Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit48fc896

Browse files
committed
Fix race condition in preparing a transaction for two-phase commit.
To lock a prepared transaction's shared memory entry, we used to mark itwith the XID of the backend. When the XID was no longer active accordingto the proc array, the entry was implicitly considered as not lockedanymore. However, when preparing a transaction, the backend's proc arrayentry was cleared before transfering the locks (and some other state) tothe prepared transaction's dummy PGPROC entry, so there was a window whereanother backend could finish the transaction before it was in fact fullyprepared.To fix, rewrite the locking mechanism of global transaction entries. Insteadof an XID, just have simple locked-or-not flag in each entry (we store thelocking backend's backend id rather than a simple boolean, but that's justfor debugging purposes). The backend is responsible for explicitly unlockingthe entry, and to make sure that that happens, install a callback to unlockit on abort or process exit.Backpatch to all supported versions.
1 parent4511e6c commit48fc896

File tree

3 files changed

+144
-47
lines changed

3 files changed

+144
-47
lines changed

‎src/backend/access/transam/twophase.c

Lines changed: 125 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@
5757
#include"replication/walsender.h"
5858
#include"replication/syncrep.h"
5959
#include"storage/fd.h"
60+
#include"storage/ipc.h"
6061
#include"storage/predicate.h"
6162
#include"storage/proc.h"
6263
#include"storage/procarray.h"
@@ -81,25 +82,25 @@ intmax_prepared_xacts = 0;
8182
*
8283
* The lifecycle of a global transaction is:
8384
*
84-
* 1. After checking that the requested GID is not in use, set up an
85-
*entry inthe TwoPhaseState->prepXacts array with the correctXID andGID,
86-
*with locking_xid = my own XID and valid = false.
85+
* 1. After checking that the requested GID is not in use, set up an entry in
86+
* the TwoPhaseState->prepXacts array with the correctGID andvalid = false,
87+
*and mark it as locked by my backend.
8788
*
8889
* 2. After successfully completing prepare, set valid = true and enter the
8990
* referenced PGPROC into the global ProcArray.
9091
*
91-
* 3. To begin COMMIT PREPARED or ROLLBACK PREPARED, check that the entry
92-
*isvalid andits locking_xid is no longer active, then store my current
93-
*XIDintolocking_xid. This prevents concurrent attempts to commit or
94-
* rollback the same prepared xact.
92+
* 3. To begin COMMIT PREPARED or ROLLBACK PREPARED, check that the entry is
93+
* valid andnot locked, then mark the entry as locked by storing my current
94+
*backend IDintolocking_backend. This prevents concurrent attempts to
95+
*commit orrollback the same prepared xact.
9596
*
9697
* 4. On completion of COMMIT PREPARED or ROLLBACK PREPARED, remove the entry
9798
* from the ProcArray and the TwoPhaseState->prepXacts array and return it to
9899
* the freelist.
99100
*
100101
* Note that if the preparing transaction fails between steps 1 and 2, the
101-
* entrywill remain in prepXacts until recycled. We can detect recyclable
102-
*entries by checking for valid = false and locking_xid no longer active.
102+
* entrymust be removed so that the GID and the GlobalTransaction struct
103+
*can be reused. See AtAbort_Twophase().
103104
*
104105
* typedef struct GlobalTransactionData *GlobalTransaction appears in
105106
* twophase.h
@@ -114,8 +115,8 @@ typedef struct GlobalTransactionData
114115
TimestampTzprepared_at;/* time of preparation */
115116
XLogRecPtrprepare_lsn;/* XLOG offset of prepare record */
116117
Oidowner;/* ID of user that executed the xact */
117-
TransactionIdlocking_xid;/*top-level XID ofbackend working on xact */
118-
boolvalid;/* TRUE iffully prepared */
118+
BackendIdlocking_backend;/* backendcurrentlyworking on the xact */
119+
boolvalid;/* TRUE ifPGPROC entry is in proc array */
119120
chargid[GIDSIZE];/* The GID assigned to the prepared xact */
120121
}GlobalTransactionData;
121122

@@ -140,6 +141,12 @@ typedef struct TwoPhaseStateData
140141

141142
staticTwoPhaseStateData*TwoPhaseState;
142143

144+
/*
145+
* Global transaction entry currently locked by us, if any.
146+
*/
147+
staticGlobalTransactionMyLockedGxact=NULL;
148+
149+
staticbooltwophaseExitRegistered= false;
143150

144151
staticvoidRecordTransactionCommitPrepared(TransactionIdxid,
145152
intnchildren,
@@ -156,6 +163,7 @@ static void RecordTransactionAbortPrepared(TransactionId xid,
156163
RelFileNode*rels);
157164
staticvoidProcessRecords(char*bufptr,TransactionIdxid,
158165
constTwoPhaseCallbackcallbacks[]);
166+
staticvoidRemoveGXact(GlobalTransactiongxact);
159167

160168

161169
/*
@@ -229,6 +237,74 @@ TwoPhaseShmemInit(void)
229237
Assert(found);
230238
}
231239

240+
/*
241+
* Exit hook to unlock the global transaction entry we're working on.
242+
*/
243+
staticvoid
244+
AtProcExit_Twophase(intcode,Datumarg)
245+
{
246+
/* same logic as abort */
247+
AtAbort_Twophase();
248+
}
249+
250+
/*
251+
* Abort hook to unlock the global transaction entry we're working on.
252+
*/
253+
void
254+
AtAbort_Twophase(void)
255+
{
256+
if (MyLockedGxact==NULL)
257+
return;
258+
259+
/*
260+
* What to do with the locked global transaction entry? If we were in
261+
* the process of preparing the transaction, but haven't written the WAL
262+
* record and state file yet, the transaction must not be considered as
263+
* prepared. Likewise, if we are in the process of finishing an
264+
* already-prepared transaction, and fail after having already written
265+
* the 2nd phase commit or rollback record to the WAL, the transaction
266+
* should not be considered as prepared anymore. In those cases, just
267+
* remove the entry from shared memory.
268+
*
269+
* Otherwise, the entry must be left in place so that the transaction
270+
* can be finished later, so just unlock it.
271+
*
272+
* If we abort during prepare, after having written the WAL record, we
273+
* might not have transfered all locks and other state to the prepared
274+
* transaction yet. Likewise, if we abort during commit or rollback,
275+
* after having written the WAL record, we might not have released
276+
* all the resources held by the transaction yet. In those cases, the
277+
* in-memory state can be wrong, but it's too late to back out.
278+
*/
279+
if (!MyLockedGxact->valid)
280+
{
281+
RemoveGXact(MyLockedGxact);
282+
}
283+
else
284+
{
285+
LWLockAcquire(TwoPhaseStateLock,LW_EXCLUSIVE);
286+
287+
MyLockedGxact->locking_backend=InvalidBackendId;
288+
289+
LWLockRelease(TwoPhaseStateLock);
290+
}
291+
MyLockedGxact=NULL;
292+
}
293+
294+
/*
295+
* This is called after we have finished transfering state to the prepared
296+
* PGXACT entry.
297+
*/
298+
void
299+
PostPrepare_Twophase()
300+
{
301+
LWLockAcquire(TwoPhaseStateLock,LW_EXCLUSIVE);
302+
MyLockedGxact->locking_backend=InvalidBackendId;
303+
LWLockRelease(TwoPhaseStateLock);
304+
305+
MyLockedGxact=NULL;
306+
}
307+
232308

233309
/*
234310
* MarkAsPreparing
@@ -260,29 +336,15 @@ MarkAsPreparing(TransactionId xid, const char *gid,
260336
errmsg("prepared transactions are disabled"),
261337
errhint("Set max_prepared_transactions to a nonzero value.")));
262338

263-
LWLockAcquire(TwoPhaseStateLock,LW_EXCLUSIVE);
264-
265-
/*
266-
* First, find and recycle any gxacts that failed during prepare. We do
267-
* this partly to ensure we don't mistakenly say their GIDs are still
268-
* reserved, and partly so we don't fail on out-of-slots unnecessarily.
269-
*/
270-
for (i=0;i<TwoPhaseState->numPrepXacts;i++)
339+
/* on first call, register the exit hook */
340+
if (!twophaseExitRegistered)
271341
{
272-
gxact=TwoPhaseState->prepXacts[i];
273-
if (!gxact->valid&& !TransactionIdIsActive(gxact->locking_xid))
274-
{
275-
/* It's dead Jim ... remove from the active array */
276-
TwoPhaseState->numPrepXacts--;
277-
TwoPhaseState->prepXacts[i]=TwoPhaseState->prepXacts[TwoPhaseState->numPrepXacts];
278-
/* and put it back in the freelist */
279-
gxact->next=TwoPhaseState->freeGXacts;
280-
TwoPhaseState->freeGXacts=gxact;
281-
/* Back up index count too, so we don't miss scanning one */
282-
i--;
283-
}
342+
on_shmem_exit(AtProcExit_Twophase,0);
343+
twophaseExitRegistered= true;
284344
}
285345

346+
LWLockAcquire(TwoPhaseStateLock,LW_EXCLUSIVE);
347+
286348
/* Check for conflicting GID */
287349
for (i=0;i<TwoPhaseState->numPrepXacts;i++)
288350
{
@@ -339,14 +401,20 @@ MarkAsPreparing(TransactionId xid, const char *gid,
339401
/* initialize LSN to 0 (start of WAL) */
340402
gxact->prepare_lsn=0;
341403
gxact->owner=owner;
342-
gxact->locking_xid=xid;
404+
gxact->locking_backend=MyBackendId;
343405
gxact->valid= false;
344406
strcpy(gxact->gid,gid);
345407

346408
/* And insert it into the active array */
347409
Assert(TwoPhaseState->numPrepXacts<max_prepared_xacts);
348410
TwoPhaseState->prepXacts[TwoPhaseState->numPrepXacts++]=gxact;
349411

412+
/*
413+
* Remember that we have this GlobalTransaction entry locked for us.
414+
* If we abort after this, we must release it.
415+
*/
416+
MyLockedGxact=gxact;
417+
350418
LWLockRelease(TwoPhaseStateLock);
351419

352420
returngxact;
@@ -409,6 +477,13 @@ LockGXact(const char *gid, Oid user)
409477
{
410478
inti;
411479

480+
/* on first call, register the exit hook */
481+
if (!twophaseExitRegistered)
482+
{
483+
on_shmem_exit(AtProcExit_Twophase,0);
484+
twophaseExitRegistered= true;
485+
}
486+
412487
LWLockAcquire(TwoPhaseStateLock,LW_EXCLUSIVE);
413488

414489
for (i=0;i<TwoPhaseState->numPrepXacts;i++)
@@ -423,15 +498,11 @@ LockGXact(const char *gid, Oid user)
423498
continue;
424499

425500
/* Found it, but has someone else got it locked? */
426-
if (TransactionIdIsValid(gxact->locking_xid))
427-
{
428-
if (TransactionIdIsActive(gxact->locking_xid))
429-
ereport(ERROR,
430-
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
431-
errmsg("prepared transaction with identifier \"%s\" is busy",
432-
gid)));
433-
gxact->locking_xid=InvalidTransactionId;
434-
}
501+
if (gxact->locking_backend!=InvalidBackendId)
502+
ereport(ERROR,
503+
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
504+
errmsg("prepared transaction with identifier \"%s\" is busy",
505+
gid)));
435506

436507
if (user!=gxact->owner&& !superuser_arg(user))
437508
ereport(ERROR,
@@ -452,7 +523,8 @@ LockGXact(const char *gid, Oid user)
452523
errhint("Connect to the database where the transaction was prepared to finish it.")));
453524

454525
/* OK for me to lock it */
455-
gxact->locking_xid=GetTopTransactionId();
526+
gxact->locking_backend=MyBackendId;
527+
MyLockedGxact=gxact;
456528

457529
LWLockRelease(TwoPhaseStateLock);
458530

@@ -1088,6 +1160,13 @@ EndPrepare(GlobalTransaction gxact)
10881160
*/
10891161
MyPgXact->delayChkpt= false;
10901162

1163+
/*
1164+
* Remember that we have this GlobalTransaction entry locked for us. If
1165+
* we crash after this point, it's too late to abort, but we must unlock
1166+
* it so that the prepared transaction can be committed or rolled back.
1167+
*/
1168+
MyLockedGxact=gxact;
1169+
10911170
END_CRIT_SECTION();
10921171

10931172
/*
@@ -1334,8 +1413,9 @@ FinishPreparedTransaction(const char *gid, bool isCommit)
13341413

13351414
/*
13361415
* In case we fail while running the callbacks, mark the gxact invalid so
1337-
* no one else will try to commit/rollback, and so it can be recycled
1338-
* properly later. It is still locked by our XID so it won't go away yet.
1416+
* no one else will try to commit/rollback, and so it will be recycled
1417+
* if we fail after this point. It is still locked by our backend so it
1418+
* won't go away yet.
13391419
*
13401420
* (We assume it's safe to do this without taking TwoPhaseStateLock.)
13411421
*/
@@ -1395,6 +1475,7 @@ FinishPreparedTransaction(const char *gid, bool isCommit)
13951475
RemoveTwoPhaseFile(xid, true);
13961476

13971477
RemoveGXact(gxact);
1478+
MyLockedGxact=NULL;
13981479

13991480
pfree(buf);
14001481
}

‎src/backend/access/transam/xact.c

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2184,9 +2184,13 @@ PrepareTransaction(void)
21842184
ProcArrayClearTransaction(MyProc);
21852185

21862186
/*
2187-
* This is all post-transaction cleanup. Note that if an error is raised
2188-
* here, it's too late to abort the transaction. This should be just
2189-
* noncritical resource releasing. See notes in CommitTransaction.
2187+
* In normal commit-processing, this is all non-critical post-transaction
2188+
* cleanup. When the transaction is prepared, however, it's important that
2189+
* the locks and other per-backend resources are transfered to the
2190+
* prepared transaction's PGPROC entry. Note that if an error is raised
2191+
* here, it's too late to abort the transaction. XXX: This probably should
2192+
* be in a critical section, to force a PANIC if any of this fails, but
2193+
* that cure could be worse than the disease.
21902194
*/
21912195

21922196
CallXactCallbacks(XACT_EVENT_PREPARE);
@@ -2221,6 +2225,14 @@ PrepareTransaction(void)
22212225
RESOURCE_RELEASE_AFTER_LOCKS,
22222226
true, true);
22232227

2228+
/*
2229+
* Allow another backend to finish the transaction. After
2230+
* PostPrepare_Twophase(), the transaction is completely detached from
2231+
* our backend. The rest is just non-critical cleanup of backend-local
2232+
* state.
2233+
*/
2234+
PostPrepare_Twophase();
2235+
22242236
/* Check we've released all catcache entries */
22252237
AtEOXact_CatCache(true);
22262238

@@ -2347,6 +2359,7 @@ AbortTransaction(void)
23472359
AtEOXact_LargeObject(false);
23482360
AtAbort_Notify();
23492361
AtEOXact_RelationMap(false);
2362+
AtAbort_Twophase();
23502363

23512364
/*
23522365
* Advertise the fact that we aborted in pg_clog (assuming that we got as

‎src/include/access/twophase.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@ extern intmax_prepared_xacts;
3030
externSizeTwoPhaseShmemSize(void);
3131
externvoidTwoPhaseShmemInit(void);
3232

33+
externvoidAtAbort_Twophase(void);
34+
externvoidPostPrepare_Twophase(void);
35+
3336
externPGPROC*TwoPhaseGetDummyProc(TransactionIdxid);
3437
externBackendIdTwoPhaseGetDummyBackendId(TransactionIdxid);
3538

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp