diff options
| author | Sergey Vojtovich <svoj@mariadb.org> | 2015-03-17 19:49:04 +0400 |
|---|---|---|
| committer | Sergey Vojtovich <svoj@mariadb.org> | 2015-05-07 16:48:30 +0400 |
| commit | 7ed673f35c4b9baf7d343a4ad0d64ed6a9df912a (patch) | |
| tree | 17333dfcb07a34abf4e4530f78f257747876743e /sql/transaction.cc | |
| parent | b97568503640d62987daae6304d39302257ffcbb (diff) | |
| download | mariadb-git-7ed673f35c4b9baf7d343a4ad0d64ed6a9df912a.tar.gz | |
MDEV-7793 - Race condition between XA COMMIT/ROLLBACK and disconnect
XA COMMIT/ROLLBACK of XA transaction owned by different thread may access
freed memory if that thread disconnects at the same time.
Also concurrent XA COMMIT/ROLLBACK of recovered XA transaction were not
serialized properly.
Diffstat (limited to 'sql/transaction.cc')
| -rw-r--r-- | sql/transaction.cc | 15 |
1 files changed, 3 insertions, 12 deletions
diff --git a/sql/transaction.cc b/sql/transaction.cc index f84c4e5a892..8f0cbcc5eb4 100644 --- a/sql/transaction.cc +++ b/sql/transaction.cc @@ -837,18 +837,9 @@ bool trans_xa_commit(THD *thd) my_error(ER_OUT_OF_RESOURCES, MYF(0)); DBUG_RETURN(TRUE); } - /* - xid_state.in_thd is always true beside of xa recovery procedure. - Note, that there is no race condition here between xid_cache_search - and xid_cache_delete, since we always delete our own XID - (thd->lex->xid == thd->transaction.xid_state.xid). - The only case when thd->lex->xid != thd->transaction.xid_state.xid - and xid_state->in_thd == 0 is in the function - xa_cache_insert(XID, xa_states), which is called before starting - client connections, and thus is always single-threaded. - */ + XID_STATE *xs= xid_cache_search(thd, thd->lex->xid); - res= !xs || xs->in_thd; + res= !xs; if (res) my_error(ER_XAER_NOTA, MYF(0)); else @@ -949,7 +940,7 @@ bool trans_xa_rollback(THD *thd) } XID_STATE *xs= xid_cache_search(thd, thd->lex->xid); - if (!xs || xs->in_thd) + if (!xs) my_error(ER_XAER_NOTA, MYF(0)); else { |