ExportXMLWordPrintableJSON

    • Type: Bug
    • Resolution: Fixed
    • Priority: Major - P3
    • 9.1.0-rc0, 8.3.16, 9.0.7, 8.0.37, 7.0.48
    • Affects Version/s: 8.3.9, 7.0.41, 8.0.30, 9.0.0-rc2
    • Component/s: None
    • None
    • Server Security
    • Fully Compatible
    • ALL
    • v9.0, v8.3, v8.0, v7.0
    • Server Security 2026-10-23
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Problem

      SERVER-130785 added a disconnect() call in LDAPRunnerImpl::getConnectionWithOptions after any failed bind:

      // Avoid reusing connections that failed to establish the intended identity.
      swConnection.getValue()->disconnect().ignore();
      

      If the bind timed out (ldapTimeoutMS), PooledLDAPConnection::runFuncWithTimeout has returned NetworkTimeout, but the bind is still running on an LDAPConnPool thread. WrappedConnection::disconnect() skips the timeout wrapper and hands the same LDAP* to the LDAPConnectionReaper, which calls ldap_unbind_ext_s while the bind is still using it.

      With a SASL GSSAPI bind (for example, ldapQueryUser bound with ldapBindMethod: sasl and ldapBindSaslMechanisms: GSSAPI) that is stuck talking to the KDC:

      1. The bind thread holds the Cyrus GSSAPI per-context mutex inside gss_init_sec_context.
      2. The reaper thread enters sasl_dispose, which takes Cyrus SASL's process-global free_mutex, then blocks on that context's mutex.
      3. Every other sasl_dispose in the process blocks on free_mutex. That includes ~CyrusGSSAPIServerMechanism at the end of every client GSSAPI authentication (AuthenticationSession::StepGuard::~StepGuard).

      Result: every GSSAPI client connection hangs right after authentication succeeds, until mongod is restarted.

      Before SERVER-130785, an LDAP connection was only torn down in ~OpenLDAPConnection. That can't run while runFuncWithTimeout still holds its anchor, so teardown always happened after the bind finished.

      Fix

      Remove the disconnect() call. It is not needed to prevent reuse:

      • WrappedConnection::bindAsUser already calls indicateFailure() on any failure, including a timeout, and ConnectionPool::SpecificPool::returnConnection never puts a connection with a failed status back in the pool.
      • Non-pooled connections are destroyed, and disconnected, when the unique_ptr goes out of scope.

      Backport to every branch that has SERVER-130785.

            Assignee:
            Ken Martin
            Reporter:
            Ken Martin
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: