mariadb/storage/maria
Vlad Lesin c9b49a4be7 MDEV-18207: ASAN heap-use-after-free in _ma_get_status upon concurrent operations with sequence
The issue is that two MARIA_HA instances shares the same MARIA_STATUS_INFO
object during UNION execution, so the second MARIA_HA instance state pointer
MARIA_HA::state points to the MARIA_HA::state_save of the first MARIA instance.

This happens in
thr_multi_lock(...) {
...
	for (first_lock=data, pos= data+1 ; pos < end ; pos++)
	{
...
		if (pos[0]->lock == pos[-1]->lock && pos[0]->lock->copy_status)
			(pos[0]->lock->copy_status)((*pos)->status_param,
																	(*first_lock)->status_param);
...
	}
...
}

Usually the state is restored from ha_maria::external_lock(...):

\#0  _ma_update_status (param=0x6290000e6270) at ./storage/maria/ma_state.c:309
\#1  0x00005555577ccb15 in _ma_update_status_with_lock (info=0x6290000e6270) at ./storage/maria/ma_state.c:361
\#2  0x00005555577c7dcc in maria_lock_database (info=0x6290000e6270, lock_type=2) at ./storage/maria/ma_locking.c:66
\#3  0x0000555557802ccd in ha_maria::external_lock (this=0x61d0001b1308, thd=0x62a000048270, lock_type=2) at ./storage/maria/ha_maria.cc:2727

But _ma_update_status() does not take into account the case when
MARIA_HA::status points to the MARIA_HA::state_save of the other MARIA_HA
instance.

The fix is to restore MARIA_HA::state in ha_maria::external_lock() after
maria_lock_database() call for transactional tables.
2019-05-31 10:03:17 +03:00
..
unittest Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
CMakeLists.txt
file_formats.txt
ft_maria.c
ha_maria.cc MDEV-18207: ASAN heap-use-after-free in _ma_get_status upon concurrent operations with sequence 2019-05-31 10:03:17 +03:00
ha_maria.h
lockman.c
lockman.h
ma_bitmap.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_blockrec.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_blockrec.h Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_cache.c
ma_changed.c
ma_check.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_check_standalone.h Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_checkpoint.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_checkpoint.h
ma_checksum.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_close.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_commit.c
ma_commit.h
ma_control_file.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_control_file.h
ma_create.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_crypt.c
ma_crypt.h
ma_dbug.c
ma_delete.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_delete_all.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_delete_table.c
ma_dynrec.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_extra.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_ft_boolean_search.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_ft_eval.c
ma_ft_eval.h
ma_ft_nlq_search.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_ft_parser.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_ft_stem.c
ma_ft_test1.c
ma_ft_test1.h
ma_ft_update.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_ftdefs.h
ma_fulltext.h
ma_info.c
ma_init.c
ma_key.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_key_recover.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_key_recover.h
ma_keycache.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_locking.c
ma_loghandler.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_loghandler.h Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_loghandler_lsn.h Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_norec.c
ma_open.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_packrec.c
ma_page.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_pagecache.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_pagecache.h
ma_pagecaches.c
ma_pagecrc.c
ma_panic.c
ma_preload.c
ma_range.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_recovery.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_recovery.h
ma_recovery_util.c
ma_recovery_util.h
ma_rename.c
ma_rfirst.c
ma_rkey.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_rlast.c
ma_rnext.c
ma_rnext_same.c
ma_rprev.c
ma_rrnd.c
ma_rsame.c
ma_rsamepos.c
ma_rt_index.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_rt_index.h
ma_rt_key.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_rt_key.h
ma_rt_mbr.c
ma_rt_mbr.h
ma_rt_split.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_rt_test.c
ma_scan.c
ma_search.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_servicethread.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_servicethread.h
ma_sort.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_sp_defs.h
ma_sp_key.c
ma_sp_test.c
ma_state.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_state.h
ma_static.c
ma_statrec.c
ma_test1.c
ma_test2.c
ma_test3.c
ma_test_all.res
ma_test_all.sh
ma_test_big.sh
ma_test_force_start.pl
ma_test_recovery
ma_trnman.h
ma_unique.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
ma_update.c
ma_write.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
maria_chk.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
maria_def.h Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
maria_dump_log.c
maria_ftdump.c
maria_pack.c
maria_read_log.c Merge 10.1 into 10.2 2019-05-13 17:54:04 +03:00
maria_rename.sh
tablockman.c
tablockman.h
test_pack
trnman.c
trnman.h
trnman_public.h