1
0
mirror of https://github.com/MariaDB/server.git synced 2025-11-25 17:25:02 +03:00
Files
mariadb/mysql-test/suite/innodb/t
Vlad Lesin b54e7b0cea MDEV-31185 rw_trx_hash_t::find() unpins pins too early
rw_trx_hash_t::find() acquires element->mutex, then unpins pins, used for
lf_hash element search. After that the "element" can be deallocated and
reused by some other thread.

If we take a look rw_trx_hash_t::insert()->lf_hash_insert()->lf_alloc_new()
calls, we will not find any element->mutex acquisition, as it was not
initialized yet before it's allocation. rw_trx_hash_t::insert() can reuse
the chunk, unpinned in rw_trx_hash_t::find().

The scenario is the following:

1. Thread 1 have just executed lf_hash_search() in
rw_trx_hash_t::find(), but have not acquired element->mutex yet.
2. Thread 2 have removed the element from hash table with
rw_trx_hash_t::erase() call.
3. Thread 1 acquired element->mutex and unpinned pin 2 pin with
lf_hash_search_unpin(pins) call.
4. Some thread purged memory of the element.
5. Thread 3 reused the memory for the element, filled element->id,
element->trx.
6. Thread 1 crashes with failed "DBUG_ASSERT(trx_id == trx->id)"
assertion.

Note that trx_t objects are also reused, see the code around trx_pools
for details.

The fix is to invoke "lf_hash_search_unpin(pins);" after element->trx is
stored in local variable in rw_trx_hash_t::find().

Reviewed by: Nikita Malyavin, Marko Mäkelä.
2023-05-19 15:50:20 +03:00
..
2020-05-05 20:33:10 +03:00
2019-04-05 11:41:03 +03:00
2021-09-11 11:14:18 +03:00
2019-05-29 22:17:00 +03:00
2022-07-27 11:02:57 +02:00
2020-09-03 15:53:38 +03:00
2022-10-05 20:30:57 +03:00
2021-08-18 16:47:03 +03:00
2019-08-21 15:23:45 +03:00
2019-04-25 16:05:20 +03:00
2020-01-20 08:41:52 +02:00
2022-02-17 10:53:58 +02:00
2021-07-02 11:48:51 +03:00
2022-09-07 08:08:59 +03:00
2018-09-14 08:47:22 +02:00
2019-05-29 11:32:46 +03:00
2022-12-13 11:37:33 +02:00
2021-03-08 09:39:54 +02:00
2022-09-13 16:36:38 +03:00
2020-10-29 13:38:38 +02:00
2022-10-05 20:30:57 +03:00
2020-07-31 11:54:35 +03:00
2020-09-21 12:29:00 +03:00
2019-07-16 18:39:21 +03:00
2022-10-05 20:30:57 +03:00
2018-05-17 09:37:01 +03:00
2019-04-26 15:31:31 +03:00