---
id: "bug-1862"
status: "fixed"
status_updated: "2026-09-25"
status_note: "c29518b2"
component: "worker"
severity: "crash"
timestamp: "2026-09-24T15:24:57Z"
last_seen: "2026-09-24T15:24:57Z"
occurrences: 1
files: ["src/worker/src/xcecd_resync.c", "src/worker/src/xcecd_worker_utils.c", "src/worker/src/controller_connector.c", "src/worker/src/main.c"]
tags: ["worker", "asan", "race", "use-after-free", "resync", "ha"]
related: []
fix_commits: ["c29518b2"]
legacy: true
gitea_issue: 281
gitea_synced_status: "fixed"
gitea_synced_hash: "91d19796eef1"
---

# bug-1862: xcecd_virtual ASAN heap-use-after-free in find_worker_by_jobid (xcecd_worker_utils.c:702) <…

## Description
xcecd_virtual ASAN heap-use-after-free in find_worker_by_jobid (xcecd_worker_utils.c:702) <- xcecd_resync_classify_job (xcecd_resync.c:33) <- xcecd_resync_build_report <- handle_jobstatequery (controller_connector.c:1662) on a vtask thread; freed by remove_worker (xcecd_worker_utils.c:283) <- cleanup_worker_list <- main loop (main.c:652). Worker aborted mid chaotic HA soak (2026-09-24, run 1 of 3), so later rounds lost worker-resync coverage.

## Environment
_Not recorded (migrated from buglog.json)._

## Reproduction
_Not recorded (migrated from buglog.json)._

## Root cause
The worker's live job list is mutated by the main loop (add_worker / cleanup_worker_list -> remove_worker) with no lock, while the controller's OPCode_jobStateQuery is answered on a vtask thread (myreq_handler) that walks the same list. Any rejoin resync overlapping a job reap reads a freed node.

## Fix
UPDATE (2026-09-25): Fix (uncommitted): xcecd_worker_utils.c gains a worker-list mutex (xcecd_worker_list_lock/unlock). add_worker takes it around linking a fully-built entry; remove_worker unlinks under it and frees after. Readers on vtask threads: handle_jobstatequery holds it from reading the list head through the whole query page (report build walks the list several times; the send is a non-blocking xce_request); the job-control handler copies job_status under it and re-finds the entry under it to set killed_signal; remote task start strdup's the five fields it sends under it and frees them after xcecli_runtask. The finished-job retention store (appended by the main loop, read by resync) gets its own internal mutex via public wrappers around *_locked_ bodies. Main-thread-only traversals (uv_ipc.c find_worker_by_pid, cleanup/update) need no lock. Test: test_xcecd_resync.c test_build_report_safe_against_concurrent_list_mutation (mutator thread add/remove/retain vs 20000 locked report builds) -- heap-use-after-free in find_worker_by_jobid 3/3 with no-op lock stubs, clean 5/5 with the fix; worker suite 10/10.

## Verification
_Not recorded (migrated from buglog.json)._

## References
- Gitea: #281