Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40298

Use-After-Free when SQL Thread stops in the middle of SHOW SLAVE STATUS

    XMLWordPrintable

Details

    Description

      • CWE-362 Race Condition → CWE-416 Use After Free

      psergei stumbled upon a random MSAN CI failure from within stop_slave.inc; the attached logfile is snippets from the log.

      My analysis confirms that this is a part of MDEV-36287, which reported that SHOW SLAVE STATUS did not hold the run_lock mutex of the replication threads when retrieving Slave_IO/SQL_State.
      If the replication thread shuts down, then SHOW SLAVE STATUS may be retrieving these states from a THD data that has just been deleted, resulting in a risk of crash (invalid memory access) or an unexpected result (if the memory has then been reässigned, potentially to private data, though consistency is only feasible in a lab environment.)

      Although MDEV-36287 was considered fixed, it missed that the SQL thread’s synchronization is independent of the IO thread’s; that is, it held mi->run_lock, but not mi->rli.run_lock.
      It therefore has only fixed the race with a closing IO thread, not a closing SQL thread.

      Attachments

        Issue Links

          Activity

            People

              ParadoxV5 Jimmy Hú
              ParadoxV5 Jimmy Hú
              Jimmy Hú Jimmy Hú
              Kristian Nielsen Kristian Nielsen
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Time Tracking

                  Estimated:
                  Original Estimate - 1.5d
                  1.5d
                  Remaining:
                  Time Spent - 7h 5m Remaining Estimate - 3h 20m
                  3h 20m
                  Logged:
                  Time Spent - 7h 5m Remaining Estimate - 3h 20m Time Not Required
                  7h 5m

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.