Commit c0a84fb9 authored by Marko Mäkelä's avatar Marko Mäkelä

MDEV-26465 Race condition in trx_purge_rseg_get_next_history_log()

trx_purge_rseg_get_next_history_log(): Fix a race condition that
was introduced in commit e46f76c9
(MDEV-15912). The buffer pool page contents must not be accessed
while not holding a page latch. The page latch was released by
mtr_t::commit().

This race resulted in an ASAN heap-use-after-poison during a stress test.
parent 687417e5
...@@ -1155,15 +1155,16 @@ static void trx_purge_rseg_get_next_history_log( ...@@ -1155,15 +1155,16 @@ static void trx_purge_rseg_get_next_history_log(
trx_no = mach_read_from_8(log_hdr + TRX_UNDO_TRX_NO); trx_no = mach_read_from_8(log_hdr + TRX_UNDO_TRX_NO);
ut_ad(mach_read_from_2(log_hdr + TRX_UNDO_NEEDS_PURGE) <= 1); ut_ad(mach_read_from_2(log_hdr + TRX_UNDO_NEEDS_PURGE) <= 1);
const byte needs_purge = log_hdr[TRX_UNDO_NEEDS_PURGE + 1];
mtr_commit(&mtr); mtr.commit();
mutex_enter(&purge_sys.rseg->mutex); mutex_enter(&purge_sys.rseg->mutex);
purge_sys.rseg->last_page_no = static_cast<uint32_t>( purge_sys.rseg->last_page_no = static_cast<uint32_t>(
prev_log_addr.page); prev_log_addr.page);
purge_sys.rseg->set_last_commit(prev_log_addr.boffset, trx_no); purge_sys.rseg->set_last_commit(prev_log_addr.boffset, trx_no);
purge_sys.rseg->needs_purge = log_hdr[TRX_UNDO_NEEDS_PURGE + 1] != 0; purge_sys.rseg->needs_purge = needs_purge != 0;
/* Purge can also produce events, however these are already ordered /* Purge can also produce events, however these are already ordered
in the rollback segment and any user generated event will be greater in the rollback segment and any user generated event will be greater
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment