BUG#25306 (Race conditions during replication slave shutdown (valgrind stacks)):

The possibility of the race is removed by changing sequence of calls

  pthread_mutex_unlock(&mi->run_lock);
  pthread_cond_broadcast(&mi->stop_cond);  

into

  pthread_cond_broadcast(&mi->stop_cond);
  pthread_mutex_unlock(&mi->run_lock);

at the end of I/O thread (similar change at the end of SQL thread). This ensures 
that no thread waiting on the condition executes between the broadcast and the 
unlock and thus can't delete the mi structure which caused the bug.

1 files changed, 14 insertions, 5 deletions

diff --git a/sql/slave.cc b/sql/slave.cc
index 8805f950d50..13793705b9a 100644
--- a/sql/slave.cc
+++ b/sql/slave.cc
@@ -3758,8 +3758,13 @@ err:
   mi->abort_slave= 0;
   mi->slave_running= 0;
   mi->io_thd= 0;
-  pthread_mutex_unlock(&mi->run_lock);
+  /*
+    Note: the order of the two following calls (first broadcast, then unlock)
+    is important. Otherwise a killer_thread can execute between the calls and
+    delete the mi structure leading to a crash! (see BUG#25306 for details)
+   */ 
   pthread_cond_broadcast(&mi->stop_cond);       // tell the world we are done
+  pthread_mutex_unlock(&mi->run_lock);
 #ifndef DBUG_OFF
   if (abort_slave_event_count && !events_till_abort)
     goto slave_begin;
@@ -3977,8 +3982,13 @@ the slave SQL thread with \"SLAVE START\". We stopped at log \
   THD_CHECK_SENTRY(thd);
   delete thd;
   pthread_mutex_unlock(&LOCK_thread_count);
-  pthread_cond_broadcast(&rli->stop_cond);
 
+ /*
+  Note: the order of the broadcast and unlock calls below (first broadcast, then unlock)
+  is important. Otherwise a killer_thread can execute between the calls and
+  delete the mi structure leading to a crash! (see BUG#25306 for details)
+ */ 
+  pthread_cond_broadcast(&rli->stop_cond);
 #ifndef DBUG_OFF
   /*
     Bug #19938 Valgrind error (race) in handle_slave_sql()
@@ -3986,9 +3996,8 @@ the slave SQL thread with \"SLAVE START\". We stopped at log \
   */
   const int eta= rli->events_till_abort;
 #endif
-
-  // tell the world we are done
-  pthread_mutex_unlock(&rli->run_lock);
+  pthread_mutex_unlock(&rli->run_lock);  // tell the world we are done
+  
 #ifndef DBUG_OFF // TODO: reconsider the code below
   if (abort_slave_event_count && !eta)
     goto slave_begin;