Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MDEV-35852 : ASAN heap-use-after-free in WSREP_DEBUG after INSERT DEL… #3769

Closed
wants to merge 1 commit into from
Closed

MDEV-35852 : ASAN heap-use-after-free in WSREP_DEBUG after INSERT DEL… #3769

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions mysql-test/suite/galera/r/MDEV-35852.result
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
connection node_2;
connection node_1;
CREATE TABLE t (a INT) ENGINE=InnoDB;
INSERT DELAYED INTO t VALUES ();
ERROR HY000: DELAYED option not supported for table 't'
DROP TABLE t;
INSERT DELAYED t1 () VALUES ();
ERROR 42S02: Table 'test.t1' doesn't exist
4 changes: 4 additions & 0 deletions mysql-test/suite/galera/t/MDEV-35852.cnf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
!include ../galera_2nodes.cnf

[mysqld]
wsrep-debug=1
9 changes: 9 additions & 0 deletions mysql-test/suite/galera/t/MDEV-35852.test
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
--source include/galera_cluster.inc

CREATE TABLE t (a INT) ENGINE=InnoDB;
--error ER_DELAYED_NOT_SUPPORTED
INSERT DELAYED INTO t VALUES ();
DROP TABLE t;

--error ER_NO_SUCH_TABLE
INSERT DELAYED t1 () VALUES ();
13 changes: 8 additions & 5 deletions sql/handler.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2286,8 +2286,10 @@ int ha_rollback_trans(THD *thd, bool all)
my_error(ER_ERROR_DURING_ROLLBACK, MYF(0), err);
error=1;
#ifdef WITH_WSREP
WSREP_WARN("handlerton rollback failed, thd %lld %lld conf %d SQL %s",
WSREP_WARN("handlerton rollback failed, thd %lld %lld "
"conf %d wsrep_err %s SQL %s",
thd->thread_id, thd->query_id, thd->wsrep_trx().state(),
wsrep::to_c_string(thd->wsrep_cs().current_error()),
thd->query());
#endif /* WITH_WSREP */
}
Expand All @@ -2300,11 +2302,12 @@ int ha_rollback_trans(THD *thd, bool all)
}

#ifdef WITH_WSREP
if (thd->is_error())
if (WSREP(thd) && thd->is_error())
{
WSREP_DEBUG("ha_rollback_trans(%lld, %s) rolled back: %s: %s; is_real %d",
thd->thread_id, all?"TRUE":"FALSE", wsrep_thd_query(thd),
thd->get_stmt_da()->message(), is_real_trans);
WSREP_DEBUG("ha_rollback_trans(%lld, %s) rolled back: msg %s is_real %d wsrep_err %s",
thd->thread_id, all? "TRUE" : "FALSE",
thd->get_stmt_da()->message(), is_real_trans,
wsrep::to_c_string(thd->wsrep_cs().current_error()));
}

// REPLACE|INSERT INTO ... SELECT uses TOI in consistency check
Expand Down
4 changes: 3 additions & 1 deletion sql/service_wsrep.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
/* Copyright 2018-2024 Codership Oy <[email protected]>
/* Copyright 2018-2025 Codership Oy <[email protected]>

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
Expand Down Expand Up @@ -86,7 +86,9 @@ extern "C" const char *wsrep_thd_query(const THD *thd)
return "SET PASSWORD";
/* fallthrough */
default:
{
return (thd->query() ? thd->query() : "NULL");
}
}
return "NULL";
}
Expand Down
1 change: 1 addition & 0 deletions sql/sql_insert.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2433,6 +2433,7 @@ class Delayed_insert :public ilink {
delayed_insert_threads--;

my_free(thd.query());
thd->reset_query_inner();
thd.security_ctx->user= 0;
thd.security_ctx->host= 0;
}
Expand Down