Commit c0a84fb9 authored by Marko Mäkelä's avatar Marko Mäkelä

MDEV-26465 Race condition in trx_purge_rseg_get_next_history_log()

trx_purge_rseg_get_next_history_log(): Fix a race condition that
was introduced in commit e46f76c9
(MDEV-15912). The buffer pool page contents must not be accessed
while not holding a page latch. The page latch was released by
mtr_t::commit().

This race resulted in an ASAN heap-use-after-poison during a stress test.
parent 687417e5
......@@ -1155,15 +1155,16 @@ static void trx_purge_rseg_get_next_history_log(
trx_no = mach_read_from_8(log_hdr + TRX_UNDO_TRX_NO);
ut_ad(mach_read_from_2(log_hdr + TRX_UNDO_NEEDS_PURGE) <= 1);
const byte needs_purge = log_hdr[TRX_UNDO_NEEDS_PURGE + 1];
mtr_commit(&mtr);
mtr.commit();
mutex_enter(&purge_sys.rseg->mutex);
purge_sys.rseg->last_page_no = static_cast<uint32_t>(
prev_log_addr.page);
purge_sys.rseg->set_last_commit(prev_log_addr.boffset, trx_no);
purge_sys.rseg->needs_purge = log_hdr[TRX_UNDO_NEEDS_PURGE + 1] != 0;
purge_sys.rseg->needs_purge = needs_purge != 0;
/* Purge can also produce events, however these are already ordered
in the rollback segment and any user generated event will be greater
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment