Details
-
Bug
-
Status: Approved (View Workflow)
-
Critical
-
Resolution: Unresolved
-
10.11, 12.3
-
Can result in hang or crash
-
Q3/2026 Replic. Development
Description
- CWE-362 Race Condition → CWE-416 Use After Free
psergei stumbled upon a random MSAN CI failure from within stop_slave.inc; the attached logfile is snippets from the log.
My analysis confirms that this is a part of MDEV-36287, which reported that SHOW SLAVE STATUS did not hold the run_lock mutex of the replication threads when retrieving Slave_IO/SQL_State.
If the replication thread shuts down, then SHOW SLAVE STATUS may be retrieving these states from a THD data that has just been deleted, resulting in a risk of crash (invalid memory access) or an unexpected result (if the memory has then been reässigned, potentially to private data, though consistency is only feasible in a lab environment.)
Although MDEV-36287 was considered fixed, it missed that the SQL thread’s synchronization is independent of the IO thread’s; that is, it held mi->run_lock, but not mi->rli.run_lock.
It therefore has only fixed the race with a closing IO thread, not a closing SQL thread.
Attachments
Issue Links
- is caused by
-
MDEV-36287 Server crash in SHOW SLAVE STATUS concurrent with STOP SLAVE
-
- Closed
-
- split from
-
MDEV-36287 Server crash in SHOW SLAVE STATUS concurrent with STOP SLAVE
-
- Closed
-