Bug#20391552 CRASH DURING MEMCACHE WORKLOAD

aditya · aditya · commit e7a265bc115b · 2015-03-19T18:11:21.000+05:30
PROBLEM

Cursor transaction (crsr_trx) is initially used for a read operation (get) ,
so the crsr_trx-&gt;read_only option is set as 1,and then the same transaction
is used for write (set) operation without resetting the crsr_trx-&gt;read_only = 0
,so it crashes in the innodb layer. Usually the background thread commits
the transaction and resets it,but in this case the connection got the
connection lock first and reused the transaction which leads to crash.

FIX

Check the status of crsr_trx-&gt;read_only before using the transaction for
write.If set commit the transaction before reusing.
diff --git a/plugin/innodb_memcached/innodb_memcache/include/innodb_cb_api.h b/plugin/innodb_memcached/innodb_memcache/include/innodb_cb_api.h
@@ -1,6 +1,6 @@
 /***********************************************************************
 
-Copyright (c) 2011, 2013, Oracle and/or its affiliates. All rights reserved.
+Copyright (c) 2011, 2015, Oracle and/or its affiliates. All rights reserved.
 
 This program is free software; you can redistribute it and/or modify it
 under the terms of the GNU General Public License as published by the
@@ -463,6 +463,13 @@ ib_err_t
 /*====================*/
 	ib_crsr_t	ib_crsr);
 
+typedef
+ib_u32_t
+(*cb_trx_read_only_t)(
+/*==================*/
+	ib_trx_t	ib_trx);
+
+
 cb_open_table_t			ib_cb_open_table;
 cb_read_row_t			ib_cb_read_row;
 cb_insert_row_t			ib_cb_insert_row;
@@ -524,5 +531,6 @@ cb_cursor_clear_trx_t		ib_cb_cursor_clear_trx;
 cb_trx_get_start_time		ib_cb_trx_get_start_time;
 cb_bk_commit_interval		ib_cb_cfg_bk_commit_interval;
 cb_cursor_stmt_begin		ib_cb_cursor_stmt_begin;
+cb_trx_read_only_t		ib_cb_trx_read_only;
 
 #endif /* innodb_cb_api_h */
diff --git a/plugin/innodb_memcached/innodb_memcache/src/innodb_api.c b/plugin/innodb_memcached/innodb_memcache/src/innodb_api.c
@@ -101,7 +101,8 @@ static ib_cb_t* innodb_memcached_api[] = {
 	(ib_cb_t*) &ib_cb_get_idx_field_name,
 	(ib_cb_t*) &ib_cb_trx_get_start_time,
 	(ib_cb_t*) &ib_cb_cfg_bk_commit_interval,
-	(ib_cb_t*) &ib_cb_cursor_stmt_begin
+	(ib_cb_t*) &ib_cb_cursor_stmt_begin,
+	(ib_cb_t*) &ib_cb_trx_read_only
 };
 
 /** Set expiration time. If the exp sent by client is larger than
diff --git a/plugin/innodb_memcached/innodb_memcache/src/innodb_engine.c b/plugin/innodb_memcached/innodb_memcache/src/innodb_engine.c
@@ -810,6 +810,11 @@ innodb_conn_init(
 		} else {
 			/* Write cursor transaction exists.
 			   Reuse this transaction.*/
+			if (ib_cb_trx_read_only(conn_data->crsr_trx)) {
+				innodb_cb_trx_commit(
+					conn_data->crsr_trx);
+			}
+
 			assert(ib_cb_trx_start(conn_data->crsr_trx,
 					       engine->trx_level,
 					       true, false, NULL));
@@ -850,6 +855,11 @@ innodb_conn_init(
 					engine->trx_level, true, false);
 				trx_updated = true;
 			} else {
+				if (ib_cb_trx_read_only(conn_data->crsr_trx)) {
+					innodb_cb_trx_commit(
+						conn_data->crsr_trx);
+				}
+
 				ib_cb_trx_start(conn_data->crsr_trx,
 						engine->trx_level,
 						true, false, NULL);
@@ -915,6 +925,12 @@ innodb_conn_init(
 					engine, idx_crsr, lock_mode);
 			}
 		} else {
+
+			if (ib_cb_trx_read_only(conn_data->crsr_trx)) {
+				innodb_cb_trx_commit(
+					conn_data->crsr_trx);
+			}
+
 			ib_cb_trx_start(conn_data->crsr_trx,
 					engine->trx_level,
 					true, false, NULL);
diff --git a/storage/innobase/api/api0api.cc b/storage/innobase/api/api0api.cc
@@ -595,6 +595,21 @@ ib_trx_begin(
 	return(static_cast<ib_trx_t>(trx));
 }
 
+
+/*****************************************************************//**
+Check if transaction is read_only
+@return transaction read_only status */
+UNIV_INTERN
+ib_u32_t
+ib_trx_read_only(
+/*=============*/
+	ib_trx_t	ib_trx)		/*!< in: trx handle */
+{
+	trx_t*		trx = (trx_t*) ib_trx;
+
+	return(trx->read_only);
+}
+
 /*****************************************************************//**
 Get the transaction's state.
 @return	transaction state */
diff --git a/storage/innobase/handler/ha_innodb.cc b/storage/innobase/handler/ha_innodb.cc
@@ -482,7 +482,8 @@ ib_cb_t innodb_api_cb[] = {
 	(ib_cb_t) ib_get_idx_field_name,
 	(ib_cb_t) ib_trx_get_start_time,
 	(ib_cb_t) ib_cfg_bk_commit_interval,
-	(ib_cb_t) ib_cursor_stmt_begin
+	(ib_cb_t) ib_cursor_stmt_begin,
+	(ib_cb_t) ib_trx_read_only
 };
 
 /*************************************************************//**
diff --git a/storage/innobase/include/api0api.h b/storage/innobase/include/api0api.h
@@ -1,6 +1,6 @@
 /*****************************************************************************
 
-Copyright (c) 2011, 2013, Oracle and/or its affiliates. All Rights Reserved.
+Copyright (c) 2011, 2015, Oracle and/or its affiliates. All Rights Reserved.
 
 This program is free software; you can redistribute it and/or modify it under
 the terms of the GNU General Public License as published by the Free Software
@@ -494,6 +494,14 @@ ib_trx_state(
 /*=========*/
 	ib_trx_t	ib_trx);	/*!< in: trx handle */
 
+
+/*****************************************************************//**
+Check if the transaction is read_only */
+ib_u32_t
+ib_trx_read_only(
+/*=============*/
+        ib_trx_t        ib_trx);         /*!< in: trx handle */
+
 /*****************************************************************//**
 Release the resources of the transaction. If the transaction was
 selected as a victim by InnoDB and rolled back then use this function
