after-free: READ of size 8 in encode_NameValue_list (T6 join thread) on memory freed by xlist_fini in sched_worker_change (T2 hook thread). Crashes the controller, causing all jobs to fail.",
"file": "src/controller/sched.c (sched_worker_change)",
"root_cause": "sched_worker_change pointed w->host.resvals_to_sched at resvalist.data, then xlist_fini(&resvalist) freed that array \u2014 leaving the worker's resvals_to_sched dangling. A concurrent reader (the WORKER_JOIN hook encoding the worker's resvals via encode_NameValue_list) read the freed memory -> UAF. The old #if 0 free_name_val_list block was disabled for the same race.",
"fix": "Take ownership of resvalist.data via MOVE_PTR before xlist_fini (mirrors collect_resvals_workers). The prior resvals_to_sched is intentionally leaked (freeing it would race the same readers). Added #include \"utils.h\".",
"tags": [
"asan",
"heap-use-after-free",
"controller",
"sched",
"resvals",
"race"
],
"related_bugs": [],
"occurrences": 1,
"last_seen": "2026-08-05"
},
{
"id": "bug-1507",
"timestamp": "2026-08-05",
"error_message": "\u4f5c\u4e1a\u63d0\u4ea4\u540e\u7acb\u5373 EXIT: systemd \u5355\u5143 xcecd-worker-<jobid>.service \u5931\u8d25, status=217/USER (\u670d\u52a1\u7528\u6237\u4e0d\u5b58\u5728). \u7528\u6237 1-0-1785897786-0 \u7b49\u5168\u90e8\u5931\u8d25.",
"file": "src/worker/src/controller_connector.c (job_start_local_task)",
"root_cause": "apiserver bug-1500 \u4fee\u590d\u8bbe\u7f6e si.execuser=resolveExecUser(job)=\"admin\" (\u63d0\u4ea4\u7528\u6237). \u4f46 admin \u5728 worker \u4e3b\u673a /etc/passwd \u4e0d\u5b58\u5728. worker \u628a limits->user_name \u8bbe\u4e3a execuser, start_systemd_job \u751f\u6210 User=admin \u5355\u5143 -> systemd EXIT_USER 217 -> \u4f5c\u4e1a\u5931\u8d25. \u4e4b\u524d execuser \u4e3a\u7a7a\u65f6\u9ed8\u8ba4 nobody(\u5b58\u5728) \u80fd\u8dd1, bug-1500 \u90e8\u7f72\u540e\u53d8\u6210 admin \u53cd\u800c\u5168\u5931\u8d25.",
"fix": "job_start_local_task \u7528 getpwnam() \u68c0\u67e5 execuser \u662f\u5426\u5b58\u5728; \u4e0d\u5b58\u5728\u5219\u56de\u9000 nobody. \u4f5c\u4e1a\u4ee5 nobody \u8fd0\u884c(\u7528\u6237\u5df2\u786e\u8ba4\u73b0\u9636\u6bb5\u53ef\u4ee5).",
"tags": [
"worker",
"execuser",
"systemd",
"217",
"nobody",
"regression"
],
"related_bugs": [
"bug-1500"
],
"occurrences": 1,
"last_seen": "2026-08-05"
}
]