database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-29 05:21:33 +03:00
Code Activity

MDEV-30924 Server crashes in MYSQL_LOG::is_open upon ALTER vs FUNCTION

Browse Source 
ASAN showed use-after-free in binlog_online_alter_end_trans, during
running through thd->online_alter_cache_list.

In online_alter_binlog_get_cache_data, new_cache_data was allocated on
thd->mem_root, in case of autocommit=1, but this mem_root could be freed
in sp_head::execute, upon using stored functions.

It appears that thd->transaction->mem_root exists even in single-stmt
transaction mode (i.e autocommit=1), so it can be used in all cases.
This mem_root will remain valid till the end of transaction, including
commit phase.
This commit is contained in:
Nikita Malyavin
2023-03-26 17:50:37 +03:00
committed by Sergei Golubchik
parent 6b35d6a909
commit 3ad0e7edd1
3 changed files with 51 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
mysql-test/main/alter_table_online_debug.result
View File

@ -1190,5 +1190,27 @@ set debug_sync= 'now signal goon';
connection default;
drop table t;
#
# MDEV-30924 Server crashes in MYSQL_LOG::is_open upon ALTER vs FUNCTION
#
create table t (a int);
insert into t values (1),(2);
create function f () returns int
begin
update t set a = 10;
return 0;
end $
set debug_sync= 'alter_table_online_downgraded signal downgraded wait_for goon';
alter table t force, algorithm=copy;
connection con1;
set debug_sync= 'now wait_for downgraded';
select f();
f()
0
set debug_sync= 'now signal goon';
connection default;
drop table t;
drop function f;
disconnect con1;
#
# End of 11.2 tests
#

28
mysql-test/main/alter_table_online_debug.test
View File

@ -1370,6 +1370,34 @@ set debug_sync= 'now signal goon';
--reap
drop table t;
--echo #
--echo # MDEV-30924 Server crashes in MYSQL_LOG::is_open upon ALTER vs FUNCTION
--echo #
create table t (a int);
insert into t values (1),(2);
--delimiter $
create function f () returns int
begin
update t set a = 10;
return 0;
end $
--delimiter ;
set debug_sync= 'alter_table_online_downgraded signal downgraded wait_for goon';
send alter table t force, algorithm=copy;
--connection con1
set debug_sync= 'now wait_for downgraded';
select f();
set debug_sync= 'now signal goon';
--connection default
--reap
drop table t;
drop function f;
--disconnect con1
--echo #
--echo # End of 11.2 tests
--echo #

3
sql/log.cc
View File

@ -6449,8 +6449,7 @@ online_alter_cache_data *online_alter_binlog_get_cache_data(THD *thd, TABLE *tab
return &cache;
}
MEM_ROOT *root= thd->in_multi_stmt_transaction_mode()
? &thd->transaction->mem_root : thd->mem_root;
MEM_ROOT *root= &thd->transaction->mem_root;
auto *new_cache_data= binlog_setup_cache_data(root, table->s);
list.push_back(*new_cache_data);