25.11.7 - #83
Open
itkovian wants to merge 7375 commits into
Open
Conversation
See merge request SchedMD/dev/slurm!3319
See merge request SchedMD/dev/slurm!3312
The sentence is incorrect in 2 ways. Typo: GPUS is mentioned twice. CPUs was probably meant in one of them. Also since we internally only respect (and more recently allow) gpu-socket affinity, checking gres.conf for gpu-cpu affinity is pointless and misleading. Ticket: 24883 Cherry-picked: 392afa9
See merge request SchedMD/dev/slurm!3330
See merge request SchedMD/dev/slurm!3334
Ticket: 24362 Cherry-picked: 6a52e16
See merge request SchedMD/dev/slurm!3335
get_uint(), get_uint16(), and get_uint64() use strtol() but only validate the result when the parsed value is 0, allowing any non-zero value with trailing characters to fail silently. This tightens the check to reject values where strtol() does not consume the entire string. Changelog: Fix sacctmgr silently ignoring trailing characters in numeric options. Ticket: 23842 Cherry-picked: 13a1d82
See merge request SchedMD/dev/slurm!3337
Changelog: Fix sbcast with auth/slurm when user doesn't exist on slurmctld. Ticket: 24381 Cherry-picked: 749e661
Ticket: 24381 Cherry-picked: 33a56f9
Ticket: 24381 Cherry-picked: e90900b
The cred plugin wasn't detecting that it was the stepd/stepmgr and wasn't loading the key. It failed when it tried to create the sbcast credential. auth/slurm and cred/slurm plugins use the same .so, so they get double init()'ed. So we need to detect that the stepd is the stepmgr after the first init(), auth_g_init(), and we need to be able to init() on the second init(), creg_g_init(), as a daemon. Changelog: Fix stepmgr crash with using sbcast with auth/slurm. Ticket: 24381 Cherry-picked: e3ca546
This call to init_internal() only needs to be called by srun, but was inadvertently being called as the stepmgr. This caused a memory leak when multiple steps were created in the slurmstepd step manager when auth/slurm was used. Changelog: Fix memory leak in stepmgr stepd. Ticket: 24381 Cherry-picked: 2bcd219
See merge request SchedMD/dev/slurm!3353
Ticket: 24808 Cherry-picked: 55fa304
Ticket: 24808 Cherry-picked: c27c9bc
Ticket: 24808 Cherry-picked: 263bd68
See merge request SchedMD/dev/slurm!3368
GANG can only be specified on the cluster wide PreemptMode slurm.conf option. Cherry-picked: 7333022
The PRIORITY flag was missing from these doc entries. Cherry-picked: bd07b0b
The WITHIN flag was missing from this doc entry. Cherry-picked: 550b77d
This removes the assertion that a QOS could not have PreemptMode=OFF if the global PreemptType was not preempt/none. The removed line seems to have been copy and pasted from the description of the global PreemptMode. For QOS having a PreemptMode=OFF means that it will default to using the global PreemptMode value. Also this swaps the reference for OFF with CLUSTER since sacctmgr only prints "cluster" in this case. Cherry-picked: a320de3
See merge request SchedMD/dev/slurm!3369
Changelog: Reject untrusted REQUEST_COMPLETE_PROLOG. Cherry-picked: 0187dc0
Ticket: 24926 Cherry-picked: 9b0b67c
Replace magic number 64 with a named constant. Ticket: 24926 Cherry-picked: 4a1ed8a
Ticket: 24926 Cherry-picked: 01151b4
Changelog: Fix sbcast shared objects skipping credential verification. CVE-2026-65107.
Changelog: Fix possible slurmd crash on invalid sbcast filenames. CVE-2026-65107.
The replay tolerance that shared object transfers need was applied to every sbcast credential. The executable is always the first decode of a given credential and is never replayed, so pass the flag down from unpack_sbcast_cred() and leave that path strict.
spank_clear_remote_options_env() copied the variable name into a fixed 1024 byte stack buffer with an unbounded memcpy(), so an oversized SPANK option variable in the job environment smashed the stack while running as root. Use xstrndup() instead. Changelog: Fix a slurmstepd stack overflow when a job environment contains an oversized SPANK option variable. CVE-2026-65108.
_cleanup_container() removed the spool contents with path based unlink() and rmdir() as root, but the job user owns the directory components, so swapping a task directory for a symlink made root delete the target's config.json and environment. Descend from the configured spool directory with O_NOFOLLOW and remove relative to those handles. Changelog: Fix slurmstepd removing files outside the container spool directory when cleaning up an OCI container. CVE-2026-65109.
_generate_spooldir() trims the pattern at the first taskid component, so with a %t in ContainerPath the step spool dir ends in a '/' and its basename is empty, and the task dirs sit several components below it rather than directly beneath. Strip the trailing separators and walk the intervening components with O_NOFOLLOW. Changelog: Fix slurmstepd leaving OCI container spool directories behind when ContainerPath contains a task id pattern. CVE-2026-65109.
msg->len was unpacked independently of the data buffer's actual length, letting a crafted RPC over-read in _rpc_forward_data()'s safe_write(). Reject mismatched lengths. Changelog: Fix heap over-read when unpacking a malformed forward data RPC in slurmd. CVE-2026-65138.
_unpack_forward_data_msg() accepted a missing address, which unpacks to NULL and reaches strlen() in _connect_as_other(), crashing slurmd. Reject it at unpack instead. Changelog: Fix a slurmd crash when handling a malformed forward data RPC with a missing socket address. CVE-2026-65138.
Cluster names are interpolated into table identifiers, not just quoted values, and identifier quoting can't be backslash-escaped, so escaping can't neutralize them. Reject names with SQL-unsafe characters instead. Changelog: Reject cluster names containing characters that are unsafe to use in an accounting database query. CVE-2026-65139.
as_mysql_validate_cluster_list() only covered the cond fields, leaving the usage queries and the add and runaway job paths to interpolate a caller supplied name straight into a table identifier. Add a single name validator and call it there. Changelog: Reject unsafe cluster names on the accounting usage, add and runaway job paths. CVE-2026-65139.
The cluster name is taken off the persistent connection init message without any check and is used unquoted to build table names throughout the plugin, so validating the condition structures alone still leaves it reachable. Check it once when the connection is set up and refuse the connection outright. Changelog: Reject unsafe cluster names when opening a connection to the slurmdbd. CVE-2026-65139.
The numeric id lists reaching the mysql plugin are spliced into SQL, some unquoted, so a non-numeric entry could inject. Validate each list as it is unpacked rather than in every handler. The qos entries carry a leading +, - or = from the add, subtract and set syntax, so the qos check permits those operators. Changelog: Reject non-numeric id values in accounting database queries. CVE-2026-65139.
Changelog: Fix a privilege escalation where an operator could alter Administrator accounts through the accounting database. CVE-2026-65140.
pack_assoc_rec, pack_assoc_rec_with_usage and pack_event_cond put names in qos_list and reason_uid_list, which are now validated as numeric on unpack. Use numeric values so the round trip tests pass.
An arbitrary step whose node list matched the job's req_nodes, or that requested all nodes, skipped the node list check. Its node count then came from the request while its task layout came from the list, leaving step_layout->node_cnt disagreeing with the step's node bitmap. Take the count from the list in both cases. Pin max_nodes to that same count as well. Without it the later cpu_count block can raise min_nodes above the list's node count and the node top-up loops then extend the step past the nodes the list names, which is how the two counts came apart. Changelog: Fix node count of a job step using arbitrary distribution. CVE-2026-65165.
Reject one containing a hostlist function ('{').
An arbitrary step node list must be a literal list of node names.
Changelog: Reject a hostlist function in the node list of a job step
using arbitrary distribution. CVE-2026-65165.
Changelog: Reject a job step whose arbitrary node list disagrees with its node count. CVE-2026-65165.
See merge request nvidia/schedmd/slurm/slurm!4318
Cherry-picked: 6f570cb7c4
Cherry-picked: 0883bcf
Update slurm.spec and debian/changelog as well.
Update slurm.spec and debian/changelog as well.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.