[MDEV-30613] output_core_info crashes in my_read() Created: 2023-02-08 Updated: 2023-10-19 Resolved: 2023-03-08 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Server |
| Affects Version/s: | 10.4 |
| Fix Version/s: | 10.11.3, 11.0.2, 10.4.29, 10.5.20, 10.6.13, 10.8.8, 10.9.6, 10.10.4 |
| Type: | Bug | Priority: | Major |
| Reporter: | Vladislav Vaintroub | Assignee: | Daniel Black |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Issue Links: |
|
||||||||
| Description |
|
Seen in 10.4, possibly present elsewhere, did not check From
The problem here is using my_read, which may accesses thread local storage variables and can dereference null pointer, if variables are not initialized for example, the innocuously looking line
in my_read() potentially dereferences null pointer, since my_errno expands to my_thread_var->thr_errno, which in turn does my_pthread_getspecific() to get my_thread_var. I think the solution might be to abandon "my_" functions in error handler, an replace them with posix. unless one can rewrite the "my_" stuff in a safe manner, rather than assume existence of mysys thread local storage variable. |
| Comments |
| Comment by Daniel Black [ 2023-02-08 ] |
|
Thanks. I'd looked over this fault numerous times over years without spotting it. Though I was recently bitten by it, |
| Comment by Otto Kekäläinen [ 2023-02-12 ] |
|
This was referenced in discussion at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1030510 about s390x failing to run on Debian buildd hosts (=zero tests passed). However it is likely that the actual root cause in that case is a kernel bug Daniel reported in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1020831. |