IBM Support

IT38158: Connection handle leak when a MQ-JMS application security exit reports an error

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • A JMS application has a ConnectionFactory configured to use an
    MQ Security Exit, which fails to run successfully.  When the
    application issues the JMS method:
    
        javax.jms.ConnectionFactory.createConnection();
    
    it is presented with a JMS Exception of the form:
    
    com.ibm.msg.client.jms.DetailedJMSException: JMSWMQ0018: Failed
    to connect to queue manager 'myQMGR' with connection mode
    'Client' and host name 'localhost(1414)'.
    Check the queue manager is started and if running in client
    mode, check there is a listener running. Please see the linked
    exception for more information.
    at
    com.ibm.msg.client.wmq.common.internal.Reason.reasonToException
    at com.ibm.msg.client.wmq.common.internal.Reason.createException
    at com.ibm.msg.client.wmq.internal.WMQConnection.<init>
    at
    com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createV7Pr
    oviderConnection
    at
    com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createProv
    iderConnection
    at
    com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl.createConn
    ection
    at com.ibm.mq.jms.MQConnectionFactory.createCommonConnection
    at com.ibm.mq.jms.MQConnectionFactory.createConnection
    at SecurityExitTest.startTest
    at SecurityExitTest.main
    
    Caused by: com.ibm.mq.MQException: JMSCMQ0001: WebSphere MQ
    call failed with compcode '2' ('MQCC_FAILED') reason '2537'
    ('MQRC_CHANNEL_NOT_AVAILABLE').
    at com.ibm.msg.client.wmq.common.internal.Reason.createException
    ... 8 more
    
    Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2537;AMQ9204:
    Connection to host 'localhost(1414)' rejected.
    [1=com.ibm.mq.jmqi.JmqiException[CC=2;RC=2537;AMQ9536: Channel
    ended by an exit.
    [1=SEC.EXIT.CHANNEL,2=/var/mqm/exits/mySecurityExit.so(ChlExit)]
    ],3=localhost(1414),5=RemoteExitChain.callScyExitSecParms]
    at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect
    at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect
    at com.ibm.msg.client.wmq.internal.WMQConnection.<init>
    ... 7 more
    
    Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2537;AMQ9536:
    Channel ended by an exit.
    [1=SEC.EXIT.CHANNEL,2=/var/mqm/exits/mySecurityExit.so(ChlExit)]
    at
    com.ibm.mq.jmqi.remote.exit.RemoteExitChain.callScyExitSecParms
    at com.ibm.mq.jmqi.remote.impl.RemoteConnection.initOAMUserAuth
    at
    com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSes
    sion
    at com.ibm.mq.jmqi.remote.impl.RemoteConnectionPool.getSession
    at com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect
    ... 9 more
    
    
    However after several iterations of the application connection
    attempt is made, it is observed that the queue manager reports
    that the maximum number of channels has been reached, and
    further attempts to connect fail due to the queue manager
    rejecting the connection attempts.
    

Local fix

Problem summary

  • ****************************************************************
    USERS AFFECTED:
    This issue affects users of the MQ classes for Java and classes
    for JMS, who have applications that  are using security exits.
    
    
    Platforms affected:
    MultiPlatform
    
    ****************************************************************
    PROBLEM DESCRIPTION:
    When an MQ classes for Java or MQ classes for JMS application
    attempts to connect to a queue manager where a security exit has
    been configured to be called on the client side, the security
    exit may request that the channel is closed as part of its
    failure processing.
    
    If this happens the connection attempt is rejected, and the
    application will receive an exception.  For example when using
    the MQ classes for JMS API, the following exception might be
    thrown from the call to:
    
    javax.jms.ConnectionFactory.createConnection(String username,
    String password);
    
    com.ibm.msg.client.jms.DetailedJMSException: JMSWMQ0018: Failed
    to connect to queue manager 'myQMGR' with connection mode
    'Client' and host name 'localhost(1414)'.
    Check the queue manager is started and if running in client
    mode, check there is a listener running. Please see the linked
    exception for more information.
      at
    com.ibm.msg.client.wmq.common.internal.Reason.reasonToException(
    Reason.java:595)
      at
    com.ibm.msg.client.wmq.common.internal.Reason.createException(Re
    ason.java:215)
      at
    com.ibm.msg.client.wmq.internal.WMQConnection.<init>(WMQConnecti
    on.java:424)
      at
    com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createV7Pr
    oviderConnection(WMQConnectionFactory.java:8470)
      at
    com.ibm.msg.client.wmq.factories.WMQConnectionFactory.createProv
    iderConnection(WMQConnectionFactory.java:7810)
      at
    com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl._createCon
    nection(JmsConnectionFactoryImpl.java:325)
      at
    com.ibm.msg.client.jms.admin.JmsConnectionFactoryImpl.createConn
    ection(JmsConnectionFactoryImpl.java:243)
      at
    com.ibm.mq.jms.MQConnectionFactory.createCommonConnection(MQConn
    ectionFactory.java:6038)
      at
    com.ibm.mq.jms.MQConnectionFactory.createConnection(MQConnection
    Factory.java:6068)
      at myApplication.myMethod
    
    Caused by: com.ibm.mq.MQException: JMSCMQ0001: IBM MQ call
    failed with compcode '2' ('MQCC_FAILED') reason '2537'
    ('MQRC_CHANNEL_NOT_AVAILABLE').
      at
    com.ibm.msg.client.wmq.common.internal.Reason.createException(Re
    ason.java:203)
      ... 9 more
    
    Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2537;AMQ9204:
    Connection to host 'localhost(1414)' rejected.
    [1=com.ibm.mq.jmqi.JmqiException[CC=2;RC=2537;AMQ9536: Channel
    ended by an exit. [1=SEC.EXIT.CHANNEL
    ,2=/var/mqm/exits/myExit.so(ChlExit)]],3=localhost(1414),5=Remot
    eExitChain.callScyExitSecParms]
      at
    com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:
    2301)
      at
    com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:
    1273)
      at
    com.ibm.mq.ese.jmqi.InterceptedJmqiImpl.jmqiConnect(InterceptedJ
    mqiImpl.java:377)
      at com.ibm.mq.ese.jmqi.ESEJMQI.jmqiConnect(ESEJMQI.java:562)
      at
    com.ibm.msg.client.wmq.internal.WMQConnection.<init>(WMQConnecti
    on.java:357)
      ... 8 more
    
    Caused by: com.ibm.mq.jmqi.JmqiException: CC=2;RC=2537;AMQ9536:
    Channel ended by an exit. [1=SEC.EXIT.CHANNEL
    ,2=/var/mqm/exits/myExit.so(ChlExit)]
      at
    com.ibm.mq.jmqi.remote.exit.RemoteExitChain.callScyExitSecParms(
    RemoteExitChain.java:597)
      at
    com.ibm.mq.jmqi.remote.impl.RemoteConnection.initOAMUserAuth(Rem
    oteConnection.java:2386)
      at
    com.ibm.mq.jmqi.remote.impl.RemoteConnectionSpecification.getSes
    sion(RemoteConnectionSpecification.java:351)
      at
    com.ibm.mq.jmqi.remote.impl.RemoteConnectionPool.getSession(Remo
    teConnectionPool.java:161)
      at
    com.ibm.mq.jmqi.remote.api.RemoteFAP.jmqiConnect(RemoteFAP.java:
    1749)
      ... 12 more
    
    
    This exception is expected in this scenario - the security exit
    has rejected the connection attempt.
    
    However the underlying connection handle to the queue manager
    (the 'hconn') is left open when this happens, resulting in the
    hconn being orphaned with no mechanism to close it from the JMS
    API (a JMS Connection object was not returned to the application
    by the createConnection method call when it threw the
    exception).
    
    The same problem can occur when creating a JMS Session, if the
    Connection was successfully created, but then subsequent Session
    creation requests on new TCP/IP sockets (especially in the
    channel configuration case of SHARECNV(1) ) fail in the security
    exit.
    
    The net result is that the additional channel instances are
    created but not used by the application.  If this issue is
    repeatedly encountered during the lifetime of the JVM/queue
    manager, the queue manager's maximum channel instance count
    could be reached, which will then result in all further
    connection requested being rejected.
    

Problem conclusion

  • The MQ classes for Java and classes for JMS have been updated
    such that, if a security exit returns a return code which would
    result in a failure to complete the establishing of the
    connection to the queue manager, the 'hconn' associated with
    this new connection attempt is closed before the exception is
    thrown back to the calling application.
    
    ---------------------------------------------------------------
    The fix is targeted for delivery in the following PTFs:
    
    Version    Maintenance Level
    
    v9.1 LTS   9.1.0.11
    v9.2 LTS   9.2.0.5
    v9.x CD    9.2.5
    
    The latest available maintenance can be obtained from
    'WebSphere MQ Recommended Fixes'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
    
    If the maintenance level is not yet available information on
    its planned availability can be found in 'WebSphere MQ
    Planned Maintenance Release Dates'
    http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
    ---------------------------------------------------------------
    

Temporary fix

Comments

APAR Information

  • APAR number

    IT38158

  • Reported component name

    MQ WINDOWS V7

  • Reported component ID

    5724H7220

  • Reported release

    710

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2021-08-26

  • Closed date

    2021-11-01

  • Last modified date

    2022-06-14

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    MQ WINDOWS V7

  • Fixed component ID

    5724H7220

Applicable component levels

[{"Line of Business":{"code":"LOB45","label":"Automation"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSFKSJ","label":"WebSphere MQ"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.1"}]

Document Information

Modified date:
15 June 2022