1berry/MariaDB-server
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MDEV-26465 Race condition in trx_purge_rseg_get_next_history_log()

Browse Source 
trx_purge_rseg_get_next_history_log(): Fix a race condition that
was introduced in commit e46f76c9749d7758765ba274a212cfc2dcf3eeb8
(MDEV-15912). The buffer pool page contents must not be accessed
while not holding a page latch. The page latch was released by
mtr_t::commit().

This race resulted in an ASAN heap-use-after-poison during a stress test.
This commit is contained in:
Marko Mäkelä 2021-08-23 17:00:01 +03:00
parent 687417e5c5
commit c0a84fb9b0
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
storage/innobase/trx/trx0purge.cc
View File

@ -1155,15 +1155,16 @@ static void trx_purge_rseg_get_next_history_log(
trx_no = mach_read_from_8(log_hdr + TRX_UNDO_TRX_NO); trx_no = mach_read_from_8(log_hdr + TRX_UNDO_TRX_NO);
ut_ad(mach_read_from_2(log_hdr + TRX_UNDO_NEEDS_PURGE) <= 1); ut_ad(mach_read_from_2(log_hdr + TRX_UNDO_NEEDS_PURGE) <= 1);
const byte needs_purge = log_hdr[TRX_UNDO_NEEDS_PURGE + 1];
mtr_commit(&mtr); mtr.commit();
mutex_enter(&purge_sys.rseg->mutex); mutex_enter(&purge_sys.rseg->mutex);
purge_sys.rseg->last_page_no = static_cast<uint32_t>( purge_sys.rseg->last_page_no = static_cast<uint32_t>(
prev_log_addr.page); prev_log_addr.page);
purge_sys.rseg->set_last_commit(prev_log_addr.boffset, trx_no); purge_sys.rseg->set_last_commit(prev_log_addr.boffset, trx_no);
purge_sys.rseg->needs_purge = log_hdr[TRX_UNDO_NEEDS_PURGE + 1] != 0; purge_sys.rseg->needs_purge = needs_purge != 0;
/* Purge can also produce events, however these are already ordered /* Purge can also produce events, however these are already ordered
in the rollback segment and any user generated event will be greater in the rollback segment and any user generated event will be greater