77 lines
3.2 KiB
Markdown
77 lines
3.2 KiB
Markdown
---
|
|
id: "bug-1956"
|
|
status: "cannot-reproduce"
|
|
status_updated: "2026-10-10"
|
|
status_note: "no NULL path from the wire; the explicit NULL branch in job_start_local_task is unreachable through decoding"
|
|
component: "worker"
|
|
severity: "crash"
|
|
timestamp: "2026-10-10T08:46:13Z"
|
|
last_seen: "2026-10-10T08:46:13Z"
|
|
occurrences: 1
|
|
files: ["src/worker/src/controller_connector.c"]
|
|
tags: ["worker", "crash", "launch-type"]
|
|
related: []
|
|
repro_attempts: "decoder analysis 2026-10-10: empty launchType decodes to \"\" (capn_val0 default + strdup), never NULL"
|
|
gitea_issue: 387
|
|
gitea_synced_status: "cannot-reproduce"
|
|
gitea_synced_hash: "46653c4397e0"
|
|
---
|
|
|
|
# bug-1956: xcecd compares a NULL launch_type with strcmp when a job has no launch type (possible crash)
|
|
|
|
## Description
|
|
**Observed:** (source reading, 2026-10-10; suspected, not reproduced)
|
|
`job_start_local_task()` stores NULL when the start info has no launch type
|
|
and then dereferences it:
|
|
```c
|
|
if (d->start_info->launch_type) {
|
|
job_ctx->startinfo->launch_type = strdup(...);
|
|
} else {
|
|
job_ctx->startinfo->launch_type = NULL; /* :981-985 */
|
|
}
|
|
...
|
|
if (strcmp(job_ctx->startinfo->launch_type, "openmpi") == 0 /* :994 */
|
|
```
|
|
`job_start_remote_task()` does the same without a check (`:753`). The apiserver
|
|
sends no launch type when the user gives none (`cStringOrNil`,
|
|
`backend/convert.go:339`). Jobs without a launch type do run in existing
|
|
tests, so the decoder may deliver an empty string rather than NULL: not
|
|
confirmed either way.
|
|
|
|
**Expected:** a missing launch type means a plain (non-MPI) job; no NULL
|
|
dereference.
|
|
**Impact:** possible worker crash at job start for jobs without a launch
|
|
type.
|
|
**Found by:** review of the bug-1940/1942 fixes, 2026-10-10.
|
|
|
|
UPDATE (2026-10-10): Not confirmed: the generated decoder reads launchType with capn_get_text(..., capn_val0) whose default is {0,"",0} and then STRING_DUPs (strdup) it (src/xce.build/lib/controller.capnp.c:6398), so a job start without a launch type reaches the worker as "" (non-NULL); strcmp at controller_connector.c:753/994 is safe. job_start_local_task's explicit NULL assignment (:985) is only reachable if start_info->launch_type is NULL, which decoding never produces.
|
|
|
|
## Environment
|
|
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
|
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
|
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
|
- Build: asan (xce.build)
|
|
- Code: scheduler-framework @ 8568c8ab-dirty
|
|
- Deployment: real `xcecd` worker (systemd/dbus); multi-host for the remote-task case
|
|
|
|
## Reproduction
|
|
1. Decode a job start message whose start info has no launch type and run
|
|
`job_start_local_task()` (worker unit test), or submit a job without a
|
|
launch type through libxce/harness to a real `xcecd`.
|
|
2. Check whether `startinfo->launch_type` is NULL at `:994`.
|
|
- Frequency: deterministic by code reading (not yet run)
|
|
- Evidence: the code quoted in Description; no logs kept.
|
|
|
|
## Root cause
|
|
TODO: required for fixed/partial
|
|
|
|
## Fix
|
|
TODO: required for fixed/partial
|
|
|
|
## Verification
|
|
- Test: TODO: name + file; RED before the fix, GREEN after
|
|
- Suites: TODO: suite results and build profile
|
|
- Live: TODO: soak/deploy run, or n/a and why
|
|
|
|
## References
|
|
- Related: none
|