Problem
SERVER-130785 added a disconnect() call in LDAPRunnerImpl::getConnectionWithOptions after any failed bind:
// Avoid reusing connections that failed to establish the intended identity.
swConnection.getValue()->disconnect().ignore();
If the bind timed out (ldapTimeoutMS), PooledLDAPConnection::runFuncWithTimeout has returned NetworkTimeout, but the bind is still running on an LDAPConnPool thread. WrappedConnection::disconnect() skips the timeout wrapper and hands the same LDAP* to the LDAPConnectionReaper, which calls ldap_unbind_ext_s while the bind is still using it.
With a SASL GSSAPI bind (for example, ldapQueryUser bound with ldapBindMethod: sasl and ldapBindSaslMechanisms: GSSAPI) that is stuck talking to the KDC:
- The bind thread holds the Cyrus GSSAPI per-context mutex inside gss_init_sec_context.
- The reaper thread enters sasl_dispose, which takes Cyrus SASL's process-global free_mutex, then blocks on that context's mutex.
- Every other sasl_dispose in the process blocks on free_mutex. That includes ~CyrusGSSAPIServerMechanism at the end of every client GSSAPI authentication (AuthenticationSession::StepGuard::~StepGuard).
Result: every GSSAPI client connection hangs right after authentication succeeds, until mongod is restarted.
Before SERVER-130785, an LDAP connection was only torn down in ~OpenLDAPConnection. That can't run while runFuncWithTimeout still holds its anchor, so teardown always happened after the bind finished.
Fix
Remove the disconnect() call. It is not needed to prevent reuse:
- WrappedConnection::bindAsUser already calls indicateFailure() on any failure, including a timeout, and ConnectionPool::SpecificPool::returnConnection never puts a connection with a failed status back in the pool.
- Non-pooled connections are destroyed, and disconnected, when the unique_ptr goes out of scope.
Backport to every branch that has SERVER-130785.
- is related to
-
SERVER-137900 Suppress LSAN leak in system GSSAPI library on master
-
- In Code Review
-
-
SERVER-137981 Add LDAP tests for pooled bind timeouts and connection reuse
-
- In Code Review
-