diff options
| author | Thirunarayanan Balathandayuthapani <thiru@mariadb.com> | 2019-04-24 12:31:24 +0530 |
|---|---|---|
| committer | Marko Mäkelä <marko.makela@mariadb.com> | 2019-04-24 11:46:14 +0300 |
| commit | d5da8ae04d57556f517c0f03afeafe73c6cc75d1 (patch) | |
| tree | d12ada3a85fbb66d7807a0daf1d755c5cfa4dae3 /sql | |
| parent | cb8d888c42aa9504db2df686f0e963b99079e287 (diff) | |
| download | mariadb-git-d5da8ae04d57556f517c0f03afeafe73c6cc75d1.tar.gz | |
MDEV-15772 Potential list overrun during XA recovery
InnoDB could return the same list again and again if the buffer
passed to trx_recover_for_mysql() is smaller than the number of
transactions that InnoDB recovered in XA PREPARE state.
We introduce the transaction state TRX_PREPARED_RECOVERED, which
is like TRX_PREPARED, but will be set during trx_recover_for_mysql()
so that each transaction will only be returned once.
Because init_server_components() is invoking ha_recover() twice,
we must reset the state of the transactions back to TRX_PREPARED
after returning the complete list, so that repeated traversals
will see the complete list again, instead of seeing an empty list.
Without this tweak, the test main.tc_heuristic_recover would hang
in MariaDB 10.1.
Diffstat (limited to 'sql')
| -rw-r--r-- | sql/handler.cc | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sql/handler.cc b/sql/handler.cc index ab4d9fd37c9..8c6270a042e 100644 --- a/sql/handler.cc +++ b/sql/handler.cc @@ -1740,6 +1740,7 @@ int ha_recover(HASH *commit_list) for (info.len= MAX_XID_LIST_SIZE ; info.list==0 && info.len > MIN_XID_LIST_SIZE; info.len/=2) { + DBUG_EXECUTE_IF("min_xa_len", info.len = 16;); info.list=(XID *)my_malloc(info.len*sizeof(XID), MYF(0)); } if (!info.list) |