Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-19660

wsrep_rec_get_foreign_key() is dereferencing a stale pointer to a page that was previously latched

    Details

      Description

      In row_ins_foreign_check_on_constraint(), clustered index record is being passed to wsrep_append_foreign_key() after releasing the latch. If a record has been changed by other thread in the meantime then it could lead to a crash when
      wsrep_rec_get_foreign_key () tries to access the record.

      The following is the problematic code :

              btr_pcur_store_position(pcur, mtr); 
       
              if (index == clust_index) {
                      btr_pcur_copy_stored_position(cascade->pcur, pcur);
              } else {
                      btr_pcur_store_position(cascade->pcur, mtr);
              }
       
              mtr_commit(mtr);
       
              ut_a(cascade->pcur->rel_pos == BTR_PCUR_ON);
              
              cascade->state = UPD_NODE_UPDATE_CLUSTERED;
              
      #ifdef WITH_WSREP
              err = wsrep_append_foreign_key(
                                              thr_get_trx(thr),
                                              foreign,
                                              clust_rec,
                                              clust_index,
                                              FALSE,
                                              (node) ? TRUE : FALSE);
      

        Attachments

          Activity

            People

            • Assignee:
              jplindst Jan Lindström
              Reporter:
              thiru Thirunarayanan Balathandayuthapani
            • Votes:
              1 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: