I found a potential null pointer dereference in ReplIndexBuildState::tryAbort() in MongoDB 8.0.9:

In this method, the return value of target->getOperationContext() is passed to ServiceContext::killOperation() without a prior null check:

{{auto serviceContext = opCtx->getServiceContext();
if (auto target = serviceContext->getLockedClient(*_opId)) {
auto targetOpCtx = target->getOperationContext();
serviceContext->killOperation(target, targetOpCtx);
}}}

According to the documentation of Client::getOperationContext(), this method may return nullptr if there is no active operation context on the client:

"Gets the operation context active on this client, or nullptr if there is no such context."

Although the code checks whether getLockedClient() returns a valid client, it does not explicitly check whether that client has an active operation context.

If target->getOperationContext() returns nullptr, the null pointer is passed to ServiceContext::killOperation(), where it may be dereferenced without a prior check:

opCtx->markKilled(killCode);

This may lead to undefined behavior.

The return value of target->getOperationContext() should be checked before passing it to ServiceContext::killOperation().

A possible fix is:

{{if (auto target = serviceContext->getLockedClient(*_opId)) {
auto targetOpCtx = target->getOperationContext();
if (targetOpCtx)

{ serviceContext->killOperation(target, targetOpCtx); }

}}}

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Reporter: Grebennikov Aleksandr (grebennikov@bmstu.ru)