Commit f4b6dab2 authored by unknown's avatar unknown

fil0fil.c:

  Add assertions to check that we do not go out of bounds of io thread status array
os0file.c:
  Fix memory corruption (assertion failure on line 244 of sync0sync.c) reported by Miguel in a Windows build of MySQL-4.1.2. The bug is present in all InnoDB versions in Windows, but it depends on how the linker places a static array in srv0srv.c, whether the bug shows itself. 4 bytes were overwritten with a pointer to a statically allocated string: 'get windows aio return value'.


innobase/os/os0file.c:
  Fix memory corruption (assertion failure on line 244 of sync0sync.c) reported by Miguel in a Windows build of MySQL-4.1.2. The bug is present in all InnoDB versions in Windows, but it depends on how the linker places a static array in srv0srv.c, whether the bug shows itself. 4 bytes were overwritten with a pointer to a statically allocated string: 'get windows aio return value'.
innobase/fil/fil0fil.c:
  Add assertions to check that we do not go out of bounds of io thread status array
parent bdb370c8
...@@ -1331,6 +1331,7 @@ fil_aio_wait( ...@@ -1331,6 +1331,7 @@ fil_aio_wait(
ut_ad(fil_validate()); ut_ad(fil_validate());
if (os_aio_use_native_aio) { if (os_aio_use_native_aio) {
ut_a(segment < SRV_MAX_N_IO_THREADS);
srv_io_thread_op_info[segment] = (char *) "native aio handle"; srv_io_thread_op_info[segment] = (char *) "native aio handle";
#ifdef WIN_ASYNC_IO #ifdef WIN_ASYNC_IO
ret = os_aio_windows_handle(segment, 0, &fil_node, &message, ret = os_aio_windows_handle(segment, 0, &fil_node, &message,
...@@ -1342,6 +1343,7 @@ fil_aio_wait( ...@@ -1342,6 +1343,7 @@ fil_aio_wait(
ut_error; ut_error;
#endif #endif
} else { } else {
ut_a(segment < SRV_MAX_N_IO_THREADS);
srv_io_thread_op_info[segment] =(char *)"simulated aio handle"; srv_io_thread_op_info[segment] =(char *)"simulated aio handle";
ret = os_aio_simulated_handle(segment, (void**) &fil_node, ret = os_aio_simulated_handle(segment, (void**) &fil_node,
...@@ -1350,6 +1352,7 @@ fil_aio_wait( ...@@ -1350,6 +1352,7 @@ fil_aio_wait(
ut_a(ret); ut_a(ret);
ut_a(segment < SRV_MAX_N_IO_THREADS);
srv_io_thread_op_info[segment] = (char *) "complete io for fil node"; srv_io_thread_op_info[segment] = (char *) "complete io for fil node";
mutex_enter(&(system->mutex)); mutex_enter(&(system->mutex));
...@@ -1363,10 +1366,12 @@ fil_aio_wait( ...@@ -1363,10 +1366,12 @@ fil_aio_wait(
/* Do the i/o handling */ /* Do the i/o handling */
if (buf_pool_is_block(message)) { if (buf_pool_is_block(message)) {
ut_a(segment < SRV_MAX_N_IO_THREADS);
srv_io_thread_op_info[segment] = srv_io_thread_op_info[segment] =
(char *) "complete io for buf page"; (char *) "complete io for buf page";
buf_page_io_complete(message); buf_page_io_complete(message);
} else { } else {
ut_a(segment < SRV_MAX_N_IO_THREADS);
srv_io_thread_op_info[segment] =(char *) "complete io for log"; srv_io_thread_op_info[segment] =(char *) "complete io for log";
log_io_complete(message); log_io_complete(message);
} }
......
...@@ -1586,6 +1586,7 @@ os_aio_init( ...@@ -1586,6 +1586,7 @@ os_aio_init(
os_io_init_simple(); os_io_init_simple();
for (i = 0; i < n_segments; i++) { for (i = 0; i < n_segments; i++) {
ut_a(i < SRV_MAX_N_IO_THREADS);
srv_io_thread_op_info[i] = (char*)"not started yet"; srv_io_thread_op_info[i] = (char*)"not started yet";
} }
...@@ -1606,12 +1607,14 @@ os_aio_init( ...@@ -1606,12 +1607,14 @@ os_aio_init(
os_aio_read_array = os_aio_array_create(n_read_segs * n_per_seg, os_aio_read_array = os_aio_array_create(n_read_segs * n_per_seg,
n_read_segs); n_read_segs);
for (i = 2; i < 2 + n_read_segs; i++) { for (i = 2; i < 2 + n_read_segs; i++) {
ut_a(i < SRV_MAX_N_IO_THREADS);
srv_io_thread_function[i] = (char*)"read thread"; srv_io_thread_function[i] = (char*)"read thread";
} }
os_aio_write_array = os_aio_array_create(n_write_segs * n_per_seg, os_aio_write_array = os_aio_array_create(n_write_segs * n_per_seg,
n_write_segs); n_write_segs);
for (i = 2 + n_read_segs; i < n_segments; i++) { for (i = 2 + n_read_segs; i < n_segments; i++) {
ut_a(i < SRV_MAX_N_IO_THREADS);
srv_io_thread_function[i] = (char*)"write thread"; srv_io_thread_function[i] = (char*)"write thread";
} }
...@@ -2324,11 +2327,10 @@ os_aio_windows_handle( ...@@ -2324,11 +2327,10 @@ os_aio_windows_handle(
n = array->n_slots / array->n_segments; n = array->n_slots / array->n_segments;
if (array == os_aio_sync_array) { if (array == os_aio_sync_array) {
srv_io_thread_op_info[orig_seg] =
"wait Windows aio for 1 page";
os_event_wait(os_aio_array_get_nth_slot(array, pos)->event); os_event_wait(os_aio_array_get_nth_slot(array, pos)->event);
i = pos; i = pos;
} else { } else {
ut_a(orig_seg < SRV_MAX_N_IO_THREADS);
srv_io_thread_op_info[orig_seg] = srv_io_thread_op_info[orig_seg] =
"wait Windows aio"; "wait Windows aio";
i = os_event_wait_multiple(n, i = os_event_wait_multiple(n,
...@@ -2341,7 +2343,12 @@ os_aio_windows_handle( ...@@ -2341,7 +2343,12 @@ os_aio_windows_handle(
ut_a(slot->reserved); ut_a(slot->reserved);
srv_io_thread_op_info[orig_seg] = "get windows aio return value"; if (orig_seg != ULINT_UNDEFINED) {
ut_a(orig_seg < SRV_MAX_N_IO_THREADS);
srv_io_thread_op_info[orig_seg] =
"get windows aio return value";
}
ret = GetOverlappedResult(slot->file, &(slot->control), &len, TRUE); ret = GetOverlappedResult(slot->file, &(slot->control), &len, TRUE);
*message1 = slot->message1; *message1 = slot->message1;
...@@ -2664,6 +2671,7 @@ consecutive_loop: ...@@ -2664,6 +2671,7 @@ consecutive_loop:
} }
} }
ut_a(global_segment < SRV_MAX_N_IO_THREADS);
srv_io_thread_op_info[global_segment] = (char*) "doing file i/o"; srv_io_thread_op_info[global_segment] = (char*) "doing file i/o";
if (os_aio_print_debug) { if (os_aio_print_debug) {
...@@ -2714,6 +2722,7 @@ consecutive_loop: ...@@ -2714,6 +2722,7 @@ consecutive_loop:
} }
ut_a(ret); ut_a(ret);
ut_a(global_segment < SRV_MAX_N_IO_THREADS);
srv_io_thread_op_info[global_segment] = (char*) "file i/o done"; srv_io_thread_op_info[global_segment] = (char*) "file i/o done";
/* printf("aio: %lu consecutive %lu:th segment, first offs %lu blocks\n", /* printf("aio: %lu consecutive %lu:th segment, first offs %lu blocks\n",
...@@ -2772,6 +2781,7 @@ wait_for_io: ...@@ -2772,6 +2781,7 @@ wait_for_io:
os_mutex_exit(array->mutex); os_mutex_exit(array->mutex);
recommended_sleep: recommended_sleep:
ut_a(global_segment < SRV_MAX_N_IO_THREADS);
srv_io_thread_op_info[global_segment] = srv_io_thread_op_info[global_segment] =
(char*)"waiting for i/o request"; (char*)"waiting for i/o request";
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment