In src/mongo/db/operation_killer.cpp, OperationKiller::killOperation()
retrieves an OperationContext pointer from the target client and
dereferences it without null check:

    auto opCtx = target->getOperationContext();
    if (opCtx->isKillOpsExempt()) {
        LOGV2_DEBUG(11227300, 3, "Not killing exempt op", "opId"_attr = opId);
        return;
    }

    serviceContext->killOperation(target, opCtx, killCode);

In definition Client::getOperationContext() is documented to return nullptr
when the client has no active OperationContext:

    /**
     * Gets the operation context active on this client, or nullptr if there is no such context.
     *
     * It is an error to call this method on an unlocked client, or to use the value returned
     * by this method while the client is not locked.
     */
    OperationContext* getOperationContext() {
        return _opCtx;
    }

Because of that, it is not obvious from this call site whether the
pointer is guaranteed to be non-null after getLockedClient(opId).
If such guarantee does not strictly hold, this code may dereference
a null pointer.

Please confirm whether getLockedClient(opId) guarantees that the returned
locked client always has a valid active OperationContext. If so, an
invariant/assertion here may make the contract clearer. Otherwise, this
code path may need a null check or different handling.

Found Linux Verification Center ( linuxtesting.org ) with SVACE
Reporter: Grebennikov Aleksandr (grebennikovas@bmstu.ru)