lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(controller,worker): sched worker resval UAF + execuser fallback to nobody

Browse source 
bug-1506 (controller): sched_worker_change pointed w->host.resvals_to_sched
at resvalist.data, then xlist_fini freed it — a concurrent reader (the
WORKER_JOIN hook encoding the worker's resvals) hit an ASAN
heap-use-after-free that crashed the controller and failed every job. Take
ownership of the resval data via MOVE_PTR (mirrors collect_resvals_workers);
the prior array is intentionally leaked (freeing it races the same readers).

bug-1507 (worker): the apiserver's bug-1500 execuser fix sent the submit
user ("admin") as execuser, but that user does not exist in the worker
host's /etc/passwd. systemd failed the worker unit with EXIT_USER (217),
so every job died immediately after submit. job_start_local_task now
checks the execuser with getpwnam() and falls back to "nobody" when the
user does not exist.

Verified with a full job lifecycle (submit -> RUN as nobody -> DONE) on
the clean build: all 4 daemons healthy, zero ASAN.

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
lei.chen 2026-08-05 03:40:09 +00:00
parent c630809116
commit c091a8dae0
4 changed files with 95 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.wolf/memory.md
View file

@ -7371,3 +7371,5 @@
| 09:39 | 修复 controller 反复崩溃 bug-1502: persist_job_hook_fun 把 RUSAGE_UPDATE hook 的第2参 (xce_job_rusages_t*) 当 job_t* 用, 读 offset 56 越界 56字节结构 -> ASAN heap-buffer-overflow. 加专用 case 从 jobmgr 取当前 state | src/controller/persist.c, testsuite/test_persist_hooks.c | RED(旧代码 stack-buffer-overflow)/GREEN(修复后 PASS), 全套458测试通过 | ~350 |
| 01:08 | 验证完成: bug-1502(controller ASAN崩溃)修复生产生效(sleep 666跑满666秒, controller 0崩溃); 作业PENDING根因=配置正确但scheduler先于worker join拿不到slots(操作时序, bug-1503); 干净controller部署, 集群全链路(apiserver提交->scheduler->controller->worker)冒烟通过 | persist.c, sched.c, worker.c | 验证通过 | ~300 |
| 01:42 | 修复 bug-1504: xcecli jobs list -a 返回空, 因 FilterRows 把 job_status notnull 路由到 MatchesBitmaskCondition(仅实现OpEQ/OpNE) -> 全过滤. 加 OpISNULL/OpNOTNULL 分支 + 3回归测试, 部署后 -a 正常显示全部作业 | src/frontend/apiserver/store/query.go + query_test.go | RED->GREEN, 生产验证 -a 列出全部 | ~250 |
| 02:40 | 增量重建并部署 xcecd (ASAN): bug-1505修复(worker join无限重试, checking_connection 不再5次放弃+删handle_disconnect). 首次编译失败: controller_connector.c 引用 xcecd_ctx 未包含 xcecd.h -> 加 #include "xcecd.h" 修复. ninja worker/xcecd 成功, mtime 2026-08-05 02:28:50, md5 36b166545caf266e30e194e626494c6d 源/部署一致 | src/worker/src/controller_connector.c, xcecd.h | 部署完成(未重启守护进程) | ~200 |
| 03:39 | 完整验证通过: 干净 controller(bug-1506 UAF修复)+worker(bug-1507 execuser回退nobody) 下 final-verify sleep 12 完整跑完=DONE, 4 daemon健康, ASAN 0. bug-1506(sched_worker_change MOVE_PTR所有权)+bug-1507(getpwnam回退nobody) 修复, 按新准则验证后提交 | sched.c, controller_connector.c, buglog | 验证通过, 准备提交 | ~200 |