lei.chen/myxce
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(persist): zero nresvals_to_sched after free_name_val_list

Browse source 
Crash: encode_NameValue_list called with count=21, s=NULL on worker
rejoin, causing SIGSEGV in persist_worker_hook_fun.

Root cause: free_name_val_list(xce_name_val_t***, int) accepted count by
value. It zeroed *vals (resvals_to_sched = NULL) but could not zero
nresvals_to_sched. Any caller that freed the scheduler resource snapshot
(opget.c workerlist, reply.c clusterconf, dataex.c, sched.c dispatch)
left nresvals_to_sched stale. When the worker later rejoined and the
WAL HOOK fired, the WAL encoder read count=21 with a NULL pointer.

Fix: change signature to free_name_val_list(xce_name_val_t***, int*)
so both fields are zeroed atomically. Update all 7 call sites.
This commit is contained in:
Rongsong Shen 2026-05-20 09:39:07 +00:00
parent 0d783b16e3
commit e5fde7b55f
7 changed files with 14 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/controller/apiserver.c
View file

@ -48,7 +48,7 @@ static int xce_apiserver_push_workers(cluster_t* c, endpoint_t* ep)
for (i = 0; i < workers.n_total; i++) { for (i = 0; i < workers.n_total; i++) {
xce_worker_t* w = workers.workers[i]; xce_worker_t* w = workers.workers[i];
free_name_val_list(&(w->resvals_to_sched), w->nresvals_to_sched); free_name_val_list(&(w->resvals_to_sched), &(w->nresvals_to_sched));
} }
unlock_collect_workers(&wlist); unlock_collect_workers(&wlist);

2
src/controller/dataex.c
View file

@ -417,7 +417,7 @@ void unlock_collect_workers(xlist_t* l)
continue; continue;
} }
free_name_val_list(&(w->resvals_to_sched), w->nresvals_to_sched); free_name_val_list(&(w->resvals_to_sched), &(w->nresvals_to_sched));
w1 = CONTAINER_OF(w, worker_t, host); w1 = CONTAINER_OF(w, worker_t, host);
unlock(w1); unlock(w1);

2
src/controller/opget.c
View file

@ -125,7 +125,7 @@ static int do_reply_workerlist(cluster_t* c, endpoint_t* ep,
for (i = 0; i < workerdata.n_total; i++) { for (i = 0; i < workerdata.n_total; i++) {
xce_worker_t* w = workerdata.workers[i]; xce_worker_t* w = workerdata.workers[i];
free_name_val_list(&(w->resvals_to_sched), w->nresvals_to_sched); free_name_val_list(&(w->resvals_to_sched), &(w->nresvals_to_sched));
} }
unlock_collect_workers(&wlist); unlock_collect_workers(&wlist);

2
src/controller/reply.c
View file

@ -63,7 +63,7 @@ int handle_clusterconf(cluster_t* c, endpoint_t* ep, xce_request_t* request)
for (i = 0; i < clusterconf.wlist.count; i++) { for (i = 0; i < clusterconf.wlist.count; i++) {
xce_worker_t* w = clusterconf.wlist.workers[i]; xce_worker_t* w = clusterconf.wlist.workers[i];
free_name_val_list(&(w->resvals_to_sched), w->nresvals_to_sched); free_name_val_list(&(w->resvals_to_sched), &(w->nresvals_to_sched));
} }
unlock_collect_queues(&qlist); unlock_collect_queues(&qlist);

6
src/controller/sched.c
View file

@ -143,7 +143,7 @@ static int xcesched_push_configs(cluster_t* c)
rc = xce_pushconfig_req(c->sched.ep, c->myhost, &configdata); rc = xce_pushconfig_req(c->sched.ep, c->myhost, &configdata);
free_name_val_list(&(configdata.data.conf4sched->resvals), free_name_val_list(&(configdata.data.conf4sched->resvals),
configdata.data.conf4sched->nresvals); &(configdata.data.conf4sched->nresvals));
FREEUP(configdata.data.conf4sched); FREEUP(configdata.data.conf4sched);
@ -223,7 +223,7 @@ static int xcesched_push_workers(cluster_t* c)
for (i = 0; i < workers.n_total; i++) { for (i = 0; i < workers.n_total; i++) {
xce_worker_t* w = workers.workers[i]; xce_worker_t* w = workers.workers[i];
free_name_val_list(&(w->resvals_to_sched), w->nresvals_to_sched); free_name_val_list(&(w->resvals_to_sched), &(w->nresvals_to_sched));
} }
unlock_collect_workers(&wlist); unlock_collect_workers(&wlist);
@ -461,7 +461,7 @@ static int sched_worker_change(int type, int situation, void* data,
#if 0 #if 0
/*FIXME*/ /*FIXME*/
free_name_val_list(&(w->host.resvals_to_sched), free_name_val_list(&(w->host.resvals_to_sched),
w->host.nresvals_to_sched); &(w->host.nresvals_to_sched));
#endif #endif
xlist_fini(&resvalist); xlist_fini(&resvalist);

2
src/include/utils.h
View file

@ -127,7 +127,7 @@ extern xce_timewindow_config_t* dup_timewindow_config(xce_timewindow_config_t*);
extern void free_resource_thresholds(xce_res_threshold_t**, int); extern void free_resource_thresholds(xce_res_threshold_t**, int);
extern xce_res_threshold_t** dup_resource_thresholds(xce_res_threshold_t**, extern xce_res_threshold_t** dup_resource_thresholds(xce_res_threshold_t**,
int); int);
extern void free_name_val_list(xce_name_val_t***, int); extern void free_name_val_list(xce_name_val_t***, int*);
extern void free_strlist(xce_strlist_t*); extern void free_strlist(xce_strlist_t*);
extern int fmt_jobid_ex(char*, size_t, uint64_t, char*, char*); extern int fmt_jobid_ex(char*, size_t, uint64_t, char*, char*);
extern int fmt_jobid(char*, size_t, uint64_t); extern int fmt_jobid(char*, size_t, uint64_t);

13
src/lib/utils.c
View file

@ -385,16 +385,14 @@ int copy_strlist(xce_strlist_t* dst, xce_strlist_t src)
} }
return 0; return 0;
} }
void free_name_val_list(xce_name_val_t*** vals, int count) void free_name_val_list(xce_name_val_t*** vals, int *count_p)
{ {
xce_name_val_t** resvals = *vals; xce_name_val_t** resvals = *vals;
int count = *count_p;
int i; int i;
if (resvals == NULL) { if (resvals == NULL || count <= 0) {
return; *count_p = 0;
}
if (count <= 0) {
return; return;
} }
@ -418,7 +416,8 @@ void free_name_val_list(xce_name_val_t*** vals, int count)
} }
FREEUP(resvals); FREEUP(resvals);
*vals = NULL; *vals = NULL;
*count_p = 0;
} }
void free_strlist(xce_strlist_t* l) void free_strlist(xce_strlist_t* l)