Memory leak in sql_service when a statement fails after it sent its metadata

A statement that is run through the SQL service of a plugin (sql_service, with mysql_real_connect_local() and the other functions of service_sql.h) can fail after the server has sent its metadata, for example when a lock wait times out, or the statement is aborted by KILL QUERY while it waits. The error is then kept in the dataset of the result set, and embedded_get_error() in sql/sql_prepare.cc, which reports it to the caller, frees only the MYSQL_DATA structure with my_free(data), and not its MEM_ROOT. About 8 KB are lost for each such statement. The memory is accounted to the connection.

The function is the same in 10.11, and is present since 10.4, where the SQL service starts.

How to repeat

With the test_sql_service plugin, a statement of the plugin waits for an InnoDB row lock, and is aborted by KILL QUERY:

install plugin test_sql_service soname 'test_sql_service';

CREATE TABLE t1 (a INT PRIMARY KEY) ENGINE=InnoDB;

INSERT INTO t1 VALUES (1);

connect (blocker,localhost,root);

BEGIN;

SELECT * FROM t1 FOR UPDATE;

connect (con1,localhost,root);

SET innodb_lock_wait_timeout=3600;

send set global test_sql_service_execute_sql_local= 'select * from test.t1 for update';

connection default;

# wait until con1 waits for the lock, then

KILL QUERY <id of con1>;

connection con1;

reap;

show status like 'test_sql_query_result';

# Error 1317 returned. Query execution was interrupted

The statement of the plugin ends with the expected error, and its memory is not released. A debug build fails a memory accounting check when the connection ends. A lock wait timeout instead of KILL QUERY does the same.

Fix

Free the dataset with free_rows(data), which also frees its MEM_ROOT. The test above, as plugins.test_sql_service_abort, fails without the change on a debug build.