60 lines
2.9 KiB
Markdown
60 lines
2.9 KiB
Markdown
---
|
|
id: "bug-1866"
|
|
status: "fixed"
|
|
status_updated: "2026-09-27"
|
|
status_note: ""
|
|
component: "worker"
|
|
severity: "leak"
|
|
timestamp: "2026-09-25T15:42:02Z"
|
|
last_seen: "2026-09-25T15:42:02Z"
|
|
occurrences: 1
|
|
files: ["src/worker/src/xcecd_worker_utils.c"]
|
|
tags: ["worker", "leak", "asan"]
|
|
related: []
|
|
fix_commits: ["e84a8d43"]
|
|
gitea_issue: 285
|
|
gitea_synced_status: "fixed"
|
|
gitea_synced_hash: "fa33c9cef96e"
|
|
---
|
|
|
|
# bug-1866: xcecd_virtual leaks up to five strings per finished job (LeakSanitizer at exit)
|
|
|
|
## Description
|
|
**Observed:**
|
|
```
|
|
Direct leak of 12 byte(s) in 12 object(s) allocated from:
|
|
strndup add_worker (xcecd_worker_utils.c:140)
|
|
<- xcecd_process_command <- handle_message_from_queue
|
|
```
|
|
**Expected:** no leaks reported when xcecd_virtual exits.
|
|
**Impact:** one leaked string per job that carries a launch type, plus one per queue/job pre- or post-exec command; grows with the number of finished jobs for the life of the daemon.
|
|
**Found by:** LeakSanitizer at xcecd_virtual exit after a job burst run, 2026-09-25.
|
|
|
|
## Environment
|
|
- OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
|
|
- libc: glibc 2.42-47 (interpreter /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47/lib/ld-linux-x86-64.so.2)
|
|
- Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
|
|
- Build: asan (xce.build), leak detection on at process exit
|
|
- Code: scheduler-framework @ d87b78dc
|
|
- Deployment: xcecd_virtual worker; the burst run's cluster topology was not recorded
|
|
|
|
## Reproduction
|
|
1. Check out d87b78dc and add `test_remove_worker_frees_every_startinfo_copy` from e84a8d43 to `src/worker/testsuite/test_finished_job_retention.c`.
|
|
2. `/xce-build worker`
|
|
3. `ASAN_OPTIONS=detect_leaks=0 src/xce.build/worker/testsuite/finished_job_retention_test`
|
|
- Frequency: deterministic (58 bytes leaked per add/remove round trip)
|
|
- Evidence: the unit test; the original burst-run log was not kept.
|
|
|
|
## Root cause
|
|
add_worker() strndup()s launch_type, q_pre_exec, q_post_exec, job_pre_exec and job_post_exec out of the job's start info, but remove_worker() only freed exechome, execcwd, execuser, job_cmd, pids and job_exdata. LeakSanitizer reported only the launch_type copy because the burst's jobs had no pre/post-exec commands. Pre-existing, origin unknown. remove_worker() is the only place a worker entry is freed, so no other path is affected.
|
|
|
|
## Fix
|
|
remove_worker() also frees launch_type, q_pre_exec, q_post_exec, job_pre_exec and job_post_exec (src/worker/src/xcecd_worker_utils.c).
|
|
|
|
## Verification
|
|
- Test: test_remove_worker_frees_every_startinfo_copy in src/worker/testsuite/test_finished_job_retention.c compares ASAN's live-heap bytes across an add/remove round trip (the suite runs with detect_leaks=0): RED before the fix leaked 58 B, the five strings; GREEN after, 0 B
|
|
- Suites: worker 12/12, asan
|
|
- Live: n/a; the leak is in a pure unlink/free path the unit test covers completely
|
|
|
|
## References
|
|
- Gitea: #285
|