[SERVER-521] cursor may be deleted while in use by getMore() Created: 04/Jan/10  Updated: 12/Jul/16  Resolved: 06/Jan/10

Status: Closed
Project: Core Server
Component/s: None
Affects Version/s: None
Fix Version/s: 1.3.1

Type: Bug Priority: Major - P3
Reporter: Aaron Staple Assignee: Dwight Merriman
Resolution: Done Votes: 0
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Participants:

 Description   

I'm trying to debug some issues that occur when we run our standard js tests in parallel. While looking at the code, I noticed the following:

/* called every 4 seconds. millis is amount of idle time passed since the last call – could be zero */
void ClientCursor::idleTimeReport(unsigned millis) {
recursive_boostlock lock(ccmutex);
for ( CCByLoc::iterator i = byLoc.begin(); i != byLoc.end(); ) {
CCByLoc::iterator j = i;
i++;
if( j->second->shouldTimeout( millis ) )

{ log(1) << "killing old cursor " << j->second->cursorid << ' ' << j->second->ns << " idle:" << j->second->idleTime() << "ms\n"; delete j->second; }

}
}

idleTimeReport() gets called with only a read lock in place, so it can happen in parallel with a getMore() request. getMore() grabs the client cursor mutex while it's finding a client cursor, but then it releases the client cursor mutex and continues to use the client cursor object it has found. I believe it's possible for idleTimeReport() to delete a getMore()'s client cursor after getMore() has looked up the client cursor but before getMore() has finished accessing the client cursor's attributes.

I'm sorry I haven't written a test case - that's hard to do for a rare race condition like this.



 Comments   
Comment by auto [ 11/Jan/10 ]

Author:

{'name': 'Eliot Horowitz', 'email': 'eliot@10gen.com'}

Message: fix issue from ClientCursor Pointer thing SERVER-521
http://github.com/mongodb/mongo/commit/fa1b3331b2eb4709020519247c1625210a740a87

Comment by auto [ 06/Jan/10 ]

Author:

{'name': 'Dwight', 'email': 'dmerriman@gmail.com'}

Message: SERVER-521 cursor may be deleted while in getMore
http://github.com/mongodb/mongo/commit/63c26a96bdead538d77470be1bae1ed4925d4614

Generated at Thu Feb 08 02:54:22 UTC 2024 using Jira 9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66.