[MDEV-27891] Delayed SIGSEGV in buf_pool_t::resize on InnoDB buffer pool resize after or during DROP TABLE Created: 2022-02-19 Updated: 2022-03-08 Resolved: 2022-03-07 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Storage Engine - InnoDB |
| Affects Version/s: | 10.6.7, 10.8, 10.9 |
| Fix Version/s: | 10.6.8, 10.7.4, 10.8.3 |
| Type: | Bug | Priority: | Blocker |
| Reporter: | Roel Van de Paar | Assignee: | Daniel Black |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | not-10.2, not-10.3, not-10.4, not-10.5 | ||
| Issue Links: |
|
||||||||||||||||
| Description |
|
Leads to:
Bug confirmed present in: Bug (or feature/syntax) confirmed not present in: |
| Comments |
| Comment by Marko Mäkelä [ 2022-02-21 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Here is a simpler test case:
If I essentially revert
For me, the code crashed like this:
The crashing statement is in the loop body (dereferencing an invalid chunk):
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Daniel Black [ 2022-02-22 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
The above crashing loop is in a withdrawing blocks loop. Given we've increased the buffer pool size (twice), this shouldn't be happening. At the crash location:
cur_size (the new instance size) is < old_size hence entering this for loop. With n_chunks_new > n_chunks this loop was only going to terminate on segfault. The below resolves the test case, but not why old_size is out of sync.
As curr_size vs old_size comparisons and changes are always under the pool mutex, can we replace the curr_size -> n_chunks_new and old_size -> n_chunks for relative operations, and for running_out (only absolute reference to both) multiply by the chunk_size (and hold the mutex during calculation). n_chunks and n_chunks_new should loose their volatile compiler optimization too. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Daniel Black [ 2022-02-22 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
With an explict innodb-buffer-pool-chunk-size=1M, like
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Daniel Black [ 2022-02-28 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
update https://github.com/MariaDB/server/pull/2025 biggest question is a simple running_out implementation based on resized size acceptable. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Marko Mäkelä [ 2022-03-04 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Thank you, the revised fix looks acceptable to me. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Daniel Black [ 2022-03-07 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Thanks marko. Merged. Existing n_chunks_new/n_chunks usage outside of mutex doesn't seem as safe as I originally suspected. Functions noted in commit message. |