database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-18 17:42:25 +03:00
Code Activity

Fix race condition in preparing a transaction for two-phase commit.

Browse Source 
To lock a prepared transaction's shared memory entry, we used to mark it
with the XID of the backend. When the XID was no longer active according
to the proc array, the entry was implicitly considered as not locked
anymore. However, when preparing a transaction, the backend's proc array
entry was cleared before transfering the locks (and some other state) to
the prepared transaction's dummy PGPROC entry, so there was a window where
another backend could finish the transaction before it was in fact fully
prepared.

To fix, rewrite the locking mechanism of global transaction entries. Instead
of an XID, just have simple locked-or-not flag in each entry (we store the
locking backend's backend id rather than a simple boolean, but that's just
for debugging purposes). The backend is responsible for explicitly unlocking
the entry, and to make sure that that happens, install a callback to unlock
it on abort or process exit.

Backpatch to all supported versions.
This commit is contained in:
Heikki Linnakangas
2014-05-15 16:37:50 +03:00
parent ff810b4928
commit bb38fb0d43
3 changed files with 144 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
src/backend/access/transam/xact.c
View File

@ -2231,9 +2231,13 @@ PrepareTransaction(void)
ProcArrayClearTransaction(MyProc);
/*
* This is all post-transaction cleanup. Note that if an error is raised
* here, it's too late to abort the transaction. This should be just
* noncritical resource releasing. See notes in CommitTransaction.
* In normal commit-processing, this is all non-critical post-transaction
* cleanup. When the transaction is prepared, however, it's important that
* the locks and other per-backend resources are transfered to the
* prepared transaction's PGPROC entry. Note that if an error is raised
* here, it's too late to abort the transaction. XXX: This probably should
* be in a critical section, to force a PANIC if any of this fails, but
* that cure could be worse than the disease.
*/
CallXactCallbacks(XACT_EVENT_PREPARE);
@ -2268,6 +2272,14 @@ PrepareTransaction(void)
RESOURCE_RELEASE_AFTER_LOCKS,
true, true);
/*
* Allow another backend to finish the transaction. After
* PostPrepare_Twophase(), the transaction is completely detached from
* our backend. The rest is just non-critical cleanup of backend-local
* state.
*/
PostPrepare_Twophase();
/* Check we've released all catcache entries */
AtEOXact_CatCache(true);
@ -2394,6 +2406,7 @@ AbortTransaction(void)
AtEOXact_LargeObject(false);
AtAbort_Notify();
AtEOXact_RelationMap(false);
AtAbort_Twophase();
/*
* Advertise the fact that we aborted in pg_clog (assuming that we got as