Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitd8dbeb0

Browse files
committed
Fix race condition in preparing a transaction for two-phase commit.
To lock a prepared transaction's shared memory entry, we used to mark itwith the XID of the backend. When the XID was no longer active accordingto the proc array, the entry was implicitly considered as not lockedanymore. However, when preparing a transaction, the backend's proc arrayentry was cleared before transfering the locks (and some other state) tothe prepared transaction's dummy PGPROC entry, so there was a window whereanother backend could finish the transaction before it was in fact fullyprepared.To fix, rewrite the locking mechanism of global transaction entries. Insteadof an XID, just have simple locked-or-not flag in each entry (we store thelocking backend's backend id rather than a simple boolean, but that's justfor debugging purposes). The backend is responsible for explicitly unlockingthe entry, and to make sure that that happens, install a callback to unlockit on abort or process exit.Backpatch to all supported versions.
1 parenta2655a3 commitd8dbeb0

File tree

3 files changed

+144
-47
lines changed

3 files changed

+144
-47
lines changed

‎src/backend/access/transam/twophase.c‎

Lines changed: 125 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@
5757
#include"replication/walsender.h"
5858
#include"replication/syncrep.h"
5959
#include"storage/fd.h"
60+
#include"storage/ipc.h"
6061
#include"storage/predicate.h"
6162
#include"storage/procarray.h"
6263
#include"storage/sinvaladt.h"
@@ -80,25 +81,25 @@ intmax_prepared_xacts = 0;
8081
*
8182
* The lifecycle of a global transaction is:
8283
*
83-
* 1. After checking that the requested GID is not in use, set up an
84-
*entry inthe TwoPhaseState->prepXacts array with the correctXID andGID,
85-
*with locking_xid = my own XID and valid = false.
84+
* 1. After checking that the requested GID is not in use, set up an entry in
85+
* the TwoPhaseState->prepXacts array with the correctGID andvalid = false,
86+
*and mark it as locked by my backend.
8687
*
8788
* 2. After successfully completing prepare, set valid = true and enter the
8889
* referenced PGPROC into the global ProcArray.
8990
*
90-
* 3. To begin COMMIT PREPARED or ROLLBACK PREPARED, check that the entry
91-
*isvalid andits locking_xid is no longer active, then store my current
92-
*XIDintolocking_xid. This prevents concurrent attempts to commit or
93-
* rollback the same prepared xact.
91+
* 3. To begin COMMIT PREPARED or ROLLBACK PREPARED, check that the entry is
92+
* valid andnot locked, then mark the entry as locked by storing my current
93+
*backend IDintolocking_backend. This prevents concurrent attempts to
94+
*commit orrollback the same prepared xact.
9495
*
9596
* 4. On completion of COMMIT PREPARED or ROLLBACK PREPARED, remove the entry
9697
* from the ProcArray and the TwoPhaseState->prepXacts array and return it to
9798
* the freelist.
9899
*
99100
* Note that if the preparing transaction fails between steps 1 and 2, the
100-
* entrywill remain in prepXacts until recycled. We can detect recyclable
101-
*entries by checking for valid = false and locking_xid no longer active.
101+
* entrymust be removed so that the GID and the GlobalTransaction struct
102+
*can be reused. See AtAbort_Twophase().
102103
*
103104
* typedef struct GlobalTransactionData *GlobalTransaction appears in
104105
* twophase.h
@@ -113,8 +114,8 @@ typedef struct GlobalTransactionData
113114
TimestampTzprepared_at;/* time of preparation */
114115
XLogRecPtrprepare_lsn;/* XLOG offset of prepare record */
115116
Oidowner;/* ID of user that executed the xact */
116-
TransactionIdlocking_xid;/*top-level XID ofbackend working on xact */
117-
boolvalid;/* TRUE iffully prepared */
117+
BackendIdlocking_backend;/* backendcurrentlyworking on the xact */
118+
boolvalid;/* TRUE ifPGPROC entry is in proc array */
118119
chargid[GIDSIZE];/* The GID assigned to the prepared xact */
119120
}GlobalTransactionData;
120121

@@ -139,6 +140,12 @@ typedef struct TwoPhaseStateData
139140

140141
staticTwoPhaseStateData*TwoPhaseState;
141142

143+
/*
144+
* Global transaction entry currently locked by us, if any.
145+
*/
146+
staticGlobalTransactionMyLockedGxact=NULL;
147+
148+
staticbooltwophaseExitRegistered= false;
142149

143150
staticvoidRecordTransactionCommitPrepared(TransactionIdxid,
144151
intnchildren,
@@ -155,6 +162,7 @@ static void RecordTransactionAbortPrepared(TransactionId xid,
155162
RelFileNode*rels);
156163
staticvoidProcessRecords(char*bufptr,TransactionIdxid,
157164
constTwoPhaseCallbackcallbacks[]);
165+
staticvoidRemoveGXact(GlobalTransactiongxact);
158166

159167

160168
/*
@@ -228,6 +236,74 @@ TwoPhaseShmemInit(void)
228236
Assert(found);
229237
}
230238

239+
/*
240+
* Exit hook to unlock the global transaction entry we're working on.
241+
*/
242+
staticvoid
243+
AtProcExit_Twophase(intcode,Datumarg)
244+
{
245+
/* same logic as abort */
246+
AtAbort_Twophase();
247+
}
248+
249+
/*
250+
* Abort hook to unlock the global transaction entry we're working on.
251+
*/
252+
void
253+
AtAbort_Twophase(void)
254+
{
255+
if (MyLockedGxact==NULL)
256+
return;
257+
258+
/*
259+
* What to do with the locked global transaction entry? If we were in
260+
* the process of preparing the transaction, but haven't written the WAL
261+
* record and state file yet, the transaction must not be considered as
262+
* prepared. Likewise, if we are in the process of finishing an
263+
* already-prepared transaction, and fail after having already written
264+
* the 2nd phase commit or rollback record to the WAL, the transaction
265+
* should not be considered as prepared anymore. In those cases, just
266+
* remove the entry from shared memory.
267+
*
268+
* Otherwise, the entry must be left in place so that the transaction
269+
* can be finished later, so just unlock it.
270+
*
271+
* If we abort during prepare, after having written the WAL record, we
272+
* might not have transfered all locks and other state to the prepared
273+
* transaction yet. Likewise, if we abort during commit or rollback,
274+
* after having written the WAL record, we might not have released
275+
* all the resources held by the transaction yet. In those cases, the
276+
* in-memory state can be wrong, but it's too late to back out.
277+
*/
278+
if (!MyLockedGxact->valid)
279+
{
280+
RemoveGXact(MyLockedGxact);
281+
}
282+
else
283+
{
284+
LWLockAcquire(TwoPhaseStateLock,LW_EXCLUSIVE);
285+
286+
MyLockedGxact->locking_backend=InvalidBackendId;
287+
288+
LWLockRelease(TwoPhaseStateLock);
289+
}
290+
MyLockedGxact=NULL;
291+
}
292+
293+
/*
294+
* This is called after we have finished transfering state to the prepared
295+
* PGXACT entry.
296+
*/
297+
void
298+
PostPrepare_Twophase()
299+
{
300+
LWLockAcquire(TwoPhaseStateLock,LW_EXCLUSIVE);
301+
MyLockedGxact->locking_backend=InvalidBackendId;
302+
LWLockRelease(TwoPhaseStateLock);
303+
304+
MyLockedGxact=NULL;
305+
}
306+
231307

232308
/*
233309
* MarkAsPreparing
@@ -259,29 +335,15 @@ MarkAsPreparing(TransactionId xid, const char *gid,
259335
errmsg("prepared transactions are disabled"),
260336
errhint("Set max_prepared_transactions to a nonzero value.")));
261337

262-
LWLockAcquire(TwoPhaseStateLock,LW_EXCLUSIVE);
263-
264-
/*
265-
* First, find and recycle any gxacts that failed during prepare. We do
266-
* this partly to ensure we don't mistakenly say their GIDs are still
267-
* reserved, and partly so we don't fail on out-of-slots unnecessarily.
268-
*/
269-
for (i=0;i<TwoPhaseState->numPrepXacts;i++)
338+
/* on first call, register the exit hook */
339+
if (!twophaseExitRegistered)
270340
{
271-
gxact=TwoPhaseState->prepXacts[i];
272-
if (!gxact->valid&& !TransactionIdIsActive(gxact->locking_xid))
273-
{
274-
/* It's dead Jim ... remove from the active array */
275-
TwoPhaseState->numPrepXacts--;
276-
TwoPhaseState->prepXacts[i]=TwoPhaseState->prepXacts[TwoPhaseState->numPrepXacts];
277-
/* and put it back in the freelist */
278-
gxact->next=TwoPhaseState->freeGXacts;
279-
TwoPhaseState->freeGXacts=gxact;
280-
/* Back up index count too, so we don't miss scanning one */
281-
i--;
282-
}
341+
on_shmem_exit(AtProcExit_Twophase,0);
342+
twophaseExitRegistered= true;
283343
}
284344

345+
LWLockAcquire(TwoPhaseStateLock,LW_EXCLUSIVE);
346+
285347
/* Check for conflicting GID */
286348
for (i=0;i<TwoPhaseState->numPrepXacts;i++)
287349
{
@@ -339,14 +401,20 @@ MarkAsPreparing(TransactionId xid, const char *gid,
339401
gxact->prepare_lsn.xlogid=0;
340402
gxact->prepare_lsn.xrecoff=0;
341403
gxact->owner=owner;
342-
gxact->locking_xid=xid;
404+
gxact->locking_backend=MyBackendId;
343405
gxact->valid= false;
344406
strcpy(gxact->gid,gid);
345407

346408
/* And insert it into the active array */
347409
Assert(TwoPhaseState->numPrepXacts<max_prepared_xacts);
348410
TwoPhaseState->prepXacts[TwoPhaseState->numPrepXacts++]=gxact;
349411

412+
/*
413+
* Remember that we have this GlobalTransaction entry locked for us.
414+
* If we abort after this, we must release it.
415+
*/
416+
MyLockedGxact=gxact;
417+
350418
LWLockRelease(TwoPhaseStateLock);
351419

352420
returngxact;
@@ -409,6 +477,13 @@ LockGXact(const char *gid, Oid user)
409477
{
410478
inti;
411479

480+
/* on first call, register the exit hook */
481+
if (!twophaseExitRegistered)
482+
{
483+
on_shmem_exit(AtProcExit_Twophase,0);
484+
twophaseExitRegistered= true;
485+
}
486+
412487
LWLockAcquire(TwoPhaseStateLock,LW_EXCLUSIVE);
413488

414489
for (i=0;i<TwoPhaseState->numPrepXacts;i++)
@@ -423,15 +498,11 @@ LockGXact(const char *gid, Oid user)
423498
continue;
424499

425500
/* Found it, but has someone else got it locked? */
426-
if (TransactionIdIsValid(gxact->locking_xid))
427-
{
428-
if (TransactionIdIsActive(gxact->locking_xid))
429-
ereport(ERROR,
430-
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
431-
errmsg("prepared transaction with identifier \"%s\" is busy",
432-
gid)));
433-
gxact->locking_xid=InvalidTransactionId;
434-
}
501+
if (gxact->locking_backend!=InvalidBackendId)
502+
ereport(ERROR,
503+
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
504+
errmsg("prepared transaction with identifier \"%s\" is busy",
505+
gid)));
435506

436507
if (user!=gxact->owner&& !superuser_arg(user))
437508
ereport(ERROR,
@@ -452,7 +523,8 @@ LockGXact(const char *gid, Oid user)
452523
errhint("Connect to the database where the transaction was prepared to finish it.")));
453524

454525
/* OK for me to lock it */
455-
gxact->locking_xid=GetTopTransactionId();
526+
gxact->locking_backend=MyBackendId;
527+
MyLockedGxact=gxact;
456528

457529
LWLockRelease(TwoPhaseStateLock);
458530

@@ -1100,6 +1172,13 @@ EndPrepare(GlobalTransaction gxact)
11001172
*/
11011173
MyPgXact->inCommit= false;
11021174

1175+
/*
1176+
* Remember that we have this GlobalTransaction entry locked for us. If
1177+
* we crash after this point, it's too late to abort, but we must unlock
1178+
* it so that the prepared transaction can be committed or rolled back.
1179+
*/
1180+
MyLockedGxact=gxact;
1181+
11031182
END_CRIT_SECTION();
11041183

11051184
/*
@@ -1346,8 +1425,9 @@ FinishPreparedTransaction(const char *gid, bool isCommit)
13461425

13471426
/*
13481427
* In case we fail while running the callbacks, mark the gxact invalid so
1349-
* no one else will try to commit/rollback, and so it can be recycled
1350-
* properly later. It is still locked by our XID so it won't go away yet.
1428+
* no one else will try to commit/rollback, and so it will be recycled
1429+
* if we fail after this point. It is still locked by our backend so it
1430+
* won't go away yet.
13511431
*
13521432
* (We assume it's safe to do this without taking TwoPhaseStateLock.)
13531433
*/
@@ -1407,6 +1487,7 @@ FinishPreparedTransaction(const char *gid, bool isCommit)
14071487
RemoveTwoPhaseFile(xid, true);
14081488

14091489
RemoveGXact(gxact);
1490+
MyLockedGxact=NULL;
14101491

14111492
pfree(buf);
14121493
}

‎src/backend/access/transam/xact.c‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2198,9 +2198,13 @@ PrepareTransaction(void)
21982198
ProcArrayClearTransaction(MyProc);
21992199

22002200
/*
2201-
* This is all post-transaction cleanup. Note that if an error is raised
2202-
* here, it's too late to abort the transaction. This should be just
2203-
* noncritical resource releasing. See notes in CommitTransaction.
2201+
* In normal commit-processing, this is all non-critical post-transaction
2202+
* cleanup. When the transaction is prepared, however, it's important that
2203+
* the locks and other per-backend resources are transfered to the
2204+
* prepared transaction's PGPROC entry. Note that if an error is raised
2205+
* here, it's too late to abort the transaction. XXX: This probably should
2206+
* be in a critical section, to force a PANIC if any of this fails, but
2207+
* that cure could be worse than the disease.
22042208
*/
22052209

22062210
CallXactCallbacks(XACT_EVENT_PREPARE);
@@ -2235,6 +2239,14 @@ PrepareTransaction(void)
22352239
RESOURCE_RELEASE_AFTER_LOCKS,
22362240
true, true);
22372241

2242+
/*
2243+
* Allow another backend to finish the transaction. After
2244+
* PostPrepare_Twophase(), the transaction is completely detached from
2245+
* our backend. The rest is just non-critical cleanup of backend-local
2246+
* state.
2247+
*/
2248+
PostPrepare_Twophase();
2249+
22382250
/* Check we've released all catcache entries */
22392251
AtEOXact_CatCache(true);
22402252

@@ -2345,6 +2357,7 @@ AbortTransaction(void)
23452357
AtEOXact_LargeObject(false);
23462358
AtAbort_Notify();
23472359
AtEOXact_RelationMap(false);
2360+
AtAbort_Twophase();
23482361

23492362
/*
23502363
* Advertise the fact that we aborted in pg_clog (assuming that we got as

‎src/include/access/twophase.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,9 @@ extern intmax_prepared_xacts;
2828
externSizeTwoPhaseShmemSize(void);
2929
externvoidTwoPhaseShmemInit(void);
3030

31+
externvoidAtAbort_Twophase(void);
32+
externvoidPostPrepare_Twophase(void);
33+
3134
externPGPROC*TwoPhaseGetDummyProc(TransactionIdxid);
3235
externBackendIdTwoPhaseGetDummyBackendId(TransactionIdxid);
3336

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp