Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-27996

Accessing system.namespaces cursor with pending data after removing namespaces may cause crash

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major - P3
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 3.0.15, 3.2.13, 3.4.3, 3.5.4
    • Component/s: MMAPv1
    • Labels:
      None
    • Backwards Compatibility:
      Fully Compatible
    • Operating System:
      ALL
    • Backport Requested:
      v3.4, v3.2, v3.0
    • Steps To Reproduce:
      Hide

      use system_namespaces_invalidations;
      let dbName = 'system_namespaces_invalidations';
      let num_collections = 3;
      for (let i = 0; i < num_collections; i++) {
          assert.commandWorked(db.createCollection('coll' + i.toString()));
      }
      let cmd = db.system.namespaces.count() ? {find: 'system.namespaces'} : {listCollections: dbName};
      Object.extend(cmd, {batchSize: 2});
      let res = db.runCommand(cmd);
      assert.commandWorked(res, 'could not run ' + tojson(cmd));
      let cursor = new DBCommandCursor(db.getMongo(), res);
      let errMsg = 'expected more data from command ' + tojson(cmd) + ', with result ' + tojson(res);
      assert(cursor.hasNext(), errMsg);
      for (let j = 0; j < num_collections; j++) {
          assert(db['coll' + j.toString()].drop());
      }
      assert.gt(cursor.itcount(), 0, errMsg);
      

      Show
      use system_namespaces_invalidations; let dbName = 'system_namespaces_invalidations' ; let num_collections = 3; for (let i = 0; i < num_collections; i++) { assert.commandWorked(db.createCollection( 'coll' + i.toString())); } let cmd = db.system.namespaces.count() ? {find: 'system.namespaces' } : {listCollections: dbName}; Object.extend(cmd, {batchSize: 2}); let res = db.runCommand(cmd); assert.commandWorked(res, 'could not run ' + tojson(cmd)); let cursor = new DBCommandCursor(db.getMongo(), res); let errMsg = 'expected more data from command ' + tojson(cmd) + ', with result ' + tojson(res); assert(cursor.hasNext(), errMsg); for (let j = 0; j < num_collections; j++) { assert(db[ 'coll' + j.toString()].drop()); } assert.gt(cursor.itcount(), 0, errMsg);

      Description

      Another instance of SERVER-27199, we do not invalidate the namespace record ID upon removing a namespace. Executing the steps to reproduce thus may cause a crash.

        Attachments

          Issue Links

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: