[MDEV-25979] Invalid undo page number written to DB_ROLL_PTR Created: 2021-06-21 Updated: 2021-06-22 Resolved: 2021-06-21 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Storage Engine - InnoDB |
| Affects Version/s: | 10.3.5, 10.4.0, 10.5.0, 10.6.0 |
| Fix Version/s: | 10.3.31, 10.4.21, 10.5.12, 10.6.3 |
| Type: | Bug | Priority: | Critical |
| Reporter: | Marko Mäkelä | Assignee: | Marko Mäkelä |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | corruption, race, regression-10.3, rr-profile-analyzed | ||
| Issue Links: |
|
||||||||
| Description |
|
This could cause various types of failure. In the trace that I analyzed most recently, the page had been evicted from the buffer pool by the LRU mechanism but not yet replaced with another page. Thus, the undo->top_page_no had been assigned to FIL_NULL, triggering an error message later when the DB_ROLL_PTR column in a B-tree record was dereferenced:
Note: the reported byte offset is 4096*0xffffffff. In another trace that I started analyzing earlier (with innodb_file_per_table=0 and no separate undo tablespaces), the error was something different. I suspect that the page had not only been evicted but the block descriptor started to point to a B-tree page. Thus, the DB_ROLL_PTR would wrongly point to a B-tree page instead of the undo log page that had just been written. Ultimately, an assertion failure would be triggered for attempting to interpret some bytes in the middle of a B-tree page as an undo log record. I think that it should be relatively hard to hit this bug in practice. It would likely require using an extremely small buffer pool, so that page eviction or replacement could take place between those 2 statements. |
| Comments |
| Comment by Marko Mäkelä [ 2021-06-21 ] | ||||||||||||||||||||||||
|
I confirmed last week’s mystery to be another case of this race condition:
That is, the undo log page that this thread had just been written is being evicted from the buffer pool. Before we copied the page number from the page descriptor, that page descriptor had been reassigned to the B-tree page 0x884. Finally, we would fail like this, because there was no valid undo log record in the middle of the B-tree page:
|