Files
reth/crates
Alexey Shekhirin e7339aed84 fix(libmdbx): fix TOCTOU race in mdbx_txn_clone MVCC validation
The previous implementation checked cached_oldest BEFORE binding the
reader slot and registering the txnid. This created a race window where:

1. Check: source->txnid >= cached_oldest (passes)
2. Gap: Allocate memory, bind reader slot
3. Register: Write txnid to reader slot

During the gap, if the source transaction was the only reader holding
that snapshot and got aborted, cached_oldest could advance and GC could
reclaim pages before the clone's reader slot was registered.

The fix follows the same pattern used in mdbx_txn_begin: register the
reader slot first, then verify the snapshot is still valid. This ensures
the GC sees our registered txnid before we check validity.
2025-12-19 01:10:21 +00:00
..
2025-12-16 09:35:38 +00:00