Skip to content

Commit c0a84fb

Browse files
committed
MDEV-26465 Race condition in trx_purge_rseg_get_next_history_log()
trx_purge_rseg_get_next_history_log(): Fix a race condition that was introduced in commit e46f76c (MDEV-15912). The buffer pool page contents must not be accessed while not holding a page latch. The page latch was released by mtr_t::commit(). This race resulted in an ASAN heap-use-after-poison during a stress test.
1 parent 687417e commit c0a84fb

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

storage/innobase/trx/trx0purge.cc

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1155,15 +1155,16 @@ static void trx_purge_rseg_get_next_history_log(
11551155

11561156
trx_no = mach_read_from_8(log_hdr + TRX_UNDO_TRX_NO);
11571157
ut_ad(mach_read_from_2(log_hdr + TRX_UNDO_NEEDS_PURGE) <= 1);
1158+
const byte needs_purge = log_hdr[TRX_UNDO_NEEDS_PURGE + 1];
11581159

1159-
mtr_commit(&mtr);
1160+
mtr.commit();
11601161

11611162
mutex_enter(&purge_sys.rseg->mutex);
11621163

11631164
purge_sys.rseg->last_page_no = static_cast<uint32_t>(
11641165
prev_log_addr.page);
11651166
purge_sys.rseg->set_last_commit(prev_log_addr.boffset, trx_no);
1166-
purge_sys.rseg->needs_purge = log_hdr[TRX_UNDO_NEEDS_PURGE + 1] != 0;
1167+
purge_sys.rseg->needs_purge = needs_purge != 0;
11671168

11681169
/* Purge can also produce events, however these are already ordered
11691170
in the rollback segment and any user generated event will be greater

0 commit comments

Comments
 (0)