mariadb/storage
Nikita Malyavin 12614af1fe MDEV-17005 ASAN heap-use-after-free in innobase_get_computed_value
This is the race between DELETE and INSERT (or other any two operations accessing to the table).
What should happen in good case:
1. ALTER TABLE is issued. vc_templ->default_rec is initialized with temporary share's default_fields
2. temporary share is freed, but datadict is still there, with garbage in vc_templ->default_rec
3. DELETE is issued. It is first after ALTER TABLE finished.
4. ha_innobase::open() is called, ib_table->get_ref_count() should be one
5. we reinitialize vc_templ, so no garbage anymore

What actually happens:
3. DELETE is issued.
4. ha_innobase::open() is called and ib_table->get_ref_count() is 1
5. INSERT (or SELECT etc.) is issued in parallel
6. ha_innobase::open() is called and ib_table->get_ref_count() is 1
7. we check ib_table->get_ref_count()  and it is 2 in both threads when we want reinitialize vc_templ
8. garbage is there

Fix:
* Do not store pointers to SHARE memory in table dict, copy it instead.
* But then we don't need to refresh it each time when refcount=1.
2019-07-22 20:29:42 +10:00
..
archive Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
blackhole MDEV-11094: Blackhole table updates on slave fail when row annotation is enabled 2019-05-29 17:35:29 +05:30
cassandra Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
connect Merge 10.1 into 10.2 2019-07-18 13:10:09 +03:00
csv Merge branch '5.5' into 10.1 2019-05-11 22:19:05 +03:00
example Merge branch '5.5' into 10.1 2019-05-11 22:19:05 +03:00
federated Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
federatedx Merge 10.1 into 10.2 2019-04-03 19:58:47 +03:00
heap imporve clang build 2019-06-25 13:21:36 +03:00
innobase MDEV-17005 ASAN heap-use-after-free in innobase_get_computed_value 2019-07-22 20:29:42 +10:00
maria Remove a conditionally unused declaration 2019-07-19 11:45:35 +03:00
mroonga fix clang warnings 2019-07-09 22:16:43 +03:00
myisam imporve clang build 2019-06-25 13:21:36 +03:00
myisammrg imporve clang build 2019-06-25 13:21:36 +03:00
oqgraph Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
perfschema imporve clang build 2019-06-25 13:21:36 +03:00
rocksdb MDEV#20107: rocksdb.check_ignore_unknown_options fails on OS X again 2019-07-19 21:24:28 +03:00
sequence Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
sphinx MDEV-16544 - crash in ha_sphinx::create() 2018-08-04 22:53:16 +01:00
spider Merge 10.1 into 10.2 2019-07-09 13:22:22 +03:00
test_sql_discovery Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
tokudb Merge 10.1 into 10.2 2019-06-12 10:30:01 +03:00
xtradb Merge 10.1 into 10.2 2019-07-18 23:38:48 +03:00