Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40218

lock_rec_unlock_unmodified<CELL>() can release a stale per-cell latch after a concurrent lock_sys.rec_hash resize

    XMLWordPrintable

Details

    • Can result in hang or crash
    • Fixed a rare InnoDB race during XA PREPARE where a concurrent buffer-pool resize could cause the wrong lock latch to be released, risking a hang or crash.
    • Q3/2026 Server Maintenance

    Description

      In storage/innobase/lock/lock0lock.cc, lock_release_on_prepare_try() calls lock_rec_unlock_unmodified<CELL>() while holding a per-cell hash-latch acquired from a cell address computed before the call.

      On a secondary index, lock_rec_unlock_unmodified<CELL>() drops the cell latch and lock_sys.latch before calling lock_sec_rec_some_has_impl().
      It then re-acquires the lock_sys.latch in shared mode, recomputes the cell address and tries to latch the cell with the newly computed address.
      A concurrent lock_sys_t::hash_table::resize() (lock_sys.rec_hash grows with the buffer pool resize) during the lock_sys.rd_unlock() window, reallocates the cell array so the cell and its latch move.
      On return true from the lock_rec_unlock_unmodified<CELL>(), the caller's latch may be stale.
      The subsequent caller's latch->release() then may be invalid.

      A one-line fix is to replace, in lock_release_on_prepare_try() on the lock_rec_unlock_unmodified<CELL>() success path:

      latch->release();
      

      with

      lock_sys_t::hash_table::latch(lock_sys.rec_hash.cell_get(fold))->release();
      

      or have lock_rec_unlock_unmodified() report the cell/latch it holds on success, to avoid another lookup.

      Attachments

        Issue Links

          Activity

            People

              alessandro.vetere Alessandro Vetere
              alessandro.vetere Alessandro Vetere
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 1d
                  1d
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 1.75h Time Not Required
                  1.75h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.