diff options
| author | Luke Chen <luke.chen@mongodb.com> | 2021-05-21 16:40:50 +1000 |
|---|---|---|
| committer | Evergreen Agent <no-reply@evergreen.mongodb.com> | 2021-05-21 07:15:11 +0000 |
| commit | c29ac114551d425a34409ffb2bee052bfcc36f91 (patch) | |
| tree | 72611e583c96bfbe17e9db7adad87f4cd7da7591 /src | |
| parent | 3c8f5c86724afaf73adf8118c0c5564f59cc3f5a (diff) | |
| download | mongo-c29ac114551d425a34409ffb2bee052bfcc36f91.tar.gz | |
Import wiredtiger: 02da3990fb1d9da925ff5ba5e0ba7042b48f5c46 from branch mongodb-5.0
ref: 29fc5e8cfe..02da3990fb
for: 5.0.0
WT-7566 Resolve write after free for dead dhandle
Diffstat (limited to 'src')
| -rw-r--r-- | src/third_party/wiredtiger/import.data | 2 | ||||
| -rw-r--r-- | src/third_party/wiredtiger/src/include/cursor_inline.h | 8 |
2 files changed, 7 insertions, 3 deletions
diff --git a/src/third_party/wiredtiger/import.data b/src/third_party/wiredtiger/import.data index a26b8d3c09a..59e4dafe850 100644 --- a/src/third_party/wiredtiger/import.data +++ b/src/third_party/wiredtiger/import.data @@ -2,5 +2,5 @@ "vendor": "wiredtiger", "github": "wiredtiger/wiredtiger.git", "branch": "mongodb-5.0", - "commit": "29fc5e8cfe0666fc26efc00813fbac586f603dc8" + "commit": "02da3990fb1d9da925ff5ba5e0ba7042b48f5c46" } diff --git a/src/third_party/wiredtiger/src/include/cursor_inline.h b/src/third_party/wiredtiger/src/include/cursor_inline.h index f7862b59723..54bdc17e752 100644 --- a/src/third_party/wiredtiger/src/include/cursor_inline.h +++ b/src/third_party/wiredtiger/src/include/cursor_inline.h @@ -352,10 +352,14 @@ __wt_cursor_dhandle_decr_use(WT_SESSION_IMPL *session) dhandle = session->dhandle; - /* If we close a handle with a time of death set, clear it. */ + /* + * If we close a handle with a time of death set, clear it. The ordering is important: after + * decrementing the use count, there's a chance that the data handle can be freed. + */ WT_ASSERT(session, dhandle->session_inuse > 0); - if (__wt_atomic_subi32(&dhandle->session_inuse, 1) == 0 && dhandle->timeofdeath != 0) + if (dhandle->timeofdeath != 0 && dhandle->session_inuse == 1) dhandle->timeofdeath = 0; + (void)__wt_atomic_subi32(&dhandle->session_inuse, 1); } /* |