[SERVER-81331] Spilling in SBE may lead to read on destroyed catalog object Created: 22/Sep/23 Updated: 29/Nov/23 Resolved: 17/Nov/23 |
|
| Status: | Closed |
| Project: | Core Server |
| Component/s: | None |
| Affects Version/s: | None |
| Fix Version/s: | 7.2.0-rc0 |
| Type: | Bug | Priority: | Major - P3 |
| Reporter: | Ian Boros | Assignee: | Martin Neupauer |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Issue Links: |
|
||||||||||||||||||||
| Assigned Teams: |
Query Execution
|
||||||||||||||||||||
| Backwards Compatibility: | Fully Compatible | ||||||||||||||||||||
| Operating System: | ALL | ||||||||||||||||||||
| Sprint: | QE 2023-10-02, QE 2023-10-16, QE 2023-10-30, QE 2023-11-13, QE 2023-11-27 | ||||||||||||||||||||
| Participants: | |||||||||||||||||||||
| Case: | (copied to CRM) | ||||||||||||||||||||
| Linked BF Score: | 129 | ||||||||||||||||||||
| Description |
|
TLDR: SBE may read freed memory after spilling, when there are concurrent catalog-changing operations. Description of Bug Today SBE does not handle this situation, and assumes that the CollectionCatalog remains the same after the write, as it keeps pointers to the current Collection in the CollectionPtr objects it stores. In the (unlikely) case where the spilling query's RecoveryUnit holds the last reference to the CollectionCatalog, (or the case where another thread destroys the CollectionCatalog immediately after the spill write commits), attempting to call CollectionPtr::yield() will result in a use-after-free, as the CollectionPtr will try to read the uuid of a deleted Collection object. How to Fix it
Notes |
| Comments |
| Comment by Steve Tarzia [ 17/Nov/23 ] |
|
Note that a backport is not needed because the merge happened before the 7.2 branch cut. The fix is in https://github.com/10gen/mongo/commits/v7.2/src/mongo/db/storage/recovery_unit.h |
| Comment by Githook User [ 02/Nov/23 ] |
|
Author: {'name': 'Martin Neupauer', 'email': 'xmaton@messengeruser.com', 'username': ''}Message: |