[MDEV-26465] Race condition in trx_purge_rseg_get_next_history_log() Created: 2021-08-23  Updated: 2021-10-21  Resolved: 2021-08-23

Status: Closed
Project: MariaDB Server
Component/s: Storage Engine - InnoDB
Affects Version/s: 10.3.31, 10.4.21, 10.5.12, 10.6.3, 10.6.4
Fix Version/s: 10.3.32, 10.4.22, 10.5.13, 10.6.5

Type: Bug Priority: Blocker
Reporter: Marko Mäkelä Assignee: Marko Mäkelä
Resolution: Fixed Votes: 0
Labels: ASAN, corruption, regression

Issue Links:
Problem/Incident
is caused by MDEV-15912 InnoDB: Failing assertion: purge_sys.... Closed

 Description   

In MDEV-15912, I made a mistake. The function trx_purge_rseg_get_next_history_log() would release the undo page latch by committing the mini-transaction. After that, we would wrongly read the page frame to assign a value of purge_sys.rseg->needs_purge.

This was caught by ASAN heap-use-after-poison in a stress test, presumably related to buffer pool resizing.
Generated at Thu Feb 08 09:45:31 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.