Your message dated Mon, 19 Oct 2026 22:49:26 +0000
with message-id <[email protected]>
and subject line Bug#1144337: fixed in slurm-wlm 26.05.5-1
has caused the Debian Bug report #1144337,
regarding slurm-wlm: slurmctld segfaults on "scontrol show assoc_mgr" when
assoc/qos cache is NULL
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144337: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144337
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: slurm-wlm
Version: 23.11.4-1.2
Severity: important
Tags: patch upstream
X-Debbugs-Cc: [email protected] <mailto:[email protected]>
Dear Maintainer,
slurmctld can be crashed (SIGSEGV) by a single "scontrol show assoc_mgr"
RPC whenever the association or QOS caches are NULL. This is the case
with AccountingStorageType=accounting_storage/none, and also during the
window after slurmctld has started but before it has connected to
slurmdbd. Any user able to reach the controller can trigger it, so it is
effectively a remotely-triggerable denial of service against the
controller (feel free to reclassify as grave/security if you agree).
I have verified the affected code by reading src/common/assoc_mgr.c on
every maintained upstream stable branch (22.05.11, 23.02.8, 23.11.11,
24.05.8, 24.11.7, 25.05.9, 25.11.8): all carry the same defect. Only the
upstream master branch (26.11) is fixed, via a large refactor
(commit 710f909b0c) that is too invasive to backport. A minimal,
targeted fix is attached below and is what I intend to forward upstream.
Steps to reproduce
------------------
1. Configure a controller with
AccountingStorageType=accounting_storage/none
(or start slurmctld while slurmdbd is unreachable).
2. Run: scontrol show assoc_mgr
3. slurmctld dies with SIGSEGV.
With no arguments, scontrol sets
req.flags = ASSOC_MGR_INFO_FLAG_ASSOC | ASSOC_MGR_INFO_FLAG_USERS |
ASSOC_MGR_INFO_FLAG_QOS (src/scontrol/info_assoc_mgr.c), so the
unguarded ASSOC path is always taken.
Backtrace (23.11, -DNDEBUG build)
---------------------------------
#0 __pthread_rwlock_wrlock (rwlock=0x30)
#2 list_iterator_create (l=0x30) at src/common/list.c
#3 assoc_mgr_info_get_pack_msg (...) at src/common/assoc_mgr.c:3614
#4 _slurm_rpc_assoc_mgr_info (...) at src/slurmctld/proc_req.c
#5 slurmctld_req (...) at src/slurmctld/proc_req.c
#6 _service_connection (...) at src/slurmctld/controller.c
Root cause
----------
assoc_mgr_assoc_list is NULL at init and only assigned a real list once
_get_assoc_mgr_assoc_list() succeeds (or via an assoc update RPC). In
assoc_mgr_info_get_pack_msg() the three sections are inconsistent:
ASSOC : if (!(flags & ASSOC_MGR_INFO_FLAG_ASSOC)) goto no_assocs;
-> no NULL check, then list_iterator_create(assoc_mgr_assoc_list)
QOS : if (!(flags & ASSOC_MGR_INFO_FLAG_QOS)) { ... }
-> no NULL check
USERS : if (!(flags & ASSOC_MGR_INFO_FLAG_USERS) || !assoc_mgr_user_list)
-> already guarded
In a release build, xassert(l != NULL) inside list_iterator_create() is
compiled out (xassert.h: "#ifdef NDEBUG #define xassert(expr) ((void)(0))"),
so control reaches slurm_rwlock_wrlock(&l->mutex) with l == NULL. The
mutex field is at offset 0x30 in struct xlist, which is exactly the
rwlock=0x30 fault address in the backtrace.
The fix simply extends the existing USERS-style NULL guard to the ASSOC
and QOS sections. When the list is NULL the section is packed empty,
which is the same behaviour the USERS path already has.
Patch
-----
The following also carries a DEP-3 header and can be dropped straight
into debian/patches/ (remember to add it to debian/patches/series). It
applies cleanly to the 23.11.4 source and, unchanged, to every other
affected stable branch.
--- BEGIN PATCH: fix-slurmctld-segfault-null-assoc-qos-list.patch ---
Description: Fix slurmctld SIGSEGV in assoc_mgr_info_get_pack_msg() on NULL
lists
assoc_mgr_info_get_pack_msg() unconditionally iterates the association
and QOS caches when the corresponding request flag is set, but those
global lists are NULL until slurmdbd data has been loaded (e.g. with
accounting_storage/none, or before slurmdbd is connected). In a release
build the xassert() in list_iterator_create() is compiled out, so a NULL
list leads to a write-lock on address 0x30 and a segfault. Any client
issuing "scontrol show assoc_mgr" can crash the controller.
.
The USERS section already guards against a NULL list; this extends the
same guard to the ASSOC and QOS sections, so an empty section is packed
instead of crashing.
Author: Shengqi Chen <[email protected]>
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=NNNNNN
Forwarded: no
Last-Update: 2026-08-14
--- a/src/common/assoc_mgr.c
+++ b/src/common/assoc_mgr.c
@@ -3608,7 +3608,7 @@
assoc_mgr_lock(&locks);
- if (!(flags & ASSOC_MGR_INFO_FLAG_ASSOC))
+ if (!(flags & ASSOC_MGR_INFO_FLAG_ASSOC) || !assoc_mgr_assoc_list)
goto no_assocs;
itr = list_iterator_create(assoc_mgr_assoc_list);
@@ -3687,7 +3687,7 @@
list_iterator_destroy(itr);
list_flush(ret_list);
- if (!(flags & ASSOC_MGR_INFO_FLAG_QOS)) {
+ if (!(flags & ASSOC_MGR_INFO_FLAG_QOS) || !assoc_mgr_qos_list) {
tmp_list = ret_list;
goto no_qos;
}
--- END PATCH ---
Affected versions
-----------------
Confirmed present in upstream stable branches 22.05, 23.02, 23.11,
24.05, 24.11, 25.05 and 25.11. Fixed in upstream master (26.11) by
commit 710f909b0c. The minimal patch above is suitable for all stable
branches and for the Debian package.
--
Thanks,
Shengqi Chen
--- End Message ---
--- Begin Message ---
Source: slurm-wlm
Source-Version: 26.05.5-1
Done: Gennaro Oliva <[email protected]>
We believe that the bug you reported is fixed in the latest version of
slurm-wlm, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Gennaro Oliva <[email protected]> (supplier of updated slurm-wlm package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 19 Oct 2026 20:59:06 +0200
Source: slurm-wlm
Architecture: source
Version: 26.05.5-1
Distribution: unstable
Urgency: medium
Maintainer: Debian HPC Team <[email protected]>
Changed-By: Gennaro Oliva <[email protected]>
Closes: 1144337 1149781
Changes:
slurm-wlm (26.05.5-1) unstable; urgency=medium
.
* New upstream release
* Add libllhttp-dev build dep
* Add libze-dev build dep for amd64
* Remove pmix (Closes: #1149781)
.
[ Shengqi Chen ]
* Fix assoc_mgr_info_get_pack_msg (Closes: #1144337)
.
[ Deepak Jain ]
* Use gpu nvml/rsmi/oneapi if .so exists
Checksums-Sha1:
da56348d9ae7cd1d9254db7884ca749604493c9f 5358 slurm-wlm_26.05.5-1.dsc
e305cd6b8587d31d8c9011a578032bdad5cdf689 9649037 slurm-wlm_26.05.5.orig.tar.gz
32b70f18e1dc79696d3344f1a6232b8dc8dbd09f 142956
slurm-wlm_26.05.5-1.debian.tar.xz
8d1a8c39779819f33827d608dc10922e78acb249 29978
slurm-wlm_26.05.5-1_amd64.buildinfo
Checksums-Sha256:
8f82a79c4f55d0366098d75167759a023bff1d4ade3a5c4ed43d32a2216c7657 5358
slurm-wlm_26.05.5-1.dsc
42cc1177e14db84a0f1407ed1e01f7d0e5e12a3cb1a12da3ce00d63e17021bb3 9649037
slurm-wlm_26.05.5.orig.tar.gz
a4142d22d614a818c02d6606fe02d40381a09e9853d6850a8b923114922e1213 142956
slurm-wlm_26.05.5-1.debian.tar.xz
7a994afa4f32f56d80f84a73d7b63a03e08aab06c4837b71e7a3186f7ad65588 29978
slurm-wlm_26.05.5-1_amd64.buildinfo
Files:
db044ee93b45de0795a64fd7942b5069 5358 admin optional slurm-wlm_26.05.5-1.dsc
5786d3c772eca479e441924599ea31c7 9649037 admin optional
slurm-wlm_26.05.5.orig.tar.gz
273bfb3f7f3d23b4a076600e23ad0e6d 142956 admin optional
slurm-wlm_26.05.5-1.debian.tar.xz
a0d6b68c7d8ec77be43476f3614ffba8 29978 admin optional
slurm-wlm_26.05.5-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEE6zNF9WRBuLgad5h2ffpBrZYZhdcFAmrWhncRHG9saXZhQGRl
Ymlhbi5vcmcACgkQffpBrZYZhddyGxAAiim8I6oiTZ0DtZO3Yntmbp3ez+APUMsd
YFnJ3lvTEsXbiRs625zzYTojnkRRP68ooNVubTGENYlR6+FA7MW9oen6fZqrX7KB
C/aS7mOzYULmzjajfH1D1snZ/xtF7KnVfwXS5RmC5sXS7AaBbMyCHWkQyvdACgsN
/HtOZWZ4anJMbvLJ96HnXkA+hy0x6E+L8386MzaL0D8L0ezhS3XELO//ErmTfV7e
qiIhNWgK6lK8OoJUrjq12kLaC+rF0YbtEmHrtH+B0vEZ/ManLIhp0uxl1zrlpB8Z
QbylQi1FYSZEmJkjrWC7kU6uyjkLhcXnOa97iwZ40okgAwjvhL6TF+JsBBVqKL2A
2UPj7dcbONycqYCLlJ6ZlQ7nIspg8WatP627aqpCEbFAOc+jdawUEnPAHzXkq1nk
xJm58nrJtXbqzL1kJN1xd27rzG4QSCZXMUeiGMxTsfmHUK3AW2PvjynYRMYyxGo2
F47U+10IcXw6jHPOebmQrirdkB/5BXRFQqJCNlwObLFsw6E/mpranhTCqaDiMA6w
VqpRyvpCeiRmjI9+3bGvNjQnjVfoklWxMvISac6VmQJXvisbHbtTZMpKD43prg3q
ztO40t/mcqrJM8muLRFiBi9fy+iHLZBSseiZBtfzzBORl7IAv1sLkmQKSqkDR7It
K1yu3NA4p/U=
=uQYE
-----END PGP SIGNATURE-----
pgpw6rtabRhz_.pgp
Description: PGP signature
--- End Message ---
