Uploaded image for project: 'WiredTiger'
  1. WiredTiger
  2. WT-7689

Fix double free in `__curhs_insert`

    • Type: Icon: Bug Bug
    • Resolution: Fixed
    • Priority: Icon: Major - P3 Major - P3
    • WT10.0.1, 4.4.8, 5.0.2, 5.1.0-rc0
    • Affects Version/s: None
    • Component/s: None
    • Labels:
      None
    • 3
    • Storage - Ra 2021-06-28

      If the insertion code path fails in the history store cursor, we can free the same update twice. We can easily reproduce this by injecting an error with a patch like this:

      modified   src/cursor/cur_hs.c                                                                                                                                                        
      @@ -914,6 +914,11 @@ __curhs_insert(WT_CURSOR *cursor)                                                                                                                                
               hs_upd = hs_tombstone;                                                                                                                                                       
           }                                                                                                                                                                                
                                                                                                                                                                                            
      +    /* Randomly produce errors. */                                                                                                                                                   
      +    if (rand() % 5 == 0)                                                                                                                                                             
      +        ret = EBUSY;                                                                                                                                                                 
      +    WT_ERR(ret);                                                                                                                                                                     
      +                                                                                                                                                                                     
           do {                                                                                                                                                                             
               WT_WITH_PAGE_INDEX(session, ret = __curhs_search(cbt, true));                                                                                                                
               WT_ERR(ret);
      

            Assignee:
            alex.cameron@mongodb.com Alex Cameron (Inactive)
            Reporter:
            alex.cameron@mongodb.com Alex Cameron (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: