42 lines
2.7 KiB
Markdown
42 lines
2.7 KiB
Markdown
---
|
|
id: "bug-1862"
|
|
status: "fixed"
|
|
status_updated: "2026-09-25"
|
|
status_note: "c29518b2"
|
|
component: "worker"
|
|
severity: "crash"
|
|
timestamp: "2026-09-24T15:24:57Z"
|
|
last_seen: "2026-09-24T15:24:57Z"
|
|
occurrences: 1
|
|
files: ["src/worker/src/xcecd_resync.c", "src/worker/src/xcecd_worker_utils.c", "src/worker/src/controller_connector.c", "src/worker/src/main.c"]
|
|
tags: ["worker", "asan", "race", "use-after-free", "resync", "ha"]
|
|
related: []
|
|
fix_commits: ["c29518b2"]
|
|
legacy: true
|
|
gitea_issue: 281
|
|
gitea_synced_status: "fixed"
|
|
gitea_synced_hash: "91d19796eef1"
|
|
---
|
|
|
|
# bug-1862: xcecd_virtual ASAN heap-use-after-free in find_worker_by_jobid (xcecd_worker_utils.c:702) <…
|
|
|
|
## Description
|
|
xcecd_virtual ASAN heap-use-after-free in find_worker_by_jobid (xcecd_worker_utils.c:702) <- xcecd_resync_classify_job (xcecd_resync.c:33) <- xcecd_resync_build_report <- handle_jobstatequery (controller_connector.c:1662) on a vtask thread; freed by remove_worker (xcecd_worker_utils.c:283) <- cleanup_worker_list <- main loop (main.c:652). Worker aborted mid chaotic HA soak (2026-09-24, run 1 of 3), so later rounds lost worker-resync coverage.
|
|
|
|
## Environment
|
|
_Not recorded (migrated from buglog.json)._
|
|
|
|
## Reproduction
|
|
_Not recorded (migrated from buglog.json)._
|
|
|
|
## Root cause
|
|
The worker's live job list is mutated by the main loop (add_worker / cleanup_worker_list -> remove_worker) with no lock, while the controller's OPCode_jobStateQuery is answered on a vtask thread (myreq_handler) that walks the same list. Any rejoin resync overlapping a job reap reads a freed node.
|
|
|
|
## Fix
|
|
UPDATE (2026-09-25): Fix (uncommitted): xcecd_worker_utils.c gains a worker-list mutex (xcecd_worker_list_lock/unlock). add_worker takes it around linking a fully-built entry; remove_worker unlinks under it and frees after. Readers on vtask threads: handle_jobstatequery holds it from reading the list head through the whole query page (report build walks the list several times; the send is a non-blocking xce_request); the job-control handler copies job_status under it and re-finds the entry under it to set killed_signal; remote task start strdup's the five fields it sends under it and frees them after xcecli_runtask. The finished-job retention store (appended by the main loop, read by resync) gets its own internal mutex via public wrappers around *_locked_ bodies. Main-thread-only traversals (uv_ipc.c find_worker_by_pid, cleanup/update) need no lock. Test: test_xcecd_resync.c test_build_report_safe_against_concurrent_list_mutation (mutator thread add/remove/retain vs 20000 locked report builds) -- heap-use-after-free in find_worker_by_jobid 3/3 with no-op lock stubs, clean 5/5 with the fix; worker suite 10/10.
|
|
|
|
## Verification
|
|
_Not recorded (migrated from buglog.json)._
|
|
|
|
## References
|
|
- Gitea: #281
|