Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-3208

unsafe usage of namespace details transient on yield in update.cpp

    • Type: Icon: Bug Bug
    • Resolution: Done
    • Priority: Icon: Major - P3 Major - P3
    • 1.9.2
    • Affects Version/s: 1.8.1
    • Component/s: None
    • Labels:
      None
    • ALL

      /* idea with these here it to make them loop invariant for multi updates, and thus be a bit faster for that case */
      /* NOTE: when yield() is added herein, these must be refreshed after each call to yield! */
      NamespaceDetails *d = nsdetails(ns); // can be null if an upsert...
      NamespaceDetailsTransient *nsdt = &NamespaceDetailsTransient::get_w(ns);
      /* end note */

      If we yield and if, for example, somebody calls NamespaceDetailsTransient::clearForPrefix() on a collection with a name that is a prefix of our collection's name, I think nsdt can point to freed memory even though we recover successfully from the yield.

            Assignee:
            aaron Aaron Staple
            Reporter:
            aaron Aaron Staple
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Created:
              Updated:
              Resolved: