Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MDEV-35046 SIGSEGV in list_delete in optimized builds when using pseu… #3620

Open
wants to merge 1 commit into
base: 11.4
Choose a base branch
from

Conversation

DaveGosselin-MariaDB
Copy link
Member

…do_slave_mode

This patch disallows OPTIMIZE TABLE when (1) in pseudo slave mode and (2) after the session has run XA PREPARE, matching the behavior of the system when pseudo slave mode is disabled.

This patch fixes a memory corruption issue where we would tell innodb to delete a table, which it correctly dropped, but then the SQL layer would not remove it from the correct trx_t structure. Later, when the session closed and we iterated tables on trx_t (specifically mod_tables), we would attempt to access memory associated with the dropped table and crash.

When in pseudo slave mode, we "forget" that we're within an XA transaction during XA PREPARE, and we can't reject statements like OPTIMIZE TABLE. XA PREPARE with pseudo-slave mode enabled resets the XA transaction sim state to one-phase commit by clearing the cached XA transaction state (that is, by setting to NULL the xid_state.xid_cache_element in slave_applier_reset_xa_trans. So we need a way to remember that we're in pseudo slave mode for a particular transaction and also remember whatever transaction ID is in flight.

With that information, we can lookup the XA transaction ID when dropping a table and, if it exists, use that instead of the XA state information associated between the handler and THD. Of course, as a fallback, we will still look at the XA state (trx_t) associated between the handler and THD when the XA transaction doesn't exist (because we're not in XA, or it rolled-back, etc). This fixes the memory corruption by removing the table from the correct trx_t structure when we tell innodb to delete it, keeping consistency.

@CLAassistant
Copy link

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@DaveGosselin-MariaDB DaveGosselin-MariaDB changed the base branch from 11.2 to 11.4 November 8, 2024 14:21
…do_slave_mode

This patch disallows OPTIMIZE TABLE when (1) in pseudo slave mode and
(2) after the session has run XA PREPARE, matching the behavior of
the system when pseudo slave mode is disabled.

This patch fixes a memory corruption issue where we would tell innodb
to delete a table, which it correctly dropped, but then the SQL layer
would not remove it from the correct trx_t structure.  Later, when the
session closed and we iterated tables on trx_t (specifically mod_tables),
we would attempt to access memory associated with the dropped table
and crash.

When in pseudo slave mode, we "forget" that we're within an XA
transaction during XA PREPARE, and we can't reject statements like
OPTIMIZE TABLE. XA PREPARE with pseudo-slave mode enabled resets the
XA transaction sim state to one-phase commit by clearing the cached
XA transaction state (that is, by setting to NULL the
xid_state.xid_cache_element in slave_applier_reset_xa_trans.  So we
need a way to remember that we're in pseudo slave mode for a particular
transaction and also remember whatever transaction ID is in flight.

With that information, we can lookup the XA transaction ID when
dropping a table and, if it exists, use that instead of the XA state
information associated between the handler and THD.  Of course, as a
fallback, we will still look at the XA state (trx_t) associated
between the handler and THD when the XA transaction doesn't exist
(because we're not in XA, or it rolled-back, etc).  This fixes the
memory corruption by removing the table from the correct trx_t
structure when we tell innodb to delete it, keeping consistency.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants