Description
The SecureRandom object held by the singleton instance of CmdGetNonce is accessed in an unsychronized manner by every thread processing a getnonce command on behalf of a connection. SecureRandom is not internally synchronized. It may only be used by one thread at a time. The result is that under sufficient offered load of getnonce commands, eventually two will access the SecureRandom object concurrently, with undefined resultant behavior. One of the resultant behaviors is a segfault, on some systems.
(Original description below)
I tested this on 2.2.2 and it did not crash mongod.
Script is attached. Let me know if you need help building (go app).
In a nutshell, this script is opening and closing connections rapidly in a lot of different threads (goroutines).
Mon Mar 18 11:28:50.628 [initandlisten] connection accepted from 127.0.0.1:60649 #1428 (100 connections now open)
|
Mon Mar 18 11:28:50.637 Invalid access at address: 0x101fffff8 from thread: conn1417
|
Mon Mar 18 11:28:50.637
|
Mon Mar 18 11:28:50.637 Invalid access at address: 0x101fffff8 from thread: conn1418
|
Mon Mar 18 11:28:50.637 Mon Mar 18 11:28:50.637 Invalid access at address: 0x101fffff8 from thread: conn1419
|
Mon Mar 18 11:28:50.637 Mon Mar 18 11:28:50.637
|
Invalid access at address: 0x101fffff8 from thread: conn1345
|
Got signal: 11 (Segmentation fault: 11).
|
|
|
Invalid access at address: 0x101fffff8 from thread: conn1421
|
Invalid access at address: 0x101fffff8 from thread: conn1422
|
Mon Mar 18 11:28:50.637
|
|
|
Mon Mar 18 11:28:50.637
|
|
|
Got signal: 11 (Segmentation fault: 11).
|
Mon Mar 18 11:28:50.637 Got signal: 11 (Segmentation fault: 11).
|
Mon Mar 18 11:28:50.637
|
Mon Mar 18 11:28:50.637 Got signal: 11 (Segmentation fault: 11).
|
|
|
Got signal: 11 (Segmentation fault: 11).
|
Got signal: 11 (Segmentation fault: 11).
|
This is on OSX.
I have a standalone go script that caused this (attached).
Mon Mar 18 11:28:50.638 Mon Mar 18 11:28:50.638 Invalid access at address: 0x101fffff8 from thread: conn1423
|
Invalid access at address: 0x101fffff8 from thread: conn1424
|
Mon Mar 18 11:28:50.638 Mon Mar 18 11:28:50.638
|
Mon Mar 18 11:28:50.638
|
Invalid access at address: 0x101fffff8 from thread: conn1425
|
Invalid access at address: 0x101fffff8 from thread: conn1426
|
Mon Mar 18 11:28:50.638 Mon Mar 18 11:28:50.638 Invalid access at address: 0x101fffff8 from thread: conn1427
|
Mon Mar 18 11:28:50.638
|
|
|
Invalid access at address: 0x101fffff8 from thread: conn1428
|
Got signal: 11 (Segmentation fault: 11).
|
|
|
Got signal: 11 (Segmentation fault: 11).
|
|
|
Mon Mar 18 11:28:50.638 Mon Mar 18 11:28:50.638
|
Mon Mar 18 11:28:50.638
|
Got signal: 11 (Segmentation fault: 11).
|
Got signal: 11 (Segmentation fault: 11).
|
Mon Mar 18 11:28:50.638 Got signal: 11 (Segmentation fault: 11).
|
|
|
|
|
Got signal: 11 (Segmentation fault: 11).
|
|
|
|
|
Mon Mar 18 11:28:50.662 Backtrace:
|
0x1006dbb8b 0x10000185b 0x100001f11 0x7fff8b6698ea 0x7fff00000002 0x7ea947259716e7ee
|
0 mongod 0x00000001006dbb8b _ZN5mongo15printStackTraceERSo + 43
|
1 mongod 0x000000010000185b _ZN5mongo10abruptQuitEi + 987
|
2 mongod 0x0000000100001f11 _ZN5mongo24abruptQuitWithAddrSignalEiP9__siginfoPv + 673
|
3 libsystem_c.dylib 0x00007fff8b6698ea _sigtramp + 26
|
4 ??? 0x00007fff00000002 0x0 + 140733193388034
|
5 ??? 0x7ea947259716e7ee 0x0 + 9126904346617243630
|
Mon Mar 18 11:28:50.662
|
Mon Mar 18 11:28:50.662 Backtrace:
|
0x1006dbb8b 0x10000185b 0x100001f11 0x7fff8b6698ea 0x7fff00000002 0x7ea947259716e7ee
|
0 mongod 0x00000001006dbb8b _ZN5mongo15printStackTraceERSo + 43
|
1 mongod 0x000000010000185b _ZN5mongo10abruptQuitEi + 987
|
2 mongod 0x0000000100001f11 _ZN5mongo24abruptQuitWithAddrSignalEiP9__siginfoPv + 673
|
3 libsystem_c.dylib 0x00007fff8b6698ea _sigtramp + 26
|
4 ??? 0x00007fff00000002 0x0 + 140733193388034
|
5 ??? 0x7ea947259716e7ee 0x0 + 9126904346617243630
|
Mon Mar 18 11:28:50.662 Mon Mar 18 11:28:50.662 Backtrace:
|
0x1006dbb8b 0x10000185b 0x100001f11 0x7fff8b6698ea 0x7fff00000002 0x7ea947259716e7ee
|
0 mongod 0x00000001006dbb8b _ZN5mongo15printStackTraceERSo + 43
|
1 mongod 0x000000010000185b _ZN5mongo10abruptQuitEi + 987
|
2 mongod 0x0000000100001f11 _ZN5mongo24abruptQuitWithAddrSignalEiP9__siginfoPv + 673
|
Attachments
Issue Links
- is duplicated by
-
SERVER-10331 Mongodb SEGFAULTS with a null pointer
-
- Closed
-
-
-
- Closed
-
- related to
-
-
- Closed
-