Fix failure to guarantee that a checkpoint will write out pg_clog updates

for transaction commits that occurred just before the checkpoint.  This is
an EXTREMELY serious bug --- kudos to Satoshi Okada for creating a
reproducible test case to prove its existence.

diff --git a/src/backend/access/transam/xact.c b/src/backend/access/transam/xact.c
index 0023d47f13a98eb4b2ba7c172f4c3b218ba20308..6c14ef36468225241aa67e9e36242b7afedafa5c 100644 (file)
--- a/src/backend/access/transam/xact.c
+++ b/src/backend/access/transam/xact.c
@@ -8,7 +8,7 @@
  *
  *
  * IDENTIFICATION
- *   $Header: /cvsroot/pgsql/src/backend/access/transam/xact.c,v 1.135.2.1 2002/11/18 01:17:50 tgl Exp $
+ *   $Header: /cvsroot/pgsql/src/backend/access/transam/xact.c,v 1.135.2.2 2004/08/11 04:08:39 tgl Exp $
  *
  * NOTES
  *     Transaction aborts can now occur two ways:
@@ -523,6 +523,7 @@ RecordTransactionCommit(void)
    if (MyXactMadeXLogEntry || MyXactMadeTempRelUpdate)
    {
        TransactionId xid = GetCurrentTransactionId();
+       bool        madeTCentries;
        XLogRecPtr  recptr;
 
        /* Tell bufmgr and smgr to prepare for commit */
@@ -531,12 +532,29 @@ RecordTransactionCommit(void)
        START_CRIT_SECTION();
 
        /*
-        * We only need to log the commit in xlog if the transaction made
-        * any transaction-controlled XLOG entries.  (Otherwise, its XID
-        * appears nowhere in permanent storage, so no one else will ever
-        * care if it committed.)
+        * If our transaction made any transaction-controlled XLOG entries,
+        * we need to lock out checkpoint start between writing our XLOG
+        * record and updating pg_clog.  Otherwise it is possible for the
+        * checkpoint to set REDO after the XLOG record but fail to flush the
+        * pg_clog update to disk, leading to loss of the transaction commit
+        * if we crash a little later.  Slightly klugy fix for problem
+        * discovered 2004-08-10.
+        *
+        * (If it made no transaction-controlled XLOG entries, its XID
+        * appears nowhere in permanent storage, so no one else will ever care
+        * if it committed; so it doesn't matter if we lose the commit flag.)
+        *
+        * Note we only need a shared lock.
         */
-       if (MyLastRecPtr.xrecoff != 0)
+       madeTCentries = (MyLastRecPtr.xrecoff != 0);
+       if (madeTCentries)
+           LWLockAcquire(CheckpointStartLock, LW_SHARED);
+
+       /*
+        * We only need to log the commit in XLOG if the transaction made
+        * any transaction-controlled XLOG entries.
+        */
+       if (madeTCentries)
        {
            /* Need to emit a commit record */
            XLogRecData rdata;
@@ -605,6 +623,10 @@ RecordTransactionCommit(void)
        if (MyLastRecPtr.xrecoff != 0 || MyXactMadeTempRelUpdate)
            TransactionIdCommit(xid);
 
+       /* Unlock checkpoint lock if we acquired it */
+       if (madeTCentries)
+           LWLockRelease(CheckpointStartLock);
+
        END_CRIT_SECTION();
    }
 
@@ -724,6 +746,8 @@ RecordTransactionAbort(void)
         * care if it committed.)  We do not flush XLOG to disk in any
         * case, since the default assumption after a crash would be that
         * we aborted, anyway.
+        * For the same reason, we don't need to worry about interlocking
+        * against checkpoint start.
         */
        if (MyLastRecPtr.xrecoff != 0)
        {

diff --git a/src/backend/access/transam/xlog.c b/src/backend/access/transam/xlog.c
index e4961af4307377ad46c166c52bd91e816b89d936..a97f59490b37ef446c2cf428941f4d922676f549 100644 (file)
--- a/src/backend/access/transam/xlog.c
+++ b/src/backend/access/transam/xlog.c
@@ -7,7 +7,7 @@
  * Portions Copyright (c) 1996-2002, PostgreSQL Global Development Group
  * Portions Copyright (c) 1994, Regents of the University of California
  *
- * $Header: /cvsroot/pgsql/src/backend/access/transam/xlog.c,v 1.109.2.3 2003/07/17 16:45:25 tgl Exp $
+ * $Header: /cvsroot/pgsql/src/backend/access/transam/xlog.c,v 1.109.2.4 2004/08/11 04:08:39 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -2994,6 +2994,15 @@ CreateCheckPoint(bool shutdown, bool force)
    checkPoint.ThisStartUpID = ThisStartUpID;
    checkPoint.time = time(NULL);
 
+   /*
+    * We must hold CheckpointStartLock while determining the checkpoint
+    * REDO pointer.  This ensures that any concurrent transaction commits
+    * will be either not yet logged, or logged and recorded in pg_clog.
+    * See notes in RecordTransactionCommit().
+    */
+   LWLockAcquire(CheckpointStartLock, LW_EXCLUSIVE);
+
+   /* And we need WALInsertLock too */
    LWLockAcquire(WALInsertLock, LW_EXCLUSIVE);
 
    /*
@@ -3025,6 +3034,7 @@ CreateCheckPoint(bool shutdown, bool force)
            ControlFile->checkPointCopy.redo.xrecoff)
        {
            LWLockRelease(WALInsertLock);
+           LWLockRelease(CheckpointStartLock);
            LWLockRelease(CheckpointLock);
            END_CRIT_SECTION();
            return;
@@ -3091,11 +3101,13 @@ CreateCheckPoint(bool shutdown, bool force)
 #endif
 
    /*
-    * Now we can release insert lock, allowing other xacts to proceed
-    * even while we are flushing disk buffers.
+    * Now we can release insert lock and checkpoint start lock, allowing
+    * other xacts to proceed even while we are flushing disk buffers.
     */
    LWLockRelease(WALInsertLock);
 
+   LWLockRelease(CheckpointStartLock);
+
    /*
     * Get the other info we need for the checkpoint record.
     */

diff --git a/src/include/storage/lwlock.h b/src/include/storage/lwlock.h
index e061cd82b7e5826976d96ce661c69ae4c0a320c1..f6e12a94885113e8ae4a1892372fab857cf42b0d 100644 (file)
--- a/src/include/storage/lwlock.h
+++ b/src/include/storage/lwlock.h
@@ -7,7 +7,7 @@
  * Portions Copyright (c) 1996-2002, PostgreSQL Global Development Group
  * Portions Copyright (c) 1994, Regents of the University of California
  *
- * $Id: lwlock.h,v 1.6 2002/06/20 20:29:52 momjian Exp $
+ * $Id: lwlock.h,v 1.6.2.1 2004/08/11 04:08:40 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -37,6 +37,7 @@ typedef enum LWLockId
    WALWriteLock,
    ControlFileLock,
    CheckpointLock,
+   CheckpointStartLock,
    CLogControlLock,
    RelCacheInitLock,