Uploaded image for project: 'WiredTiger'
  1. WiredTiger
  2. WT-8023

Use global transaction information to assess if a session has active transaction

    XMLWordPrintable

    Details

    • Type: Build Failure
    • Status: Closed
    • Priority: Major - P3
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: WT10.0.1, 5.0.4, 4.4.10, 5.1.0-rc0
    • Component/s: None
    • Labels:
      None
    • Story Points:
      3
    • Sprint:
      Storage - Ra 2021-09-06
    • Backport Requested:
      v5.0, v4.4

      Description

      UBSAN testing in v4.4 reported a possible null dereference in __wt_txn_user_active().  This looks like the problematic code:

          for (i = 0, session_in_list = conn->sessions; i < session_cnt; i++, session_in_list++) {
              /* Skip inactive sessions. */
              if (!session_in_list->active)
                  continue;
              /* Check if a user session has a running transaction. Ignore prepared transactions. */
              if (F_ISSET(session_in_list->txn, WT_TXN_RUNNING) &&
                !F_ISSET(session_in_list, WT_SESSION_INTERNAL) &&
                !F_ISSET(session_in_list->txn, WT_TXN_PREPARE)) {
       
       
                  txn_active = true;
                  break;
              }
          }
      

      UBSAN complains about the access to session_in_list->txn in the first use of the F_ISSET macro.  I assume the danger is that we race with a thread that is closing a session.  So in the code, above, session_in_list->active is true but by the time we start checking flags in the session's txn, it has been cleared.  

      This window is somewhat larger than it looks since __wt_session_close_internal() does a bunch of work between when it frees and clears its transaction and when it clears the active flag.

       It is not clear whether MongoDB code would actually trigger this race or if UBSAN is simply reporting that it is possible.

      Note that although the test failure was in v4.4, the same code and race is in the develop branch.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              haseeb.bokhari Haseeb Bokhari
              Reporter:
              keith.smith Keith Smith
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: