Details
-
Bug
-
Resolution: Fixed
-
Major - P3
-
None
-
Fully Compatible
-
ALL
-
v4.4, v4.2
-
Service arch 2020-04-20
-
23
Description
The replica set change notifier makes a copy of _listeners under a lock, but then invokes onConfirmedSet on those listeners outside the lock. During shutdown, those pointers can be dead, which can cause us to use after free and crash.
See replica_set_change_notifier.cpp#L116-L120
auto listeners = _listeners;
|
lk.unlock();
|
|
|
for (auto listener : listeners) { |
listener->onConfirmedSet(state);
|
};
|