[MDEV-16371] Fix for memory write order inversion and other issues related to MW-328A Created: 2018-06-01  Updated: 2023-04-27

Status: Stalled
Project: MariaDB Server
Component/s: Server
Affects Version/s: 10.3
Fix Version/s: 10.4

Type: Bug Priority: Major
Reporter: Sergey Vojtovich Assignee: Sergei Golubchik
Resolution: Unresolved Votes: 0
Labels: None


 Description   

This patch fixes problems with "memory write order inversion" and
other problems that lead to the inoperability of the MW-328A test
from the Galera test suite. The MariaDB code contains many places
where the values​of the variables "mysys_var->current_cond" and
"mysys_var->current_mutex" are synchronously changed. Usually,
the zeroing of these variables is protected by the capture of
"mysys_var->mutex" mutex, but their initialization with non-zero
values usually is not protected with this mutex. To avoid the
problems caused by memory write order inversion, one of the code
fragments (in the sql/sql_class.cc file) uses mysql_cond_broadcast
for "mysys_var->current_cond" with additional checks and loop with
sleep(). However, there are several other places in the MariaDB
code where the similar broadcast is performed without additional
checks. In addition, there are many code fragments where broadcast
can be ignored because the enter_cond() is called after the
"thd->killed" flag is set, but (possibly) before checking the
"mysys_var->current_cond" variable by another thread (before
broadcast). So I added additional checks for "thd->killed" to
the code.



 Comments   
Comment by Sergey Vojtovich [ 2018-06-05 ]

serg, please review 6 patches in bb-10.3-svoj with MDEV-16371 tag.

Problems highlights:

  • reverse mutex locks in killer and victim threads
  • 8 different implementations of "killing"
  • current_cond and current_mutex are not set atomically, different "victims" implementations update them in different order. As a result condition "if (current_cond)" used by some "killers" doesn't guarantee current_mutex != 0.
  • abort and current_cond/current_mutex accesses are free to be reordered as well, because "killers" and "victims" hold different mutexes
Generated at Thu Feb 08 08:28:25 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.