[tarantool-patches] [PATCH] Fix memory corruption while vinyl index rebuild

[tarantool-patches] [PATCH] Fix memory corruption while vinyl index rebuild

[Georgy Kirichenko]

Reclaim memory used while previous page recovery not the last one.
There is no specific test case.

Fixes: 3920

Issue: https://github.com/tarantool/tarantool/issues/3920
Branch: https://github.com/tarantool/tarantool/tree/g.kirichenko/gh-3920-rebuild-mem-corruption
diff --git a/src/box/vy_run.c b/src/box/vy_run.c
index c448a449d..d82f1e372 100644
--- a/src/box/vy_run.c
+++ b/src/box/vy_run.c
@@ -2382,6 +2382,7 @@ vy_run_rebuild_index(struct vy_run *run, const char *dir,
 
 	off_t page_offset, next_page_offset = xlog_cursor_pos(&cursor);
 	while ((rc = xlog_cursor_next_tx(&cursor)) == 0) {
+		region_truncate(region, mem_used);
 		page_offset = next_page_offset;
 		next_page_offset = xlog_cursor_pos(&cursor);
 
@@ -2441,7 +2442,6 @@ vy_run_rebuild_index(struct vy_run *run, const char *dir,
 		info->row_index_offset = page_row_index_offset;
 		++run->info.page_count;
 		vy_run_acct_page(run, info);
-		region_truncate(region, mem_used);
 	}
 
 	if (prev_tuple != NULL) {
-- 
2.20.1

Re: [tarantool-patches] [PATCH] Fix memory corruption while vinyl index rebuild

[Vladimir Davydov]

The issue's naturally worth fixing, but I don't think that it could
actually lead to a memory corruption, because the code doesn't yield.
AFAIU you stumbled upon it just by looking at the code, not that you
encountered a crash, right?

On Sat, Jan 05, 2019 at 12:18:01AM +0300, Georgy Kirichenko wrote:
> Reclaim memory used while previous page recovery not the last one.
> There is no specific test case.
> 
> Fixes: 3920

Closes #3920

Fixes commit a14d5e4e12ed2 ("vinyl: rebuild .index in force-recovery
mode").

> 
> Issue: https://github.com/tarantool/tarantool/issues/3920
> Branch: https://github.com/tarantool/tarantool/tree/g.kirichenko/gh-3920-rebuild-mem-corruption

Should go after --

'Issue' and 'Branch' prefixes are useless.

> diff --git a/src/box/vy_run.c b/src/box/vy_run.c
> index c448a449d..d82f1e372 100644
> --- a/src/box/vy_run.c
> +++ b/src/box/vy_run.c
> @@ -2382,6 +2382,7 @@ vy_run_rebuild_index(struct vy_run *run, const char *dir,
>  
>  	off_t page_offset, next_page_offset = xlog_cursor_pos(&cursor);
>  	while ((rc = xlog_cursor_next_tx(&cursor)) == 0) {
> +		region_truncate(region, mem_used);
>  		page_offset = next_page_offset;
>  		next_page_offset = xlog_cursor_pos(&cursor);
>  
> @@ -2441,7 +2442,6 @@ vy_run_rebuild_index(struct vy_run *run, const char *dir,
>  		info->row_index_offset = page_row_index_offset;
>  		++run->info.page_count;
>  		vy_run_acct_page(run, info);
> -		region_truncate(region, mem_used);
>  	}
>  
>  	if (prev_tuple != NULL) {

Pushed to 2.1 and 1.10.