Skip to content

Commit 3ad0e7e

Browse files
FooBarriorvuvova
authored andcommitted
MDEV-30924 Server crashes in MYSQL_LOG::is_open upon ALTER vs FUNCTION
ASAN showed use-after-free in binlog_online_alter_end_trans, during running through thd->online_alter_cache_list. In online_alter_binlog_get_cache_data, new_cache_data was allocated on thd->mem_root, in case of autocommit=1, but this mem_root could be freed in sp_head::execute, upon using stored functions. It appears that thd->transaction->mem_root exists even in single-stmt transaction mode (i.e autocommit=1), so it can be used in all cases. This mem_root will remain valid till the end of transaction, including commit phase.
1 parent 6b35d6a commit 3ad0e7e

File tree

3 files changed

+51
-2
lines changed

3 files changed

+51
-2
lines changed

mysql-test/main/alter_table_online_debug.result

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1190,5 +1190,27 @@ set debug_sync= 'now signal goon';
11901190
connection default;
11911191
drop table t;
11921192
#
1193+
# MDEV-30924 Server crashes in MYSQL_LOG::is_open upon ALTER vs FUNCTION
1194+
#
1195+
create table t (a int);
1196+
insert into t values (1),(2);
1197+
create function f () returns int
1198+
begin
1199+
update t set a = 10;
1200+
return 0;
1201+
end $
1202+
set debug_sync= 'alter_table_online_downgraded signal downgraded wait_for goon';
1203+
alter table t force, algorithm=copy;
1204+
connection con1;
1205+
set debug_sync= 'now wait_for downgraded';
1206+
select f();
1207+
f()
1208+
0
1209+
set debug_sync= 'now signal goon';
1210+
connection default;
1211+
drop table t;
1212+
drop function f;
1213+
disconnect con1;
1214+
#
11931215
# End of 11.2 tests
11941216
#

mysql-test/main/alter_table_online_debug.test

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1370,6 +1370,34 @@ set debug_sync= 'now signal goon';
13701370
--reap
13711371
drop table t;
13721372

1373+
--echo #
1374+
--echo # MDEV-30924 Server crashes in MYSQL_LOG::is_open upon ALTER vs FUNCTION
1375+
--echo #
1376+
create table t (a int);
1377+
insert into t values (1),(2);
1378+
1379+
--delimiter $
1380+
create function f () returns int
1381+
begin
1382+
update t set a = 10;
1383+
return 0;
1384+
end $
1385+
--delimiter ;
1386+
1387+
set debug_sync= 'alter_table_online_downgraded signal downgraded wait_for goon';
1388+
send alter table t force, algorithm=copy;
1389+
1390+
--connection con1
1391+
set debug_sync= 'now wait_for downgraded';
1392+
select f();
1393+
set debug_sync= 'now signal goon';
1394+
1395+
--connection default
1396+
--reap
1397+
drop table t;
1398+
drop function f;
1399+
--disconnect con1
1400+
13731401
--echo #
13741402
--echo # End of 11.2 tests
13751403
--echo #

sql/log.cc

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6449,8 +6449,7 @@ online_alter_cache_data *online_alter_binlog_get_cache_data(THD *thd, TABLE *tab
64496449
return &cache;
64506450
}
64516451

6452-
MEM_ROOT *root= thd->in_multi_stmt_transaction_mode()
6453-
? &thd->transaction->mem_root : thd->mem_root;
6452+
MEM_ROOT *root= &thd->transaction->mem_root;
64546453
auto *new_cache_data= binlog_setup_cache_data(root, table->s);
64556454
list.push_back(*new_cache_data);
64566455

0 commit comments

Comments
 (0)