Skip to content

fix: LMDB deadlock in resize detection during concurrent transaction begin#84

Open
R0BC0D3R wants to merge 1 commit into
masterfrom
fix/security-lmdb-race
Open

fix: LMDB deadlock in resize detection during concurrent transaction begin#84
R0BC0D3R wants to merge 1 commit into
masterfrom
fix/security-lmdb-race

Conversation

@R0BC0D3R
Copy link
Copy Markdown
Member

Summary

  • Fixes a low-probability deadlock in lmdb_txn_begin() triggered when
    MDB_MAP_RESIZED is returned during concurrent database access
  • lmdb_resized() called wait_no_active_txns() without accounting for
    the active transaction held by the calling thread, causing it to spin
    forever waiting for a count that could never reach zero
  • Fix passes isactive flag from call sites so the calling thread's own
    transaction is temporarily excluded from the active count during the wait

…begin

lmdb_resized() called wait_no_active_txns() without accounting for the
active transaction held by the calling thread, causing a spin-wait
deadlock when MDB_MAP_RESIZED was returned from lmdb_txn_begin().

Fix by temporarily decrementing num_active_txns before the wait and
re-incrementing after, so the calling thread's own txn is excluded from
the active count. lmdb_txn_renew() passes isactive=0 since it does not
increment the counter.

Ported from monero-project/monero PR #7958.
@github-actions
Copy link
Copy Markdown

Build Artifacts

Target Status Download
nerva-linux-armv7 Download
nerva-linux-armv8 Download
nerva-windows-x32 Download
nerva-linux-i686 Download
nerva-windows-x64 Download
nerva-linux-x86_64 Download
nerva-macos-x64 Download
nerva-macos-armv8 Download
nerva-freebsd-x86_64 Download
nerva-android-armv8 Download

10 succeeded, 0 failed | View workflow run

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants