[SERVER-21696] applyOps with invalid ns field triggers fassert on MMAP Created: 30/Nov/15  Updated: 06/Dec/22  Resolved: 14/Nov/16

Status: Closed
Project: Core Server
Component/s: None
Affects Version/s: 3.0.7, 3.2.0-rc4, 3.4.0-rc3
Fix Version/s: 3.4.0-rc3

Type: Bug Priority: Major - P3
Reporter: Robert Guo (Inactive) Assignee: Backlog - Storage Execution Team
Resolution: Done Votes: 0
Labels: fuzzer-blacklist
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Attachments: File repro.js    
Issue Links:
Depends
Related
is related to SERVER-22577 mmapv1 should not allow creation of d... Closed
Assigned Teams:
Storage Execution
Backwards Compatibility: Fully Compatible
Operating System: ALL
Sprint: Integration F (02/01/16), Integration 10 (02/22/16)
Participants:
Linked BF Score: 0

 Description   

affects both 3.0 and 3.2:

 mongod(_ZN5mongo15invariantFailedEPKcS1_j+0x2F6) [0x10e191726]
 mongod(_ZN5mongo3dur13JournalWriter20_journalWriterThreadEv+0x89A) [0x10df50caa]
 mongod(_ZNSt3__114__thread_proxyINS_5tupleIJNS_6__bindIMN5mongo3dur13JournalWriterEFvvEJPS5_EEEEEEEEPvSB_+0x71) [0x10df52331]



 Comments   
Comment by Robert Guo (Inactive) [ 23/Nov/16 ]

This was fixed in SERVER-22577, which introduced the massert that prevented commands from running on invalid namespaces.

I'm going to remove the backport request on this ticket as SERVER-22577 was not backported.

Comment by Eric Milkie [ 14/Nov/16 ]

I suspect one of the applyOps code changes now avoids this crash on 3.4.

Comment by Eric Milkie [ 14/Nov/16 ]

Actually, I'm going to resolve this ticket as Gone Away, and keep it focused on the fassert that still manifests on version 3.2 and prior.

Comment by Eric Milkie [ 14/Nov/16 ]

No longer crashes with 3.4.0. The massert is still there, however.

Comment by Martin Bligh [ 02/Feb/16 ]

Testcases now produces:
Assertion: 16886:nsToCollectionSubstring: no .
massert is operation fatal, not server fatal, which is correct

inline StringData nsToCollectionSubstring(StringData ns) {
    size_t i = ns.find('.');
    massert(16886, "nsToCollectionSubstring: no .", i != std::string::npos);
    return ns.substr(i + 1);
}

Generated at Thu Feb 08 03:58:08 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.