You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2025/08/14 00:41:08 UTC
[Bug 69781] New: FileStore used with PersistentValve can cause EOFException during session expiration checks and dropped session
https://bz.apache.org/bugzilla/show_bug.cgi?id=69781
Bug ID: 69781
Summary: FileStore used with PersistentValve can cause
EOFException during session expiration checks and
dropped session
Product: Tomcat 10
Version: 10.1.44
Hardware: PC
OS: All
Status: NEW
Severity: normal
Priority: P2
Component: Catalina
Assignee: dev@tomcat.apache.org
Reporter: aogburn@redhat.com
Target Milestone: ------
The FileStore save and remove operations if done concurrently with load
attempts are not really thread safe. The file writes/deletes from save or
remove can lop off the data that a load is attempting to read so that the load
attempt hits an EOFException. This has been noted when using it combination
with a PersistentValve and PersistentManager:
<Valve className="org.apache.catalina.valves.PersistentValve" />
<Manager className="org.apache.catalina.session.PersistentManager"
processExpiresFrequency="1">
<Store className="org.apache.catalina.session.FileStore" />
</Manager>
If a FileStore save attempt from the PersistentValve at the end of a request
happens alongside a background processExpires check FileStore load attempt for
the same session, then this can induce an EOFException like below during the
load attempt:
SEVERE [Catalina-utility-1]
org.apache.catalina.session.StoreBase.processExpires Error processing session
expiration for key [3DFF110B8415939F736A5751783ECDA9]
java.io.EOFException
at
java.base/java.io.ObjectInputStream$PeekInputStream.readFully(ObjectInputStream.java:2933)
at
java.base/java.io.ObjectInputStream$BlockDataInputStream.readShort(ObjectInputStream.java:3428)
at
java.base/java.io.ObjectInputStream.readStreamHeader(ObjectInputStream.java:985)
at
java.base/java.io.ObjectInputStream.<init>(ObjectInputStream.java:416)
at
org.apache.catalina.util.CustomObjectInputStream.<init>(CustomObjectInputStream.java:87)
at
org.apache.catalina.session.StoreBase.getObjectInputStream(StoreBase.java:204)
at
org.apache.catalina.session.FileStore.load(FileStore.java:200)
at
org.apache.catalina.session.StoreBase.processExpires(StoreBase.java:138)
at
org.apache.catalina.session.PersistentManagerBase.processExpires(PersistentManagerBase.java:409)
at
org.apache.catalina.session.ManagerBase.backgroundProcess(ManagerBase.java:587)
at
org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:4837)
at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1172)
at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1176)
at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1176)
at
org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1154)
at
java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:572)
at
java.base/java.util.concurrent.FutureTask.runAndReset(FutureTask.java:358)
at
java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:305)
at
java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at
java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63)
at java.base/java.lang.Thread.run(Thread.java:1583)
That EOFException is then caught and handled at
https://github.com/apache/tomcat/blob/10.1.x/java/org/apache/catalina/session/StoreBase.java#L173
to result in the session being removed and dropped unexpectedly before any
expected expiration.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69781] FileStore used with PersistentValve can cause EOFException during session expiration checks and dropped session
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69781
--- Comment #1 from Aaron Ogburn <ao...@redhat.com> ---
Created attachment 40082
--> https://bz.apache.org/bugzilla/attachment.cgi?id=40082&action=edit
bz-69781-reproducer.zip
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69781] FileStore used with PersistentValve can cause EOFException during session expiration checks and dropped session
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69781
--- Comment #8 from Remy Maucherat <re...@apache.org> ---
(In reply to Mark Thomas from comment #7)
> I'm not sure it does. The database operations should be atomic.
+1, let's assume that then and avoid preemptively adding stuff, we'll see if
anyone complains.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69781] FileStore used with PersistentValve can cause EOFException during session expiration checks and dropped session
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69781
--- Comment #6 from Remy Maucherat <re...@apache.org> ---
I suppose DataSourceStore needs the same addition of per key locking ? It uses
getObjectInputStream the same way as FileStore (no surprise there).
I will do the changes.
I will not update JDBCStore, which is deprecated.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69781] FileStore used with PersistentValve can cause EOFException during session expiration checks and dropped session
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69781
--- Comment #3 from Aaron Ogburn <ao...@redhat.com> ---
(In reply to Aaron Ogburn from comment #2)
> https://github.com/apache/tomcat/pull/882 is an example with sessionid
> specific read/write locks that addresses this in my tests.
Note this fix does a similar id based lock tracking as with the semaphores in
the PersistentValve.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69781] FileStore used with PersistentValve can cause EOFException during session expiration checks and dropped session
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69781
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED
--- Comment #5 from Mark Thomas <ma...@apache.org> ---
Fixed in:
- 12.0.x
- 11.0.x for 11.0.11 onwards
- 10.1.x for 10.1.45 onwards
- 9.0.x for 9.0.109 onwards
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69781] FileStore used with PersistentValve can cause EOFException during session expiration checks and dropped session
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69781
--- Comment #2 from Aaron Ogburn <ao...@redhat.com> ---
https://github.com/apache/tomcat/pull/882 is an example with sessionid specific
read/write locks that addresses this in my tests.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69781] FileStore used with PersistentValve can cause EOFException during session expiration checks and dropped session
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69781
--- Comment #4 from Mark Thomas <ma...@apache.org> ---
I've added a test case for this to main (12.0.x). I haven't looked at the
proposed solution yet.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69781] FileStore used with PersistentValve can cause EOFException during session expiration checks and dropped session
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69781
--- Comment #7 from Mark Thomas <ma...@apache.org> ---
I'm not sure it does. The database operations should be atomic.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org