diff options
| author | Alexey Botchkov <holyfoot@mysql.com> | 2010-03-09 14:19:10 +0400 |
|---|---|---|
| committer | Alexey Botchkov <holyfoot@mysql.com> | 2010-03-09 14:19:10 +0400 |
| commit | 7feb51da5abfc449eae851095d349c40b671fd05 (patch) | |
| tree | a03da8be4e1a441ee5339ac9faec8cb8af9be192 /sql | |
| parent | 56f42962ff3d5109f29487572d34892cd8fc7da5 (diff) | |
| download | mariadb-git-7feb51da5abfc449eae851095d349c40b671fd05.tar.gz | |
Bug#51377 Crash in information_schema / processlist on concurrent DDL workload
the fill_schema_processlist function accesses THD::query() without proper protection
so the parallel thread killing can lead to access to the freed meemory.
per-file comments:
sql/sql_load.cc
Bug#51377 Crash in information_schema / processlist on concurrent DDL workload
the THD::set_query_inner() call needs to be protected.
But here we don't need to change the original thd->query() at all.
sql/sql_show.cc
Bug#51377 Crash in information_schema / processlist on concurrent DDL workload
protect the THD::query() access with the THD::LOCK_thd_data mutex.
Diffstat (limited to 'sql')
| -rw-r--r-- | sql/sql_load.cc | 8 | ||||
| -rw-r--r-- | sql/sql_show.cc | 3 |
2 files changed, 6 insertions, 5 deletions
diff --git a/sql/sql_load.cc b/sql/sql_load.cc index ee3b442c83a..3fb1b07cf6c 100644 --- a/sql/sql_load.cc +++ b/sql/sql_load.cc @@ -689,12 +689,10 @@ static bool write_execute_load_query_log_event(THD *thd, sql_exchange* ex, strcpy(end, p); end += pl; - thd->set_query_inner(load_data_query, end - load_data_query); - Execute_load_query_log_event - e(thd, thd->query(), thd->query_length(), - (uint) ((char*) fname_start - (char*) thd->query() - 1), - (uint) ((char*) fname_end - (char*) thd->query()), + e(thd, load_data_query, end-load_data_query, + (uint) ((char*) fname_start - load_data_query - 1), + (uint) ((char*) fname_end - load_data_query), (duplicates == DUP_REPLACE) ? LOAD_DUP_REPLACE : (ignore ? LOAD_DUP_IGNORE : LOAD_DUP_ERROR), transactional_table, FALSE, errcode); diff --git a/sql/sql_show.cc b/sql/sql_show.cc index 989606300d8..cb60027842d 100644 --- a/sql/sql_show.cc +++ b/sql/sql_show.cc @@ -1991,6 +1991,8 @@ int fill_schema_processlist(THD* thd, TABLE_LIST* tables, COND* cond) pthread_mutex_unlock(&mysys_var->mutex); /* INFO */ + /* Lock THD mutex that protects its data when looking at it. */ + pthread_mutex_lock(&tmp->LOCK_thd_data); if (tmp->query()) { table->field[7]->store(tmp->query(), @@ -1998,6 +2000,7 @@ int fill_schema_processlist(THD* thd, TABLE_LIST* tables, COND* cond) tmp->query_length()), cs); table->field[7]->set_notnull(); } + pthread_mutex_unlock(&tmp->LOCK_thd_data); if (schema_table_store_record(thd, table)) { |