From be29fb1023e57defd74ed4171c6c253cf6b47aa3 Mon Sep 17 00:00:00 2001
From: Billy Donahue <billy.donahue@mongodb.com>
Date: Sat, 2 May 2020 13:56:21 -0400
Subject: SERVER-41068: hold refs while calling wait functions

    Also check for mapped-to-nullptr case before
    dereferencing iter->second
---
 src/mongo/db/background.cpp                    | 17 +++++++++++------
 src/mongo/db/repl/replication_info.cpp         |  3 ++-
 src/mongo/s/commands/cluster_is_master_cmd.cpp |  2 +-
 3 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/src/mongo/db/background.cpp b/src/mongo/db/background.cpp
index e77eff20cd5..05acf78fb46 100644
--- a/src/mongo/db/background.cpp
+++ b/src/mongo/db/background.cpp
@@ -122,16 +122,20 @@ void recordEndAndRemove(BgInfoMap& bgiMap, StringData key) {
 }
 
 void awaitNoBgOps(stdx::unique_lock<Latch>& lk, BgInfoMap* bgiMap, StringData key) {
-    if (auto iter = bgiMap->find(key); iter != bgiMap->end())
-        iter->second->awaitNoBgOps(lk);
+    if (auto iter = bgiMap->find(key); iter != bgiMap->end() && iter->second) {
+        auto ptr = iter->second;  // hold a reference while waiting
+        ptr->awaitNoBgOps(lk);
+    }
 }
 
 }  // namespace
 
 void BackgroundOperation::waitUntilAnIndexBuildFinishes(OperationContext* opCtx, StringData ns) {
     stdx::unique_lock<Latch> lk(m);
-    if (auto iter = nsInProg.find(ns); iter != nsInProg.end())
-        iter->second->waitForAnOpRemoval(lk, opCtx);
+    if (auto iter = nsInProg.find(ns); iter != nsInProg.end() && iter->second) {
+        auto ptr = iter->second;  // hold a reference while waiting
+        ptr->waitForAnOpRemoval(lk, opCtx);
+    }
 }
 
 bool BackgroundOperation::inProgForDb(StringData db) {
@@ -141,8 +145,9 @@ bool BackgroundOperation::inProgForDb(StringData db) {
 
 int BackgroundOperation::numInProgForDb(StringData db) {
     stdx::lock_guard<Latch> lk(m);
-    auto iter = dbsInProg.find(db);
-    return iter == dbsInProg.end() ? 0 : iter->second->getOpsInProgCount();
+    if (auto iter = dbsInProg.find(db); iter != dbsInProg.end() && iter->second)
+        return iter->second->getOpsInProgCount();
+    return 0;
 }
 
 bool BackgroundOperation::inProgForNs(StringData ns) {
diff --git a/src/mongo/db/repl/replication_info.cpp b/src/mongo/db/repl/replication_info.cpp
index f4be131dba5..ddbc339c73e 100644
--- a/src/mongo/db/repl/replication_info.cpp
+++ b/src/mongo/db/repl/replication_info.cpp
@@ -501,7 +501,8 @@ public:
         result.append("readOnly", storageGlobalParams.readOnly);
 
         const auto& params = ServerParameterSet::getGlobal()->getMap();
-        if (auto iter = params.find("automationServiceDescriptor"); iter != params.end())
+        if (auto iter = params.find("automationServiceDescriptor");
+            iter != params.end() && iter->second)
             iter->second->append(opCtx, result, "automationServiceDescriptor");
 
         if (opCtx->getClient()->session()) {
diff --git a/src/mongo/s/commands/cluster_is_master_cmd.cpp b/src/mongo/s/commands/cluster_is_master_cmd.cpp
index 0fb7eefe6b3..4c9412365ab 100644
--- a/src/mongo/s/commands/cluster_is_master_cmd.cpp
+++ b/src/mongo/s/commands/cluster_is_master_cmd.cpp
@@ -172,7 +172,7 @@ public:
         {
             const auto& serverParams = ServerParameterSet::getGlobal()->getMap();
             auto iter = serverParams.find("automationServiceDescriptor");
-            if (iter != serverParams.end())
+            if (iter != serverParams.end() && iter->second)
                 iter->second->append(opCtx, result, "automationServiceDescriptor");
         }
 
-- 
cgit v1.2.1