Merge lp:~laurynas-biveinis/percona-server/bug1417953 into lp:percona-server/5.6

[Laurynas Biveinis]

Fix bug 1417953 (buf_read_ahead_linear dereferences buffer page
pointer without protection).

Fix by protecting the bpage dereference with page hash S latch.

At the same time fix some other issues discovered while porting to
5.7:
- remove unused buf_pool_mutex_key PFS instrumentation variable;
- remove zip mutex locking from buf_pool_watch_set and
  buf_pool_watch_remove, as the watch pages are already protected by
  page hash X latch;
- fix some comments;
- fix some bool variables getting assigned TRUE instead of true.

http://jenkins.percona.com/job/percona-server-5.6-param/802/

[Laurynas Biveinis (laurynas-biveinis)]

review: Approve

=== modified file 'storage/innobase/buf/buf0buf.cc'
--- storage/innobase/buf/buf0buf.cc	2014-12-30 14:14:11 +0000
+++ storage/innobase/buf/buf0buf.cc	2015-02-04 11:23:44 +0000
@@ -294,7 +294,6 @@
 
 #ifdef UNIV_PFS_MUTEX
 UNIV_INTERN mysql_pfs_key_t	buffer_block_mutex_key;
-UNIV_INTERN mysql_pfs_key_t	buf_pool_mutex_key;
 UNIV_INTERN mysql_pfs_key_t	buf_pool_zip_mutex_key;
 UNIV_INTERN mysql_pfs_key_t	buf_pool_flush_state_mutex_key;
 UNIV_INTERN mysql_pfs_key_t	buf_pool_LRU_list_mutex_key;
@@ -1735,16 +1734,12 @@
 			ut_ad(!bpage->in_page_hash);
 			ut_ad(bpage->buf_fix_count == 0);
 
-			mutex_enter(&buf_pool->zip_mutex);
-
 			bpage->state = BUF_BLOCK_ZIP_PAGE;
 			bpage->space = static_cast<ib_uint32_t>(space);
 			bpage->offset = static_cast<ib_uint32_t>(offset);
 			bpage->buf_fix_count = 1;
 			bpage->buf_pool_index = buf_pool_index(buf_pool);
 
-			mutex_exit(&buf_pool->zip_mutex);
-
 			ut_d(bpage->in_page_hash = TRUE);
 			HASH_INSERT(buf_page_t, hash, buf_pool->page_hash,
 				    fold, bpage);
@@ -1796,7 +1791,6 @@
 #endif /* UNIV_SYNC_DEBUG */
 
 	ut_ad(buf_page_get_state(watch) == BUF_BLOCK_ZIP_PAGE);
-	ut_ad(buf_own_zip_mutex_for_page(watch));
 
 	HASH_DELETE(buf_page_t, hash, buf_pool->page_hash, fold, watch);
 	ut_d(watch->in_page_hash = FALSE);
@@ -1839,9 +1833,7 @@
 #endif /* PAGE_ATOMIC_REF_COUNT */
 
 		if (bpage->buf_fix_count == 0) {
-			mutex_enter(&buf_pool->zip_mutex);
 			buf_pool_watch_remove(buf_pool, fold, bpage);
-			mutex_exit(&buf_pool->zip_mutex);
 		}
 	}
 
@@ -4421,7 +4413,7 @@
 #endif /* UNIV_DEBUG || UNIV_BUF_DEBUG */
 		buf_page_get_flush_type(bpage) == BUF_FLUSH_LRU)) {
 
-		have_LRU_mutex = TRUE; /* optimistic */
+		have_LRU_mutex = true; /* optimistic */
 	}
 retry_mutex:
 	if (have_LRU_mutex) {
@@ -4441,7 +4433,7 @@
 			  && !have_LRU_mutex)) {
 
 		mutex_exit(block_mutex);
-		have_LRU_mutex = TRUE;
+		have_LRU_mutex = true;
 		goto retry_mutex;
 	}
 

=== modified file 'storage/innobase/buf/buf0flu.cc'
--- storage/innobase/buf/buf0flu.cc	2014-12-16 06:00:17 +0000
+++ storage/innobase/buf/buf0flu.cc	2015-02-04 11:23:44 +0000
@@ -1098,8 +1098,8 @@
 # if defined UNIV_DEBUG || defined UNIV_IBUF_DEBUG
 /********************************************************************//**
 Writes a flushable page asynchronously from the buffer pool to a file.
-NOTE: block->mutex must be held upon entering this function, and it will be
-released by this function after flushing.  This is loosely based on
+NOTE: block and LRU list mutexes must be held upon entering this function, and
+they will be released by this function after flushing. This is loosely based on
 buf_flush_batch() and buf_flush_page().
 @return TRUE if the page was flushed and the mutexes released */
 UNIV_INTERN
@@ -1653,6 +1653,8 @@
 	flush_counters_t*	n)	/*!< out: flushed/evicted page
 					counts */
 {
+	ut_ad(mutex_own(&buf_pool->LRU_list_mutex));
+
 	if (buf_LRU_evict_from_unzip_LRU(buf_pool)) {
 		n->unzip_LRU_evicted
 			= buf_free_from_unzip_LRU_list_batch(buf_pool, max);

=== modified file 'storage/innobase/buf/buf0lru.cc'
--- storage/innobase/buf/buf0lru.cc	2014-12-01 07:53:48 +0000
+++ storage/innobase/buf/buf0lru.cc	2015-02-04 11:23:44 +0000
@@ -526,7 +526,7 @@
 
 		mutex_exit(block_mutex);
 
-		*must_restart = TRUE;
+		*must_restart = true;
 		processed = false;
 
 	} else if (!flush) {

=== modified file 'storage/innobase/buf/buf0rea.cc'
--- storage/innobase/buf/buf0rea.cc	2014-12-01 07:53:48 +0000
+++ storage/innobase/buf/buf0rea.cc	2015-02-04 11:23:44 +0000
@@ -640,10 +640,10 @@
 
 	fail_count = 0;
 
+	prio_rw_lock_t*	hash_lock;
+
 	for (i = low; i < high; i++) {
 
-		prio_rw_lock_t*	hash_lock;
-
 		bpage = buf_page_hash_get_s_locked(buf_pool, space, i,
 						   &hash_lock);
 
@@ -691,7 +691,7 @@
 	/* If we got this far, we know that enough pages in the area have
 	been accessed in the right order: linear read-ahead can be sensible */
 
-	bpage = buf_page_hash_get(buf_pool, space, offset);
+	bpage = buf_page_hash_get_s_locked(buf_pool, space, offset, &hash_lock);
 
 	if (bpage == NULL) {
 
@@ -719,6 +719,8 @@
 	pred_offset = fil_page_get_prev(frame);
 	succ_offset = fil_page_get_next(frame);
 
+	rw_lock_s_unlock(hash_lock);
+
 	if ((offset == low) && (succ_offset == offset + 1)) {
 
 		/* This is ok, we can continue */

=== modified file 'storage/innobase/handler/ha_innodb.cc'
--- storage/innobase/handler/ha_innodb.cc	2014-12-16 06:00:17 +0000
+++ storage/innobase/handler/ha_innodb.cc	2015-02-04 11:23:44 +0000
@@ -340,7 +340,6 @@
 #  ifndef PFS_SKIP_BUFFER_MUTEX_RWLOCK
 	{&buffer_block_mutex_key, "buffer_block_mutex", 0},
 #  endif /* !PFS_SKIP_BUFFER_MUTEX_RWLOCK */
-	{&buf_pool_mutex_key, "buf_pool_mutex", 0},
 	{&buf_pool_zip_mutex_key, "buf_pool_zip_mutex", 0},
 	{&buf_pool_LRU_list_mutex_key, "buf_pool_LRU_list_mutex", 0},
 	{&buf_pool_free_list_mutex_key, "buf_pool_free_list_mutex", 0},

=== modified file 'storage/innobase/handler/i_s.cc'
--- storage/innobase/handler/i_s.cc	2014-12-01 07:53:48 +0000
+++ storage/innobase/handler/i_s.cc	2015-02-04 11:23:44 +0000
@@ -5279,11 +5279,6 @@
 			info_buffer = (buf_page_info_t*) mem_heap_zalloc(
 				heap, mem_size);
 
-			/* Obtain appropriate mutexes. Since this is diagnostic
-			buffer pool info printout, we are not required to
-			preserve the overall consistency, so we can
-			release mutex periodically */
-
 			/* GO through each block in the chunk */
 			for (n_blocks = num_to_process; n_blocks--; block++) {
 				i_s_innodb_buffer_page_get_info(

=== modified file 'storage/innobase/include/buf0flu.h'
--- storage/innobase/include/buf0flu.h	2014-12-01 07:53:48 +0000
+++ storage/innobase/include/buf0flu.h	2015-02-04 11:23:44 +0000
@@ -78,8 +78,8 @@
 # if defined UNIV_DEBUG || defined UNIV_IBUF_DEBUG
 /********************************************************************//**
 Writes a flushable page asynchronously from the buffer pool to a file.
-NOTE: block->mutex must be held upon entering this function, and they will be
-released by this function after flushing.  This is loosely based on
+NOTE: block and LRU list mutexes must be held upon entering this function, and
+they will be released by this function after flushing. This is loosely based on
 buf_flush_batch() and buf_flush_page().
 @return TRUE if the page was flushed and the mutexes released */
 UNIV_INTERN

=== modified file 'storage/innobase/include/sync0sync.h'
--- storage/innobase/include/sync0sync.h	2014-12-01 07:53:48 +0000
+++ storage/innobase/include/sync0sync.h	2015-02-04 11:23:44 +0000
@@ -71,7 +71,6 @@
 /* Key defines to register InnoDB mutexes with performance schema */
 extern mysql_pfs_key_t	autoinc_mutex_key;
 extern mysql_pfs_key_t	buffer_block_mutex_key;
-extern mysql_pfs_key_t	buf_pool_mutex_key;
 extern mysql_pfs_key_t	buf_pool_zip_mutex_key;
 extern mysql_pfs_key_t	buf_pool_LRU_list_mutex_key;
 extern mysql_pfs_key_t	buf_pool_free_list_mutex_key;