database/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-07-30 16:24:05 +03:00
Code Activity

Bug#19070633 - POSSIBLE ACCESS TO FREED MEMORY IN IS_FREE_LOCK()

Browse Source 
AND IS_USED_LOCK().

Analysis:
-----------
In functions Item_func_is_free_lock::val_int() and 
Item_func_is_used_lock::val_int(), for the specified user lock
name, pointer to its "User_level_lock" object is obtained from hash
"hash_user_locks". Mutex "LOCK_user_locks" is acquired for this
and released immediately. And we are accessing members of
User_level_lock after releasing the mutex. If same user lock is
deleted(released) from concurrent thread then accessing members
results in invalid(freed) memory access issue.

Deleting of user lock is also protected from the mutex
"LOCK_user_locks". Since this mutex is released in "val_int" 
functions mentioned above, delete operation proceeds while concurrent
thread tries to access its members.

With the test case, valgrind reports invalid read issues in val_int
functions.

Fix:
-----------
To fix this issue, in "val_int" function of classes
"Item_func_is_free_lock" and "Item_func_is_used_lock", now releasing
mutex "LOCK_user_locks" after accessing User_level_lock members.
This commit is contained in:
Praveenkumar Hulakund
2014-09-16 11:28:46 +05:30
parent 3fef119dcd
commit 508c74ac25
3 changed files with 121 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
mysql-test/r/lock_sync.result
View File

@ -773,3 +773,54 @@ Warning 1356 View 'test.v1' references invalid table(s) or column(s) or function
SET DEBUG_SYNC= 'RESET';
DROP VIEW v1;
DROP TABLE t1;
#
# Bug#19070633 - POSSIBLE ACCESS TO FREED MEMORY IN IS_FREE_LOCK() AND IS_USED_LOCK().
#
# Verifying issue for IS_FREE_LOCK() function.
SELECT GET_LOCK("lock_19070633", 600);
GET_LOCK("lock_19070633", 600)
1
connect con1, localhost, root,,;
# Waiting after getting user level lock info and releasing mutex.
SET DEBUG_SYNC= 'after_getting_user_level_lock_info SIGNAL parked WAIT_FOR go';
# Sending: SELECT IS_FREE_LOCK("lock_19070633");
SELECT IS_FREE_LOCK("lock_19070633");
connection default;
SET DEBUG_SYNC= 'now WAIT_FOR parked';
SELECT RELEASE_LOCK("lock_19070633");
RELEASE_LOCK("lock_19070633")
1
# Signaling connection con1 after releasing the lock.
# Without fix, accessing user level lock info in con1 would result in
# crash or valgrind issue invalid read is reported.
SET DEBUG_SYNC= 'now SIGNAL go';
connection con1;
# Reaping: SELECT IS_FREE_LOCK("lock_19070633");
IS_FREE_LOCK("lock_19070633")
0
connection default;
# Verifying issue for IS_USED_LOCK() function.
SELECT GET_LOCK("lock_19070633", 600);
GET_LOCK("lock_19070633", 600)
1
connection con1;
# Waiting after getting user level lock info and releasing mutex.
SET DEBUG_SYNC= 'after_getting_user_level_lock_info SIGNAL parked WAIT_FOR go';
# Sending: SELECT IS_USED_LOCK("lock_19070633");
SELECT IS_USED_LOCK("lock_19070633");
connection default;
SET DEBUG_SYNC= 'now WAIT_FOR parked';
SELECT RELEASE_LOCK("lock_19070633");
RELEASE_LOCK("lock_19070633")
1
# Signaling connection con1 after releasing the lock.
# Without fix, accessing user level lock info in con1 would result in
# crash or valgrind issue invalid read is reported.
SET DEBUG_SYNC= 'now SIGNAL go';
connection con1;
# Reaping: SELECT IS_USED_LOCK("lock_19070633");
IS_USED_LOCK("lock_19070633")
#
connection default;
SET DEBUG_SYNC= 'RESET';
disconnect con1;