Skip to content

Commit ba95c30

Browse files
committed
MDEV-21167 LF_PINS::stack_ends_here inaccurate, leading to alloca() larger than stack
Use my_thread_var::stack_ends_here inside lf_pinbox_real_free() for address where thread stack ends. Remove LF_PINS::stack_ends_here. It is not safe to assume that mysys_var that was used during pin allocation, remains correct during free. E.g with binlog group commit in Innodb, that frees pins for multiple Innodb transactions, it does not work correctly.
1 parent 584ffa0 commit ba95c30

File tree

2 files changed

+5
-10
lines changed

2 files changed

+5
-10
lines changed

include/lf.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,6 @@ typedef struct {
6565
typedef struct {
6666
void * volatile pin[LF_PINBOX_PINS];
6767
LF_PINBOX *pinbox;
68-
void **stack_ends_here;
6968
void *purgatory;
7069
uint32 purgatory_count;
7170
uint32 volatile link;

mysys/lf_alloc-pin.c

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,6 @@ void lf_pinbox_destroy(LF_PINBOX *pinbox)
151151
*/
152152
LF_PINS *lf_pinbox_get_pins(LF_PINBOX *pinbox)
153153
{
154-
struct st_my_thread_var *var;
155154
uint32 pins, next, top_ver;
156155
LF_PINS *el;
157156
/*
@@ -194,12 +193,7 @@ LF_PINS *lf_pinbox_get_pins(LF_PINBOX *pinbox)
194193
el->link= pins;
195194
el->purgatory_count= 0;
196195
el->pinbox= pinbox;
197-
var= my_thread_var;
198-
/*
199-
Threads that do not call my_thread_init() should still be
200-
able to use the LF_HASH.
201-
*/
202-
el->stack_ends_here= (var ? & var->stack_ends_here : NULL);
196+
203197
return el;
204198
}
205199

@@ -335,16 +329,18 @@ static void lf_pinbox_real_free(LF_PINS *pins)
335329
void *list;
336330
void **addr= NULL;
337331
void *first= NULL, *last= NULL;
332+
struct st_my_thread_var *var= my_thread_var;
333+
void *stack_ends_here= var ? var->stack_ends_here : NULL;
338334
LF_PINBOX *pinbox= pins->pinbox;
339335

340336
npins= pinbox->pins_in_array+1;
341337

342338
#ifdef HAVE_ALLOCA
343-
if (pins->stack_ends_here != NULL)
339+
if (stack_ends_here != NULL)
344340
{
345341
int alloca_size= sizeof(void *)*LF_PINBOX_PINS*npins;
346342
/* create a sorted list of pinned addresses, to speed up searches */
347-
if (available_stack_size(&pinbox, *pins->stack_ends_here) >
343+
if (available_stack_size(&pinbox, stack_ends_here) >
348344
alloca_size + ALLOCA_SAFETY_MARGIN)
349345
{
350346
struct st_harvester hv;

0 commit comments

Comments
 (0)