Bug 52356

Summary: Prevent potential data races on "org.apache.catalina.tribes.transport.bio.util.FastQueue.size".
Product: Tomcat 7 Reporter: Mohsen Vakilian <reprogrammer>
Component: CatalinaAssignee: Tomcat Developers Mailing List <dev>
Severity: normal CC: reprogrammer
Priority: P2    
Version: trunk   
Target Milestone: ---   
Hardware: PC   
OS: Linux   

Description Mohsen Vakilian 2011-12-18 23:41:25 UTC
Even though accesses to "org.apache.catalina.tribes.transport.bio.util.FastQueue.size" are synchronized inside "org.apache.catalina.tribes.transport.bio.util.FastQueue.add(ChannelMessage, Member[], InterceptorPayload)" and "org.apache.catalina.tribes.transport.bio.util.FastQueue.remove()", the read access in "org.apache.catalina.tribes.transport.bio.util.FastQueue.getSize()" is not properly synchronized and thus can lead to a race condition. However, "org.apache.catalina.tribes.transport.bio.util.FastQueue.getSize()" is not used, so this bug never manifests. Nevertheless, we suggest that Tomcat developers either remove "org.apache.catalina.tribes.transport.bio.util.FastQueue.getSize()" or make it access the shared field safely.

Field "org.apache.catalina.tribes.transport.bio.util.FastQueue.size" is declared at
Comment 1 Mark Thomas 2011-12-23 21:20:11 UTC
Write access is protected by the lock. Making it volatile will ensure the latest version is available to the getSize() method.
Comment 2 Mark Thomas 2011-12-23 21:21:50 UTC
Fixed in trunk and 7.0.x and will be included in 7.0.24 onwards.
Comment 3 Mohsen Vakilian 2011-12-24 00:08:34 UTC
Thanks for resolving this issue. Keshmesh <http://keshmesh.cs.illinois.edu/> detected this problem when we ran it on Tomcat using method "org.apache.catalina.tribes.group.interceptors.MessageDispatchInterceptor.run()" as an entry point.