Skip to content

fix(mpool): cache shrink detached one region past the end (SIGSEGV) #83

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gburd merged 1 commit into from
Jul 29, 2026
Merged

fix(mpool): cache shrink detached one region past the end (SIGSEGV) #83

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions src/mp/mp_resize.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -447,8 +447,15 @@ __memp_remove_region(dbmp)
if ((ret = __memp_remove_bucket(dbmp)) != 0)
return (ret);

/* Detach from the region then destroy it. */
infop = &dbmp->reginfo[mp->nreg];
/*
* Detach from the region then destroy it. Live cache regions occupy
* reginfo[0 .. nreg-1], so the last one -- the region being removed --
* is at index nreg-1. (The add path uses reginfo[nreg] because it is
* initializing the next, not-yet-counted slot before incrementing nreg;
* removal is the mirror and must index the last LIVE region, else it
* detaches/munmaps a stale slot one past the end -> SIGSEGV.)
*/
infop = &dbmp->reginfo[mp->nreg - 1];
if (F_ISSET(env, ENV_PRIVATE)) {
hp = R_ADDR(infop, ((MPOOL*)infop->primary)->htab);
for (i = 0; i < env->dbenv->mp_mtxcount; i++)
Expand Down
Loading