Bug 1302555

Summary: [GSS](6.4.z) active-sessions can exceed max-active-sessions due to a race condition
Product: [JBoss] JBoss Enterprise Application Platform 6 Reporter: Osamu Nagano <onagano>
Component: WebAssignee: Chao Wang <chaowan>
Status: CLOSED CURRENTRELEASE QA Contact: Radim Hatlapatka <rhatlapa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.4.5CC: bbaranow, bmaxwell, chaowan, dpospisi, jtruhlar, mcada, rmaucher
Target Milestone: CR1   
Target Release: EAP 6.4.7   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-01-17 12:00:44 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1279552, 1308845    

Description Osamu Nagano 2016-01-28 07:28:05 UTC 
Below is the original bug report for Tomcat.  JBoss Web missed it for a long time.

[Bug 48790 - Race condition in org.apache.catalina.session.ManagerBase:maxActive]
https://bz.apache.org/bugzilla/show_bug.cgi?id=48790


Actual:
http://anonsvn.jboss.org/repos/jbossweb/trunk/src/main/java/org/apache/catalina/session/ManagerBase.java
~~~
    public void add(Session session) {

        sessions.put(session.getIdInternal(), session);
        int size = sessions.size();
        if( size > maxActive ) {
            maxActive = size;
        }
    }
~~~


Expected:
http://svn.apache.org/repos/asf/tomcat/tc6.0.x/trunk/java/org/apache/catalina/session/ManagerBase.java
~~~
    public void add(Session session) {

        sessions.put(session.getIdInternal(), session);
        int size = sessions.size();
        if( size > maxActive ) {
            synchronized(maxActiveUpdateLock) {
                if( size > maxActive ) {
                    maxActive = size;
                }
            }
        }
    }
~~~
Comment 6 Michael Cada 2016-03-11 14:43:15 UTC 
Verified on EAP 6.4.7.CP.CR2

Verified that max-active-sessions is never smaller than active-sessions (it's now synchronized), but active-sessions can exceed property MAX_ACTIVE_SESSIONS see bz#1316949 and if property MAX_ACTIVE_SESSIONS is set from jboss-web.xml it doesn't work - see bz#1316960
Comment 7 Petr Penicka 2017-01-17 12:00:44 UTC 
Retroactively bulk-closing issues from released EAP 6.4 cumulative patches.