Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40298

Use-After-Free when SQL Thread stops in the middle of SHOW SLAVE STATUS

    XMLWordPrintable

Details

    • Can result in hang or crash
    • Hide
      Running SHOW SLAVE STATUS (or SHOW ALL SLAVES STATUS) at the same moment a STOP SLAVE stopped the SQL thread could crash the server; the statement's read of the SQL thread's state was only synchronized with the IO thread's shutdown, so a stopping SQL thread could free that state while it was being read; the read is now synchronized with SQL thread shutdown, and the crash no longer occurs
      Show
      Running SHOW SLAVE STATUS (or SHOW ALL SLAVES STATUS) at the same moment a STOP SLAVE stopped the SQL thread could crash the server; the statement's read of the SQL thread's state was only synchronized with the IO thread's shutdown, so a stopping SQL thread could free that state while it was being read; the read is now synchronized with SQL thread shutdown, and the crash no longer occurs
    • Q3/2026 Replic. Development

    Description

      • CWE-362 Race Condition → CWE-416 Use After Free

      psergei stumbled upon a random MSAN CI failure from within stop_slave.inc; the attached logfile is snippets from the log.

      My analysis confirms that this is a part of MDEV-36287, which reported that SHOW SLAVE STATUS did not hold the run_lock mutex of the replication threads when retrieving Slave_IO/SQL_State.
      If the replication thread shuts down, then SHOW SLAVE STATUS may be retrieving these states from a THD data that has just been deleted, resulting in a risk of crash (invalid memory access) or an unexpected result (if the memory has then been reässigned, potentially to private data, though consistency is only feasible in a lab environment.)

      Although MDEV-36287 was considered fixed, it missed that the SQL thread’s synchronization is independent of the IO thread’s; that is, it held mi->run_lock, but not mi->rli.run_lock.
      It therefore has only fixed the race with a closing IO thread, not a closing SQL thread.

      Attachments

        Issue Links

          Activity

            People

              bnestere Brandon Nesterenko
              ParadoxV5 Jimmy Hú
              Jimmy Hú Jimmy Hú
              Kristian Nielsen Kristian Nielsen
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 1.5d
                  1.5d
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 7h 35m Time Not Required
                  7h 35m

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.