sessions lock race condition deleting expired session

Originally reported by: deecodameeko (Bitbucket: deecodameeko, GitHub: @deecodameeko)

---

I found an issue last night with sessions where it tries to release a lock on a session that isn't locked.

Here's a dump of the logs:

#!python
File "/root/.virtualenvs/web_api/lib/python2.7/site-packages/cherrypy/_cprequest.py", line 102, in run
    hook()
  File "/root/.virtualenvs/web_api/lib/python2.7/site-packages/cherrypy/_cprequest.py", line 62, in __call__
    return self.callback(**self.kwargs)
  File "/root/.virtualenvs/web_api/lib/python2.7/site-packages/cherrypy/lib/sessions.py", line 706, in close
    sess.release_lock()
  File "/root/.virtualenvs/web_api/lib/python2.7/site-packages/cherrypy/lib/sessions.py", line 479, in release_lock
    os.unlink(path + self.LOCK_SUFFIX)
OSError: [Errno 2] No such file or directory: '/san/in/api-sessions/session-b93639d62bec1e4a766e244d1a22d0bf7ebdc32c.lock'

It seems it doesn't check if the file exists before unlinking it. Perhaps it should? I'm not sure what could cause this issue in the first place.

---

• Bitbucket: https://bitbucket.org/cherrypy/cherrypy/issue/1193

Original comment by deecodameeko (Bitbucket: deecodameeko, GitHub: deecodameeko):

---

This issue has happened again. Traceback (most recent call last):
File "/root/.virtualenvs/web_api/lib/python2.7/site-packages/cherrypy/_cprequest.py", line 660, in respond
self.hooks.run('before_finalize')
File "/root/.virtualenvs/web_api/lib/python2.7/site-packages/cherrypy/_cprequest.py", line 112, in run
raise exc
OSError: [Errno 2] No such file or directory: '/san/in/api-sessions/session-457a905458daf6a10d03814be7263598d16fcd22.lock'

Would love to get a response about this one.

Thanks!

Original comment by Joel Rivera (Bitbucket: cyraxjoe, GitHub: cyraxjoe):

---

Which version of CherryPy are you were using?, also, are you using python with the "-O" options or calling the methods of the session like, cherrypy.session.save(), from your code?. I hope you are still interested on fixing this :).

Original comment by deecodameeko (Bitbucket: deecodameeko, GitHub: deecodameeko):

---

Hi! I'm using cherrypy 3.2.2. I found this bug from a networking issue where the load balancer was not directing certain calls to a single machine.

I wasn't explicitly calling session.save.'i was using implicit session locking.

I just think it should check if the lock file exists prior to releasing it. I'm sure there's a reason for it.