---
id: "bug-1866"
status: "fixed"
status_updated: "2026-09-27"
status_note: ""
component: "worker"
severity: "leak"
timestamp: "2026-09-25T15:42:02Z"
last_seen: "2026-09-25T15:42:02Z"
occurrences: 1
files: ["src/worker/src/xcecd_worker_utils.c"]
tags: ["worker", "leak", "asan"]
related: []
fix_commits: ["e84a8d43"]
gitea_issue: 285
gitea_synced_status: "fixed"
gitea_synced_hash: "fa33c9cef96e"
---

# bug-1866: xcecd_virtual leaks up to five strings per finished job (LeakSanitizer at exit)

## Description
**Observed:**
```
Direct leak of 12 byte(s) in 12 object(s) allocated from:
    strndup  add_worker (xcecd_worker_utils.c:140)
    <- xcecd_process_command <- handle_message_from_queue
```
**Expected:** no leaks reported when xcecd_virtual exits.
**Impact:** one leaked string per job that carries a launch type, plus one per queue/job pre- or post-exec command; grows with the number of finished jobs for the life of the daemon.
**Found by:** LeakSanitizer at xcecd_virtual exit after a job burst run, 2026-09-25.

## Environment
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
- Build: asan (xce.build), leak detection on at process exit
- Code: scheduler-framework @ d87b78dc
- Deployment: xcecd_virtual worker; the burst run's cluster topology was not recorded

## Reproduction
1. Check out d87b78dc and add `test_remove_worker_frees_every_startinfo_copy` from e84a8d43 to `src/worker/testsuite/test_finished_job_retention.c`.
2. `/xce-build worker`
3. `ASAN_OPTIONS=detect_leaks=0 src/xce.build/worker/testsuite/finished_job_retention_test`
- Frequency: deterministic (58 bytes leaked per add/remove round trip)
- Evidence: the unit test; the original burst-run log was not kept.

## Root cause
add_worker() strndup()s launch_type, q_pre_exec, q_post_exec, job_pre_exec and job_post_exec out of the job's start info, but remove_worker() only freed exechome, execcwd, execuser, job_cmd, pids and job_exdata. LeakSanitizer reported only the launch_type copy because the burst's jobs had no pre/post-exec commands. Pre-existing, origin unknown. remove_worker() is the only place a worker entry is freed, so no other path is affected.

## Fix
remove_worker() also frees launch_type, q_pre_exec, q_post_exec, job_pre_exec and job_post_exec (src/worker/src/xcecd_worker_utils.c).

## Verification
- Test: test_remove_worker_frees_every_startinfo_copy in src/worker/testsuite/test_finished_job_retention.c compares ASAN's live-heap bytes across an add/remove round trip (the suite runs with detect_leaks=0): RED before the fix leaked 58 B, the five strings; GREEN after, 0 B
- Suites: worker 12/12, asan
- Live: n/a; the leak is in a pure unlink/free path the unit test covers completely

## References
- Gitea: #285