Skip to content
Snippets Groups Projects
  • Andrey Saranchin's avatar
    8cbe42eb
    memtx: fix use-after-free in mvcc on ddl · 8cbe42eb
    Andrey Saranchin authored
    When space is being altered, `memtx_tx_space_on_delete` is called - it
    deletes all the stories associated with the old schema. However, before
    deleting a story, its `reader_list` member is not unlinked from the list
    so other nodes can still access this memory. The commit fixes this
    problem and adds an assertion that checks if story is always unlinked
    from reader list when is being deleted.
    
    Part of #10146
    
    NO_CHANGELOG=later
    NO_DOC=bugfix
    
    (cherry picked from commit a32f56dfbb4b56b410ac376fce079613cac0ccb6)
    8cbe42eb
    History
    memtx: fix use-after-free in mvcc on ddl
    Andrey Saranchin authored
    When space is being altered, `memtx_tx_space_on_delete` is called - it
    deletes all the stories associated with the old schema. However, before
    deleting a story, its `reader_list` member is not unlinked from the list
    so other nodes can still access this memory. The commit fixes this
    problem and adds an assertion that checks if story is always unlinked
    from reader list when is being deleted.
    
    Part of #10146
    
    NO_CHANGELOG=later
    NO_DOC=bugfix
    
    (cherry picked from commit a32f56dfbb4b56b410ac376fce079613cac0ccb6)