mirror of
https://github.com/MariaDB/server.git
synced 2025-01-17 12:32:27 +01:00
c0817dac99
trx->mysql_thd can be zeroed-out between thd_get_thread_id() and thd_query_safe() calls in fill_trx_row(). trx_disconnect_prepared() zeroes out trx->mysql_thd. And this can cause null pointer dereferencing in fill_trx_row(). fill_trx_row() is invoked from fetch_data_into_cache() under trx_sys.mutex. Bug fix is in reseting trx_t::mysql_thd in trx_disconnect_prepared() under trx_sys.mutex lock too. MTR test case can't be created for the fix, as we need to wait for trx_t::mysql_thd reseting in fill_trx_row() after trx_t::mysql_thd was checked for null while trx_sys.mutex is held. But trx_t::mysql_thd must be reset in trx_disconnect_prepared() under trx_sys.mutex. There will be deadlock. |
||
|---|---|---|
| .. | ||
| archive | ||
| blackhole | ||
| cassandra | ||
| connect | ||
| csv | ||
| example | ||
| federated | ||
| federatedx | ||
| heap | ||
| innobase | ||
| maria | ||
| mroonga | ||
| myisam | ||
| myisammrg | ||
| oqgraph | ||
| perfschema | ||
| rocksdb | ||
| sequence | ||
| sphinx | ||
| spider | ||
| test_sql_discovery | ||
| tokudb | ||