Commit 5f22511e authored by Marko Mäkelä's avatar Marko Mäkelä

MDEV-26010: Assertion lsn > 2 failed in buf_pool_t::get_oldest_modification

In commit 22b62eda (MDEV-25113)
we introduced a race condition. buf_LRU_free_page() would read
buf_page_t::oldest_modification() as 0 and assume that
buf_page_t::list can be used (for attaching the block to the
buf_pool.free list). In the observed race condition,
buf_pool_t::delete_from_flush_list() had cleared the field,
and buf_pool_t::delete_from_flush_list_low() was executing
concurrently with buf_LRU_block_free_non_file_page(),
which resulted in buf_pool.flush_list.end becoming corrupted.

buf_pool_t::delete_from_flush_list(), buf_flush_relocate_on_flush_list():
First remove the block from buf_pool.flush_list, and only then
invoke buf_page_t::clear_oldest_modification(), to ensure that
reading oldest_modification()==0 really implies that the block
no longer is in buf_pool.flush_list.
parent e329dc8d
...@@ -208,10 +208,10 @@ void buf_pool_t::insert_into_flush_list(buf_block_t *block, lsn_t lsn) ...@@ -208,10 +208,10 @@ void buf_pool_t::insert_into_flush_list(buf_block_t *block, lsn_t lsn)
@param clear whether to invoke buf_page_t::clear_oldest_modification() */ @param clear whether to invoke buf_page_t::clear_oldest_modification() */
void buf_pool_t::delete_from_flush_list(buf_page_t *bpage, bool clear) void buf_pool_t::delete_from_flush_list(buf_page_t *bpage, bool clear)
{ {
if (clear)
bpage->clear_oldest_modification();
delete_from_flush_list_low(bpage); delete_from_flush_list_low(bpage);
stat.flush_list_bytes-= bpage->physical_size(); stat.flush_list_bytes-= bpage->physical_size();
if (clear)
bpage->clear_oldest_modification();
#ifdef UNIV_DEBUG #ifdef UNIV_DEBUG
buf_flush_validate_skip(); buf_flush_validate_skip();
#endif /* UNIV_DEBUG */ #endif /* UNIV_DEBUG */
...@@ -309,10 +309,10 @@ buf_flush_relocate_on_flush_list( ...@@ -309,10 +309,10 @@ buf_flush_relocate_on_flush_list(
the bpage from the flush list. */ the bpage from the flush list. */
buf_pool.flush_hp.adjust(bpage); buf_pool.flush_hp.adjust(bpage);
bpage->clear_oldest_modification();
prev = UT_LIST_GET_PREV(list, bpage); prev = UT_LIST_GET_PREV(list, bpage);
UT_LIST_REMOVE(buf_pool.flush_list, bpage); UT_LIST_REMOVE(buf_pool.flush_list, bpage);
bpage->clear_oldest_modification();
} else { } else {
/* bpage was removed from buf_pool.flush_list /* bpage was removed from buf_pool.flush_list
since we last checked, and before we acquired since we last checked, and before we acquired
......
...@@ -944,7 +944,7 @@ class buf_page_t ...@@ -944,7 +944,7 @@ class buf_page_t
lsn_t oldest_modification() const { return oldest_modification_; } lsn_t oldest_modification() const { return oldest_modification_; }
/** Set oldest_modification when adding to buf_pool.flush_list */ /** Set oldest_modification when adding to buf_pool.flush_list */
inline void set_oldest_modification(lsn_t lsn); inline void set_oldest_modification(lsn_t lsn);
/** Clear oldest_modification when removing from buf_pool.flush_list */ /** Clear oldest_modification after removing from buf_pool.flush_list */
inline void clear_oldest_modification(); inline void clear_oldest_modification();
/** Note that a block is no longer dirty, while not removing /** Note that a block is no longer dirty, while not removing
it from buf_pool.flush_list */ it from buf_pool.flush_list */
...@@ -2246,10 +2246,11 @@ inline void buf_page_t::set_oldest_modification(lsn_t lsn) ...@@ -2246,10 +2246,11 @@ inline void buf_page_t::set_oldest_modification(lsn_t lsn)
{ {
mysql_mutex_assert_owner(&buf_pool.flush_list_mutex); mysql_mutex_assert_owner(&buf_pool.flush_list_mutex);
ut_ad(oldest_modification() <= 1); ut_ad(oldest_modification() <= 1);
ut_ad(lsn > 2);
oldest_modification_= lsn; oldest_modification_= lsn;
} }
/** Clear oldest_modification when removing from buf_pool.flush_list */ /** Clear oldest_modification after removing from buf_pool.flush_list */
inline void buf_page_t::clear_oldest_modification() inline void buf_page_t::clear_oldest_modification()
{ {
mysql_mutex_assert_owner(&buf_pool.flush_list_mutex); mysql_mutex_assert_owner(&buf_pool.flush_list_mutex);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment