Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-19660

wsrep_rec_get_foreign_key() is dereferencing a stale pointer to a page that was previously latched

    XMLWordPrintable

Details

    Description

      In row_ins_foreign_check_on_constraint(), clustered index record is being passed to wsrep_append_foreign_key() after releasing the latch. If a record has been changed by other thread in the meantime then it could lead to a crash when
      wsrep_rec_get_foreign_key () tries to access the record.

      The following is the problematic code :

              btr_pcur_store_position(pcur, mtr); 
       
              if (index == clust_index) {
                      btr_pcur_copy_stored_position(cascade->pcur, pcur);
              } else {
                      btr_pcur_store_position(cascade->pcur, mtr);
              }
       
              mtr_commit(mtr);
       
              ut_a(cascade->pcur->rel_pos == BTR_PCUR_ON);
              
              cascade->state = UPD_NODE_UPDATE_CLUSTERED;
              
      #ifdef WITH_WSREP
              err = wsrep_append_foreign_key(
                                              thr_get_trx(thr),
                                              foreign,
                                              clust_rec,
                                              clust_index,
                                              FALSE,
                                              (node) ? TRUE : FALSE);
      

      Attachments

        Activity

          People

            jplindst Jan Lindström (Inactive)
            thiru Thirunarayanan Balathandayuthapani
            Votes:
            1 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.