mariadb/sql
unknown 611dbd0bb3 Bug#30882 Dropping a temporary table inside a stored function may cause a server crash
If a stored function that contains a drop temporary table statement
is invoked by a create temporary table of the same name may cause
a server crash. The problem is that when dropping a table no check
is done to ensure that table is not being used by some outer query
(or outer statement), potentially leaving the outer query with a
reference to a stale (freed) table.

The solution is when dropping a temporary table, always check if
the table is being used by some outer statement as a temporary
table can be dropped inside stored procedures.

The check is performed by looking at the TABLE::query_id value for
temporary tables. To simplify this check and to solve a bug related
to handling of temporary tables in prelocked mode, this patch changes
the way in which this member is used to track the fact that table is
used/unused. Now we ensure that TABLE::query_id is zero for unused
temporary tables (which means that all temporary tables which were
used by a statement should be marked as free for reuse after it's
execution has been completed).


mysql-test/include/handler.inc:
  Add test case for side effect of Bug#30882
mysql-test/r/handler_innodb.result:
  Add test case result for side effect of Bug#30882
mysql-test/r/handler_myisam.result:
  Add test case result for side effect of Bug#30882
mysql-test/r/sp-error.result:
  Add test case result for Bug#30882
mysql-test/t/sp-error.test:
  Add test case for Bug#30882
sql/event_db_repository.cc:
  Update close_thread_tables call, no more default values.
sql/mysql_priv.h:
  Remove implicit default parameters values of the close_thread_tables
  function as no callers are using it.
sql/slave.cc:
  Update close_thread_tables call, no more default values
sql/sp_head.cc:
  Update close_thread_tables call, no more default values
sql/sql_base.cc:
  Changed the approach to distinguishing currently unused temporary tables.
  Now we ensure that such tables always have TABLE::query_id set to 0 and
  use this fact to perform checks during opening and dropping of temporary
  tables. This means that we have to call close_thread_tables() even for
  statements which use only temporary tables. To make this call cheaper,
  we re-factored close_thread_tables() to not take LOCK_open unless there
  are open base tables.
sql/sql_handler.cc:
  Properly close temporary tables associated with a handler.
sql/sql_insert.cc:
  close_temporary_table is now merged into drop_temporary_table.
sql/sql_parse.cc:
  Now the condition doesn't cover all cases because close_thread_tables()
  must be called even for statements that use only temporary tables.
sql/sql_table.cc:
  Use drop_temporary_table which perform checks to verify if
  the table is not being used. Error path problem is due to
  a handler tables issue and is going to be addressed in bug
  31397.
sql/table.h:
  Rename previously unused clear_query_id and document the usage of
  query_id and open_by_handler.
2007-11-01 18:52:56 -02:00
..
examples
share
.cvsignore
add_errmsg
authors.h
client_settings.h
CMakeLists.txt
contributors.h
custom_conf.h
derror.cc
des_key_file.cc
discover.cc
event_data_objects.cc
event_data_objects.h
event_db_repository.cc Bug#30882 Dropping a temporary table inside a stored function may cause a server crash 2007-11-01 18:52:56 -02:00
event_db_repository.h
event_queue.cc
event_queue.h
event_scheduler.cc
event_scheduler.h
events.cc
events.h
field.cc
field.h
field_conv.cc
filesort.cc
frm_crypt.cc
gen_lex_hash.cc
gstream.cc
gstream.h
ha_ndbcluster.cc
ha_ndbcluster.h
ha_ndbcluster_binlog.cc
ha_ndbcluster_binlog.h
ha_ndbcluster_cond.cc
ha_ndbcluster_cond.h
ha_ndbcluster_tables.h
ha_partition.cc
ha_partition.h
handler.cc
handler.h
hash_filo.cc
hash_filo.h
hostname.cc
init.cc
item.cc
item.h
item_buff.cc
item_cmpfunc.cc
item_cmpfunc.h
item_create.cc
item_create.h
item_func.cc
item_func.h
item_geofunc.cc
item_geofunc.h
item_row.cc
item_row.h
item_strfunc.cc
item_strfunc.h
item_subselect.cc
item_subselect.h
item_sum.cc
item_sum.h
item_timefunc.cc
item_timefunc.h
item_xmlfunc.cc
item_xmlfunc.h
key.cc
lex.h
lex_symbol.h
lock.cc
log.cc
log.h
log_event.cc
log_event.h
log_event_old.cc
log_event_old.h
Makefile.am
matherr.c
message.mc
mf_iocache.cc
my_decimal.cc
my_decimal.h
my_lock.c
mysql_priv.h Bug#30882 Dropping a temporary table inside a stored function may cause a server crash 2007-11-01 18:52:56 -02:00
mysqld.cc
mysqld_suffix.h
net_serv.cc
nt_servc.cc
nt_servc.h
opt_range.cc
opt_range.h
opt_sum.cc
parse_file.cc
parse_file.h
partition_element.h
partition_info.cc
partition_info.h
password.c
procedure.cc
procedure.h
protocol.cc
protocol.h
records.cc
repl_failsafe.cc
repl_failsafe.h
rpl_constants.h
rpl_filter.cc
rpl_filter.h
rpl_injector.cc
rpl_injector.h
rpl_mi.cc
rpl_mi.h
rpl_record.cc
rpl_record.h
rpl_record_old.cc
rpl_record_old.h
rpl_reporting.cc
rpl_reporting.h
rpl_rli.cc
rpl_rli.h
rpl_tblmap.cc
rpl_tblmap.h
rpl_utility.cc
rpl_utility.h
scheduler.cc
scheduler.h
set_var.cc
set_var.h
slave.cc Bug#30882 Dropping a temporary table inside a stored function may cause a server crash 2007-11-01 18:52:56 -02:00
slave.h
sp.cc
sp.h
sp_cache.cc
sp_cache.h
sp_head.cc Bug#30882 Dropping a temporary table inside a stored function may cause a server crash 2007-11-01 18:52:56 -02:00
sp_head.h
sp_pcontext.cc
sp_pcontext.h
sp_rcontext.cc
sp_rcontext.h
spatial.cc
spatial.h
sql_acl.cc
sql_acl.h
sql_analyse.cc
sql_analyse.h
sql_array.h
sql_base.cc Bug#30882 Dropping a temporary table inside a stored function may cause a server crash 2007-11-01 18:52:56 -02:00
sql_binlog.cc
sql_bitmap.h
sql_builtin.cc.in
sql_cache.cc
sql_cache.h
sql_class.cc
sql_class.h
sql_client.cc
sql_connect.cc Fix a compilation warning. 2007-11-01 17:00:24 +03:00
sql_crypt.cc
sql_crypt.h
sql_cursor.cc
sql_cursor.h
sql_db.cc
sql_delete.cc
sql_derived.cc
sql_do.cc
sql_error.cc
sql_error.h
sql_handler.cc Bug#30882 Dropping a temporary table inside a stored function may cause a server crash 2007-11-01 18:52:56 -02:00
sql_help.cc
sql_insert.cc Bug#30882 Dropping a temporary table inside a stored function may cause a server crash 2007-11-01 18:52:56 -02:00
sql_lex.cc
sql_lex.h
sql_list.cc
sql_list.h
sql_load.cc
sql_locale.cc
sql_manager.cc
sql_map.cc
sql_map.h
sql_olap.cc
sql_parse.cc Bug#30882 Dropping a temporary table inside a stored function may cause a server crash 2007-11-01 18:52:56 -02:00
sql_partition.cc
sql_partition.h
sql_plugin.cc
sql_plugin.h
sql_prepare.cc
sql_rename.cc
sql_repl.cc
sql_repl.h
sql_select.cc Use thd->is_error() instead of direct access to thd->net.report_error 2007-11-01 17:08:02 +03:00
sql_select.h
sql_servers.cc
sql_servers.h
sql_show.cc
sql_show.h
sql_sort.h
sql_state.c
sql_string.cc
sql_string.h
sql_table.cc Bug#30882 Dropping a temporary table inside a stored function may cause a server crash 2007-11-01 18:52:56 -02:00
sql_tablespace.cc
sql_test.cc
sql_trigger.cc
sql_trigger.h
sql_udf.cc
sql_udf.h
sql_union.cc
sql_update.cc
sql_view.cc
sql_view.h
sql_yacc.yy
stacktrace.c
stacktrace.h
strfunc.cc
structs.h
table.cc
table.h Bug#30882 Dropping a temporary table inside a stored function may cause a server crash 2007-11-01 18:52:56 -02:00
thr_malloc.cc
time.cc
tzfile.h
tztime.cc
tztime.h
udf_example.c
udf_example.def
uniques.cc
unireg.cc
unireg.h