Skip to content

Commit b105427

Browse files
author
Jan Lindström
committed
MDEV-19660: wsrep_rec_get_foreign_key() is dereferencing a stale pointer to a page that was previously latched
In row_ins_foreign_check_on_constraint(), clustered index record is being passed to wsrep_append_foreign_key() after releasing the latch. If a record has been changed by other thread in the meantime then it could lead to a crash when wsrep_rec_get_foreign_key () tries to access the record. row_ins_foreign_check_on_constraint Use cascade->pcur->old_rec instead of clust_rec. row_ins_check_foreign_constraint Add missing error printout.
1 parent 82bb108 commit b105427

File tree

2 files changed

+12
-2
lines changed

2 files changed

+12
-2
lines changed

storage/innobase/row/row0ins.cc

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1293,7 +1293,7 @@ row_ins_foreign_check_on_constraint(
12931293
err = wsrep_append_foreign_key(
12941294
thr_get_trx(thr),
12951295
foreign,
1296-
clust_rec,
1296+
cascade->pcur->old_rec,
12971297
clust_index,
12981298
FALSE, WSREP_KEY_EXCLUSIVE);
12991299
if (err != DB_SUCCESS) {
@@ -1664,6 +1664,11 @@ row_ins_check_foreign_constraint(
16641664
check_index,
16651665
check_ref,
16661666
key_type);
1667+
1668+
if (err != DB_SUCCESS) {
1669+
fprintf(stderr,
1670+
"WSREP: foreign key append failed: %d\n", err);
1671+
}
16671672
#endif /* WITH_WSREP */
16681673
goto end_scan;
16691674
} else if (foreign->type != 0) {

storage/xtradb/row/row0ins.cc

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1299,7 +1299,7 @@ row_ins_foreign_check_on_constraint(
12991299
err = wsrep_append_foreign_key(
13001300
thr_get_trx(thr),
13011301
foreign,
1302-
clust_rec,
1302+
cascade->pcur->old_rec,
13031303
clust_index,
13041304
FALSE, WSREP_KEY_EXCLUSIVE);
13051305
if (err != DB_SUCCESS) {
@@ -1676,6 +1676,11 @@ row_ins_check_foreign_constraint(
16761676
check_index,
16771677
check_ref,
16781678
key_type);
1679+
1680+
if (err != DB_SUCCESS) {
1681+
fprintf(stderr,
1682+
"WSREP: foreign key append failed: %d\n", err);
1683+
}
16791684
#endif /* WITH_WSREP */
16801685
goto end_scan;
16811686
} else if (foreign->type != 0) {

0 commit comments

Comments
 (0)