chore(buglog): bug-1884 fixed; log bug-1885 (decision leak), bug-1886 (queue/config leak), bug-1887 (resreq parse errors ignored)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-09-29 09:49:59 +00:00

2.7 KiB

Raw Blame History

status

status_updated

status_note

component

severity

timestamp

last_seen

occurrences

files

bug-1886: scheduler leaks the rejected queue on each config re-apply and the old config on each CONFIG_PUSH

Description

Observed: (code reading)

sched_init_queues() (src/scheduler/src/scheduler.c) builds a new xce_sched_queue_t for every configured queue on each config apply and sched_add_queue()s it; for an existing name the add fails and the new queue (with its interned name/resreq) is still handed to the picker but owned by nothing.
CONFIG_PUSH (core_events.c) sets core->config = config without freeing the previous config.

Expected: re-applied queues update the existing queue in place (as core_upsert_queue() does for QUEUE_UPDATE), and a replaced config is freed once nothing points into it. Impact: leak per config push/re-apply (one queue per configured queue plus one whole xce_conf4sched_t). Freeing the old config needs care: the picker and limit plugin may keep pointers into it. The queue table's datakiller must stay a no-op for as long as sched_init_queues() keeps using a rejected queue (bug-1884 found a use-after-free when it freed). Found by: review (while fixing bug-1884, 2026-09-29)

Environment

OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
Build: asan (src/xce.build.discrete)
Code: scheduler-framework @ 90b99d91-dirty
Deployment: n/a (found by code reading while fixing bug-1884; not observed on a deployment)

Reproduction

Read sched_init_queues() in src/scheduler/src/scheduler.c and the XCE_CORE_EVENT_CONFIG_PUSH case in src/scheduler/src/core_events.c.
Test-level check: test_config_push_deferred.c applies a config twice; with a freeing queue killer ASAN reports a heap-use-after-free in builtin_fcfs_on_queue_update (seen 2026-09-29 while fixing bug-1884).

Frequency: deterministic on every config re-apply
Evidence: not kept; code reading plus the test_config_push_deferred UAF seen with a freeing killer

Root cause

TODO: required for fixed/partial

Fix