fix: guard NULL part_ptr and license_list in slurmctld#202
Conversation
node_mgr_make_node_blocked dereferences job_ptr->part_ptr when calling topology_g_whole_topo, but the IS_JOB_WHOLE_TOPO macro can return true via (details->whole_node & WHOLE_TOPO) when part_ptr is still NULL. This segfaults slurmctld. Add an early return when part_ptr is NULL. _valid_license_job_expansion passes license_list directly to list_find_first_ro, which xasserts on NULL. Debug builds abort and production builds (where xassert is compiled out) dereference NULL inside the lock path. Check license_list before each call.
|
Hello, Thank you for submitting this patch set. It does look like you are fixing two separate bugs in one commit. Could you please separate these fixes into their own commits? Please see the patch submission guidelines here: Additionally, Slurm uses clang-format and pre-commit to automatically manage the coding style. Could you please reformat your commits to match our coding style? Also it is preferred that commit message lines are wrapped at 76 characters. The style guidelines can be found here: Lastly, your commits need to be sign off before they can be accepted. Please see the developer certification of origin guidelines here: Regards, |
Summary
Two NULL-pointer crashes in
slurmctldalong the job-expansion path. Both are reachable on stock Slurm 25.11 withoutexotic configuration: a job submitted with
--exclusive=topo, or any caller that passes a job record whoselicense_listwas never allocated (jobs that never requested a license).Bug 1: NULL
part_ptrderef innode_mgr_make_node_blockedFile:
src/slurmctld/node_mgr.cThe function gates its work behind
IS_JOB_WHOLE_TOPO(job_ptr)and ajob_resrcsnull check, then unconditionallydereferences
job_ptr->part_ptr->topology_idx:The
IS_JOB_WHOLE_TOPOmacro (defined insrc/common/job_record.h) is:The first disjunct returns true based purely on
details->whole_node, with no check onpart_ptr. So a job withWHOLE_TOPOset on its details but no partition pointer attached passes the macro and segfaults on the following line.WHOLE_TOPOis set by_job_createwhen the request specifiesshared = JOB_SHARED_TOPO(i.e.--exclusive=topo).Fix
Add an early return when
part_ptris NULL, after the existing guards:Bug 2: NULL
license_listderef in_valid_license_job_expansionFile:
src/slurmctld/job_mgr.clist_find_first_ro(src/common/list.c) calls_list_find_first_lock, which begins withxassert(l != NULL). Indebug builds this aborts the controller. In production builds
xassertis compiled out and execution continues intoLIST_THREAD_LOCK(l, ...), which dereferences the NULL list pointer.Either job record can have a NULL
license_list(jobs that never requested a license), so the call site must guard.Fix
Check
license_listbefore each call:Reproducer
Both bugs surface during the
select_p_job_expandpath:scontrol update job_id=N nodelist=...).--exclusive=topoand reachesnode_mgr_make_node_blockedbeforepart_ptris wired up.xassert.