comdb2 icon indicating copy to clipboard operation
comdb2 copied to clipboard

Invalid read in parallel replication

Open morgando opened this issue 9 months ago • 0 comments

Describe the bug When the processor thread commits a logical transaction, it frees the tran_type struct associated with that transaction; however, the pointer to this struct is still stored as a thread-specific variable in the processor thread's parent. The parent then reads invalid memory here.

This is the memcheck output, for reference:

==13290== Invalid read of size 1
==13290==    at 0x36FA76: berkdb_send_rtn (rep.c:900)
==13290==    by 0x4690D2: __rep_send_message (rep_util.c:249)
==13290==    by 0x46087E: __rep_apply_int (rep_record.c:3592)
==13290==    by 0x461C04: __rep_apply (rep_record.c:3942)
==13290==    by 0x465532: __rep_process_message (rep_record.c:1626)
==13290==    by 0x375368: process_berkdb (rep.c:3906)
==13290==    by 0x375368: berkdb_receive_rtn_int (rep.c:5170)
==13290==    by 0x375368: berkdb_receive_rtn (rep.c:5274)
==13290==    by 0x50FF5D: process_user_msg (net_evbuffer.c:1168)
==13290==    by 0x511F8D: process_payload (net_evbuffer.c:1552)
==13290==    by 0x5121C1: process_net_msgs (net_evbuffer.c:1579)
==13290==    by 0x512831: rd_worker (net_evbuffer.c:1629)
==13290==    by 0x4DC4608: start_thread (pthread_create.c:477)
==13290==    by 0x4EFE352: clone (clone.S:95)
==13290==  Address 0x1824999a is 346 bytes inside a block of size 520 free'd
==13290==    at 0x483CA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==13290==    by 0x37BDB4: logical_release_transaction (rowlocks.c:2175)
==13290==    by 0x37BDB4: logical_commit_replicant (rowlocks.c:2183)
==13290==    by 0x45A4C0: processor_thd (rep_record.c:4544)
==13290==    by 0x3AA004: thdpool_thd (thdpool.c:815)
==13290==    by 0x4DC4608: start_thread (pthread_create.c:477)
==13290==    by 0x4EFE352: clone (clone.S:95)
==13290==  Block was alloc'd at
==13290==    at 0x483B7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==13290==    by 0x388B02: bdb_tran_begin_logical_int (tran.c:633)
==13290==    by 0x38A545: bdb_tran_start_logical (tran.c:1318)
==13290==    by 0x38A5C0: bdb_start_ltran (tran.c:290)
==13290==    by 0x38A5C0: berkdb_start_logical (tran.c:320)
==13290==    by 0x45EE89: __rep_process_txn_concurrent_int (rep_record.c:5766)
==13290==    by 0x45F52F: __rep_process_txn_concurrent (rep_record.c:6304)
==13290==    by 0x461008: __rep_apply_int (rep_record.c:3785)
==13290==    by 0x461C04: __rep_apply (rep_record.c:3942)
==13290==    by 0x465532: __rep_process_message (rep_record.c:1626)
==13290==    by 0x375368: process_berkdb (rep.c:3906)
==13290==    by 0x375368: berkdb_receive_rtn_int (rep.c:5170)
==13290==    by 0x375368: berkdb_receive_rtn (rep.c:5274)
==13290==    by 0x50FF5D: process_user_msg (net_evbuffer.c:1168)
==13290==    by 0x511F8D: process_payload (net_evbuffer.c:1552)
==13290==    by 0x5121C1: process_net_msgs (net_evbuffer.c:1579)
==13290==    by 0x512831: rd_worker (net_evbuffer.c:1629)
==13290==    by 0x4DC4608: start_thread (pthread_create.c:477)
==13290==    by 0x4EFE352: clone (clone.S:95)

To Reproduce Run sc_transactional under memcheck

morgando avatar May 07 '24 19:05 morgando