Use after free possible with memory tracking and two cursors

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Fixed
    • Priority: Major - P3
    • 8.3.9, 9.0.0-rc2
    • Affects Version/s: None
    • Component/s: None
    • None
    • Query Integration
    • Fully Compatible
    • ALL
    • v9.0, v8.3
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      It's possible for an exchange query to crash the server with a use after free due to how we manage memory trackers.

      The issue can happen with an Exchange pipeline that uses UnionWith which itself contains a memory tracking stage like setWindowFields. If a consumer other than consumer-0 wins the race to be the first to the first getMore(), then that consumer will be the first one to lazily construct the UnionWith subpipeline. That consumer will end up creating an OperationMemoryUsageTracker that's not created in the normal way. It gets stashed on the client cursor, and when that cursor dies, the memory tracker for the setWindowFields will have a dangling pointer. When other consumers execute the exchange pipeline, there will be a use after free.

            Assignee:
            Erin Zhu
            Reporter:
            Chris Wolff
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: