SERVER-28837 Do not attempt to subtract negative cursorTimeoutMillis.

An INT_MIN value for cursorTimeoutMillis can crash mongos when we try
to subtract that value (which gets cast to a Duration) from the
current time. Because a negative cursorTimeoutMillis is semantically
the same as a 0 value, this change ignores negative values when
performing the offending subtraction.

It would be reasonable to clamp cursorTimeoutMillis to 0 using input
validation, but I don't see a good way to do that. Because a Duration
cannot be an unsigned type, we have to keep cursorTimeoutMillis as an
int. Unfortunately, we don't really have a way restrict the values
that the user sets with the setParameter command except to enforce
that the value fits in the data typed used for the parameter.

1 files changed, 7 insertions, 2 deletions

diff --git a/src/mongo/s/query/cluster_cursor_cleanup_job.cpp b/src/mongo/s/query/cluster_cursor_cleanup_job.cpp
index c222abf921f..a8892131cd0 100644
--- a/src/mongo/s/query/cluster_cursor_cleanup_job.cpp
+++ b/src/mongo/s/query/cluster_cursor_cleanup_job.cpp
@@ -68,8 +68,13 @@ void ClusterCursorCleanupJob::run() {
     invariant(manager);
 
     while (!globalInShutdownDeprecated()) {
-        manager->killMortalCursorsInactiveSince(Date_t::now() -
-                                                Milliseconds(cursorTimeoutMillis.load()));
+        // Mirroring the behavior in CursorManager::timeoutCursors(), a negative value for
+        // cursorTimeoutMillis has the same effect as a 0 value: cursors are cleaned immediately.
+        auto cursorTimeoutValue = cursorTimeoutMillis.load();
+        Date_t cutoff = (cursorTimeoutValue > 0)
+            ? (Date_t::now() - Milliseconds(cursorTimeoutValue))
+            : Date_t::now();
+        manager->killMortalCursorsInactiveSince(cutoff);
         manager->incrementCursorsTimedOut(manager->reapZombieCursors());
 
         MONGO_IDLE_THREAD_BLOCK;