Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-29517

Data race with ViewGraph::_idCounter can corrupt the in-memory ViewGraph

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Critical - P2
    • Resolution: Fixed
    • 3.4.4
    • 3.4.5, 3.5.9
    • Querying
    • Fully Compatible
    • ALL
    • v3.4
    • Query 2017-06-19
    • 0

    Description

      The ViewGraph is an in-memory directed acyclic graph data structure in which nodes represent view definitions and edges represent "view-on" relationships. This structure assigns unique unsigned 64 bit numbers to each node in the graph, using ViewGraph::_idCounter:

      https://github.com/mongodb/mongo/blob/6f7fd7318d61bd145bb75a9a0a5d35387d2a6b9f/src/mongo/db/views/view_graph.h#L182

      The intention is that concurrent access to this counter is prevented by the ViewCatalog's mutex. However, the _idCounter is a static data member. There is a ViewCatalog per database, each owning and synchronizing access to a separate ViewGraph instance. Since the _idCounter is static, all ViewGraph instances share the same counter! This means that the various ViewGraphs can all access the counter simultaneously. This leads to the assignment of invalid node ids, which in turn corrupts the in-memory graph. We have seen this manifest as a process-fatal invariant failure, or as an unexpected failed view catalog operation (e.g. a view drop, modify, or create).

      Attachments

        Activity

          People

            david.storch@mongodb.com David Storch
            david.storch@mongodb.com David Storch
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: