SERVER-58310 Always hold `_mutex` before modifying `CallbackState::callback`

(cherry picked from commit a9bec8a996b1d8fd6d3e28b200d8483f9a944bcb)

1 files changed, 9 insertions, 2 deletions

diff --git a/src/mongo/executor/thread_pool_task_executor.cpp b/src/mongo/executor/thread_pool_task_executor.cpp
index 90a2ca07918..c258766937b 100644
--- a/src/mongo/executor/thread_pool_task_executor.cpp
+++ b/src/mongo/executor/thread_pool_task_executor.cpp
@@ -651,7 +651,10 @@ void ThreadPoolTaskExecutor::runCallback(std::shared_ptr<CallbackState> cbStateA
         // Swap 'cbStateArg->callback' with temporary copy before running callback for exception
         // safety.
         TaskExecutor::CallbackFn callback;
-        std::swap(cbStateArg->callback, callback);
+        {
+            auto lk = stdx::lock_guard(_mutex);
+            std::swap(cbStateArg->callback, callback);
+        }
         callback(std::move(args));
     }
     cbStateArg->isFinished.store(true);
@@ -827,12 +830,16 @@ void ThreadPoolTaskExecutor::runCallbackExhaust(std::shared_ptr<CallbackState> c
 
     if (!cbState->isFinished.load()) {
         TaskExecutor::CallbackFn callback = [](const CallbackArgs&) {};
-        std::swap(cbState->callback, callback);
+        {
+            auto lk = stdx::lock_guard(_mutex);
+            std::swap(cbState->callback, callback);
+        }
         callback(std::move(args));
 
         // Leave the empty callback function if the request has been marked canceled or finished
         // while running the callback to avoid leaking resources.
         if (!cbState->canceled.load() && !cbState->isFinished.load()) {
+            auto lk = stdx::lock_guard(_mutex);
             std::swap(callback, cbState->callback);
         }
     }