Uploaded image for project: 'WiredTiger'
  1. WiredTiger
  2. WT-13375

Potential race condition use-after-free in eviction server

    • Storage Engines
    • 5
    • 2024-08-06 - Withholding Tax
    • v8.0, v7.3, v7.0, v6.0, v5.0

      In function __evict_walk the dhandle stored in cache->walk_tree is pinned by incrementing its use count dhandle->session_inuse. When the function exits, the use count is decremented but cache->walk_tree is not cleared and can be used later.

      In theory, that dhandle can be deleted by connection sweep server and cache->walk_tree will become invalid.

            Assignee:
            y.ershov@mongodb.com Yury Ershov
            Reporter:
            y.ershov@mongodb.com Yury Ershov
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved: