[SERVER-42987] If an abortTransaction command gets interrupted we may dereference a null pointer inside abortActiveUnpreparedOrStashPreparedTransaction Created: 22/Aug/19  Updated: 29/Oct/23  Resolved: 11/Sep/19

Status: Closed
Project: Core Server
Component/s: Replication
Affects Version/s: 4.2.0, 4.3.1
Fix Version/s: 4.3.1

Type: Bug Priority: Major - P3
Reporter: William Schultz (Inactive) Assignee: Judah Schvimer
Resolution: Fixed Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Attachments: File kill-prepared-commit-filtered.dump    
Issue Links:
Backports
Related
related to SERVER-41956 Add integration tests for killOp of c... Closed
is related to SERVER-38190 killOp while committing a prepared tr... Closed
is related to SERVER-38299 killOp while preparing a transaction ... Closed
Backwards Compatibility: Fully Compatible
Operating System: ALL
Backport Requested:
v4.2
Sprint: Repl 2019-08-26, Repl 2019-09-09, Repl 2019-09-23
Participants:

 Description   

When we run a command via 'invokeWithSessionCheckedOut' we register an exit guard here which will fire if the command throws an uncaught exception. If we are running an 'abortTransaction' command on a session that currently has a prepared transaction, it is possible that the command gets interrupted. For example, if a concurrent killOp command has killed the operation. There is at least one interruption point within the 'abortTransaction' command where we try to log an abort oplog entry and then update the session entry. We try to acquire a lock there via AutoGetCollection. If the abort command throws after we have already cleaned up the OperationContext resources, then the WriteUnitOfWork on the opCtx will have been set to null. So, if we then try to stash our transaction resources inside 'TransactionParticipant::Participant::_stashActiveTransaction' when the exit guard fires, we may dereference the null WUOW.



 Comments   
Comment by Githook User [ 11/Oct/19 ]

Author:

{'name': 'Judah Schvimer', 'username': 'judahschvimer', 'email': 'judah.schvimer@10gen.com'}

Message: SERVER-42987 make it safe to interrupt abortTransaction

(cherry picked from commit 1659ddcfb49050dcf18fef014cd9d5ebf5717650)
Branch: v4.2
https://github.com/mongodb/mongo/commit/958d004f06c37b404c7164a49cf5c4784bea6c6f

Comment by Githook User [ 11/Sep/19 ]

Author:

{'username': 'judahschvimer', 'email': 'judah.schvimer@10gen.com', 'name': 'Judah Schvimer'}

Message: SERVER-42987 make it safe to interrupt abortTransaction
Branch: master
https://github.com/mongodb/mongo/commit/1659ddcfb49050dcf18fef014cd9d5ebf5717650

Comment by William Schultz (Inactive) [ 23/Aug/19 ]

I believe commitPreparedTransaction is immune to this issue because we log the oplog entry inside an uninterruptible block.

Generated at Thu Feb 08 05:01:57 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.