wdgzyjx/myxce
1
0
Fork 0
forked from lei.chen/myxce
Code Pull requests Activity

fix(controller,worker): sched worker resval UAF + execuser fallback to nobody

Browse source 
bug-1506 (controller): sched_worker_change pointed w->host.resvals_to_sched
at resvalist.data, then xlist_fini freed it — a concurrent reader (the
WORKER_JOIN hook encoding the worker's resvals) hit an ASAN
heap-use-after-free that crashed the controller and failed every job. Take
ownership of the resval data via MOVE_PTR (mirrors collect_resvals_workers);
the prior array is intentionally leaked (freeing it races the same readers).

bug-1507 (worker): the apiserver's bug-1500 execuser fix sent the submit
user ("admin") as execuser, but that user does not exist in the worker
host's /etc/passwd. systemd failed the worker unit with EXIT_USER (217),
so every job died immediately after submit. job_start_local_task now
checks the execuser with getpwnam() and falls back to "nobody" when the
user does not exist.

Verified with a full job lifecycle (submit -> RUN as nobody -> DONE) on
the clean build: all 4 daemons healthy, zero ASAN.

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
lei.chen 2026-08-05 03:40:09 +00:00
parent c630809116
commit c091a8dae0
4 changed files with 95 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

19
src/controller/sched.c
View file

@ -4,6 +4,7 @@
#include "cluster.h"
#include "controller.capnp.h"
#include "request.h"
#include "utils.h" /* MOVE_PTR (bug-1506) */
#include "worker.h"
#include "xce/cluster_def.h"
#include "xce/types.h"
@ -500,8 +501,22 @@ static int sched_worker_change(int type, int situation, void* data,
xlist_init(&resvalist, 256);
collect_resval(c->resmgr, &(w->host.resvals), &resvalist);
w->host.nresvals_to_sched = resvalist.count;
w->host.resvals_to_sched = (xce_name_val_t**)resvalist.data;
{
/* bug-1506: take OWNERSHIP of resvalist.data so the xlist_fini
* below does not free the array w->host.resvals_to_sched aliases.
* The old code pointed resvals_to_sched at resvalist.data, then
* xlist_fini(&resvalist) freed it — a concurrent reader (the
* WORKER_JOIN hook encoding the worker's resvals, via
* encode_NameValue_list) read the dangling pointer → ASAN
* heap-use-after-free that crashed the controller. The prior
* resvals_to_sched (if any) is intentionally left allocated: freeing
* it here would race the same readers (the old #if 0
* free_name_val_list block was disabled for this reason). */
void* p = NULL;
MOVE_PTR(p, resvalist.data);
w->host.nresvals_to_sched = resvalist.count;
w->host.resvals_to_sched = (xce_name_val_t**)p;
}
mylock_lock(&(c->sched.lock));
if (c->sched.ep != NULL) {