Some potential deadlocks in BerkeleyDB 4.7.25

Question

We are building a distributed system checking tool to find software bugs. When we are doing BDB experiments under Windows, we find some MUTEX_UNLOCK operations are missed:
1. In __db_cursor_int(), line 81. dbp->mutex may need to be released before function returns.
     MUTEX_LOCK(env, dbp->mutex);
#ifndef HAVE_NO_DB_REFCOUNT
     if (txn != NULL &&
     !LF_ISSET(DBC_OPD|DBC_DUPLICATE) && !F_ISSET(dbp, DB_AM_RECOVER) &&
     dbp->log_filename != NULL && !IS_REP_CLIENT(env) &&
     (ret = __txn_record_fname(env, txn, dbp->log_filename)) != 0)
          return (ret); //ERROR, missing MUTEX_UNLOCK before returning.
#endif
2. In __dbreg_failchk(), line 707. fnp->mutex may need to be released in the "else" region.
3. In __lock_get_internal(), I ran out a path that newl->mtx_lock could be double locked and there is no unlock before returning.
Thanks.
Edited by: damm on 2008-9-30 下午12:41
Edited by: damm on 2008-9-30 下午11:04

Answer 1

Michael, according to your comment, since mutex owner relates to cursor or transaction instead of thread, thus another thread will do the release work although it is not the holder. Am I right?
For the scenario that message thread will acquire a mutex(whose db_mutex_t value is 4228) twice in one __lock_get_internal() call, the message thread is dealing REP_UPDATE_REQ while main thread is openning the db. The following is the call stack of all threads:
1. Master's main thread is trying to open the db.
ex_rep_mgr.exe!__repmgr_lock_mutex(void * * mutex=0x021fab30) Line 456 + 0xe bytes C
ex_rep_mgr.exe!__repmgr_send(__db_env * dbenv=0x021fa6c8, const __db_dbt * control=0x0012f8b8, const __db_dbt * rec=0x0012fa3c, const __db_lsn * lsnp=0x0012f888, int eid=-1, unsigned int flags=0) Line 97 + 0xf bytes C
ex_rep_mgr.exe!__rep_send_message(__env * env=0x021fade0, int eid=-1, unsigned int rtype=11, __db_lsn * lsnp=0x0012fa04, const __db_dbt * dbt=0x0012fa3c, unsigned int ctlflags=0, unsigned int repflags=0) Line 503 + 0x29 bytes C
ex_rep_mgr.exe!__log_put(__env * env=0x021fade0, __db_lsn * lsnp=0x02fd018c, const __db_dbt * udbt=0x0012fa3c, unsigned int flags=8) Line 255 + 0x1e bytes C
ex_rep_mgr.exe!__txn_child_log(__env * env=0x021fade0, __db_txn * txnp=0x021fbbf0, __db_lsn * ret_lsnp=0x02fd018c, unsigned int flags=0, unsigned int child=2147483649, __db_lsn * c_lsn=0x02fd02bc) Line 692 + 0x18 bytes C
ex_rep_mgr.exe!__txn_commit(__db_txn * txn=0x021ffa58, unsigned int flags=0) Line 712 + 0x3f bytes C
ex_rep_mgr.exe!__fop_file_setup(__db * dbp=0x021ff730, __db_thread_info * ip=0x00000000, __db_txn * txn=0x021fbbf0, const char * name=0x006fdb54, int mode=384, unsigned int flags=5, unsigned int * retidp=0x0012fe34) Line 642 + 0xe bytes C
ex_rep_mgr.exe!__db_open(__db * dbp=0x021ff730, __db_thread_info * ip=0x00000000, __db_txn * txn=0x021fbbf0, const char * fname=0x006fdb54, const char * dname=0x00000000, DBTYPE type=DB_BTREE, unsigned int flags=5, int mode=0, unsigned int meta_pgno=0) Line 154 + 0x21 bytes C
ex_rep_mgr.exe!__db_open_pp(__db * dbp=0x021ff730, __db_txn * txn=0x021fbbf0, const char * fname=0x006fdb54, const char * dname=0x00000000, DBTYPE type=DB_BTREE, unsigned int flags=1, int mode=0) Line 1125 + 0x27 bytes C
ex_rep_mgr.exe!db_mc_test_write(__db_env * dbenv=0x021fa6c8, int is_master=1) Line 101 + 0x20 bytes C++
ex_rep_mgr.exe!main(int argc=13, char * * argv=0x021f5c30) Line 213 + 0xd bytes C
2. Message Thread(We change the default message thread number to 1)
ex_rep_mgr.exe!__lock_get_internal(__db_locktab * lt=0x021fb1b0, __db_locker * sh_locker=0x02fa6030, unsigned int flags=0, const __db_dbt * obj=0x04f4f764, db_lockmode_t lock_mode=DB_LOCK_READ, unsigned int timeout=0, __db_lock_u * lock=0x04f4f7b0) Line 965 C
ex_rep_mgr.exe!__lock_vec(__env * env=0x021fade0, __db_locker * sh_locker=0x02fa6030, unsigned int flags=0, __db_lockreq * list=0x04f4f780, int nlist=2, __db_lockreq * * elistp=0x04f4f7c4) Line 142 + 0x49 bytes C
ex_rep_mgr.exe!__fop_lock_handle(__env * env=0x021fade0, __db * dbp=0x04ad3560, __db_locker * locker=0x02fa6030, db_lockmode_t mode=DB_LOCK_READ, __db_lock_u * elockp=0x04f4f85c, unsigned int flags=0) Line 142 + 0x1b bytes C
ex_rep_mgr.exe!__fop_file_setup(__db * dbp=0x04ad3560, __db_thread_info * ip=0x00000000, __db_txn * txn=0x00000000, const char * name=0x021fdd30, int mode=384, unsigned int flags=132, unsigned int * retidp=0x04f4fafc) Line 409 + 0x1c bytes C
ex_rep_mgr.exe!__db_open(__db * dbp=0x04ad3560, __db_thread_info * ip=0x00000000, __db_txn * txn=0x00000000, const char * fname=0x021fdd30, const char * dname=0x00000000, DBTYPE type=DB_UNKNOWN, unsigned int flags=132, int mode=0, unsigned int meta_pgno=0) Line 154 + 0x21 bytes C
ex_rep_mgr.exe!__rep_get_fileinfo(__env * env=0x021fade0, const char * file=0x021fdd30, const char * subdb=0x00000000, ___rep_fileinfo_args * rfp=0x04f4fba8, unsigned char * uid=0x04f4fb90, unsigned int * filecntp=0x04f4fcc4) Line 451 + 0x38 bytes C
ex_rep_mgr.exe!__rep_walk_dir(__env * env=0x021fade0, const char * dir=0x021fd830, unsigned int version=5, unsigned char * * fp=0x04f4fcd0, unsigned char * origfp=0x00000000, unsigned int * fileszp=0x04f4fcac, unsigned int * filelenp=0x04f4fcc0, unsigned int * filecntp=0x04f4fcc4) Line 300 + 0x20 bytes C
ex_rep_mgr.exe!__rep_find_dbs(__env * env=0x021fade0, unsigned int version=5, unsigned char * * fp=0x04f4fcd0, unsigned int * fileszp=0x04f4fcac, unsigned int * filelenp=0x04f4fcc0, unsigned int * filecntp=0x04f4fcc4) Line 210 + 0x26 bytes C
ex_rep_mgr.exe!__rep_update_req(__env * env=0x021fade0, ___rep_control_args * rp=0x04f4fe00, int eid=0) Line 104 + 0x1f bytes C
ex_rep_mgr.exe!__rep_process_message(__db_env * dbenv=0x021fa6c8, __db_dbt * control=0x021fff00, __db_dbt * rec=0x021fff1c, int eid=0, __db_lsn * ret_lsnp=0x04f4fe54) Line 860 + 0x11 bytes C
ex_rep_mgr.exe!process_message(__env * env=0x021fade0, __db_dbt * control=0x021fff00, __db_dbt * rec=0x021fff1c, int eid=0) Line 87 + 0x1b bytes C
ex_rep_mgr.exe!message_loop(__env * env=0x021fade0) Line 54 + 0x1e bytes C
ex_rep_mgr.exe!__repmgr_msg_thread(void * args=0x021fade0) Line 33 + 0x9 bytes C
ex_rep_mgr.exe!__thread_wrapper(void * lpThreadInfo=0x021fd788) Line 43 + 0x11 bytes C++
3. Select Thread
ex_rep_mgr.exe!__repmgr_readv(unsigned int fd=436, WSABUF * iovec=0x021fb9a8, int bufcount=3, unsigned int * xfr_count_p=0x04e0fbb4) Line 514 + 0x1e bytes C
ex_rep_mgr.exe!__repmgr_read_from_site(__env * env=0x021fade0, __repmgr_connection * conn=0x021fb970) Line 716 + 0x2b bytes C
ex_rep_mgr.exe!handle_completion(__env * env=0x021fade0, __repmgr_connection * conn=0x021fb970) Line 720 + 0xd bytes C
ex_rep_mgr.exe!__repmgr_select_loop(__env * env=0x021fade0) Line 645 + 0x2a bytes C
ex_rep_mgr.exe!__repmgr_select_thread(void * args=0x021fade0) Line 60 + 0x9 bytes C
ex_rep_mgr.exe!__thread_wrapper(void * lpThreadInfo=0x021fd648) Line 43 + 0x11 bytes C++
4. Elect Thread
ex_rep_mgr.exe!__os_yield(__env * env=0x00000000, unsigned long secs=0, unsigned long usecs=200000) Line 35 C
ex_rep_mgr.exe!__rep_wait(__env * env=0x021fade0, unsigned int * timeoutp=0x04ccfdec, int * eidp=0x04ccfd78, int full_elect=0, unsigned int flags=16) Line 1158 + 0xf bytes C
ex_rep_mgr.exe!__rep_elect(__db_env * dbenv=0x021fa6c8, unsigned int given_nsites=3, unsigned int nvotes=2, unsigned int flags=0) Line 303 + 0x1a bytes C
ex_rep_mgr.exe!__repmgr_elect_main(__env * env=0x021fade0) Line 237 + 0x13 bytes C
ex_rep_mgr.exe!__repmgr_elect_thread(void * args=0x021fade0) Line 110 + 0x9 bytes C
ex_rep_mgr.exe!__thread_wrapper(void * lpThreadInfo=0x021fdbe8) Line 43 + 0x11 bytes C++