1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MDEV-26465 Race condition in trx_purge_rseg_get_next_history_log()

Browse Source 
trx_purge_rseg_get_next_history_log(): Fix a race condition that
was introduced in commit e46f76c9749d7758765ba274a212cfc2dcf3eeb8
(MDEV-15912). The buffer pool page contents must not be accessed
while not holding a page latch. The page latch was released by
mtr_t::commit().

This race resulted in an ASAN heap-use-after-poison during a stress test.
This commit is contained in:
Marko Mäkelä 2021-08-23 17:00:01 +03:00
parent 687417e5c5
commit c0a84fb9b0
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
storage/innobase/trx/trx0purge.cc
View File

@ -1155,15 +1155,16 @@ static void trx_purge_rseg_get_next_history_log(
trx_no = mach_read_from_8(log_hdr + TRX_UNDO_TRX_NO);
ut_ad(mach_read_from_2(log_hdr + TRX_UNDO_NEEDS_PURGE) <= 1);
const byte needs_purge = log_hdr[TRX_UNDO_NEEDS_PURGE + 1];
mtr_commit(&mtr);
mtr.commit();
mutex_enter(&purge_sys.rseg->mutex);
purge_sys.rseg->last_page_no = static_cast<uint32_t>(
prev_log_addr.page);
purge_sys.rseg->set_last_commit(prev_log_addr.boffset, trx_no);
purge_sys.rseg->needs_purge = log_hdr[TRX_UNDO_NEEDS_PURGE + 1] != 0;
purge_sys.rseg->needs_purge = needs_purge != 0;
/* Purge can also produce events, however these are already ordered
in the rollback segment and any user generated event will be greater