test/format (multi-node, disagg) Race condition in __wti_conn_dhandle_outdated leads to use-after-free dereference of session->dhandle

XMLWordPrintableJSON

      We have identified a race condition in __wti_conn_dhandle_outdated

      session->dhandle can be freed or cleared by a concurrent thread between the time it is found using __wt_conn_dhandle_find and the time it is acquired or accessed.

      This can lead to a error when the dhandle is accessed.

      Steps to Reproduce

      1. Run test/format in a multi-node configuration with disaggregated storage enabled.
      2. Modify src/conn/conn_dhandle.c, inside _wti_conn_dhandle_outdated, to insert a sleep after _wt_conn_dhandle_find and before WT_DHANDLE_ACQUIRE, to widen the race window.
      3. Run the test.

      How to run multi node (test/format)

      cd build/test/format
      ./format_disagg_multi.sh

            Assignee:
            Sid Mahajan
            Reporter:
            Sid Mahajan
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: