[MXS-328] Read-Write router frees buffer after write (which also frees) Created: 2015-08-22 Updated: 2015-09-17 Resolved: 2015-08-27 |
|
| Status: | Closed |
| Project: | MariaDB MaxScale |
| Component/s: | readwritesplit |
| Affects Version/s: | 1.2.0 |
| Fix Version/s: | 1.2.1 |
| Type: | Bug | Priority: | Major |
| Reporter: | martin brampton (Inactive) | Assignee: | markus makela |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Environment: |
Any |
||
| Description |
|
In the current develop branch at line 2603 is gwbuf_free(wbuf). This is on a return of zero (failure) from line 2589: if ((ret = target_dcb->func.write(target_dcb, wbuf)) == 1). This fails with an abort based on glibc double free detection. The free statement appears wrong, based on the principle that a DCB write always takes responsibility for the buffer, either freeing it or queueing it for later write. In the particular case, there was an authentication failure which prevented write, and the buffer was freed by the MySQL client protocol. Hence the double free. This is recorded as a bug because there could be other similar instances. |
| Comments |
| Comment by markus makela [ 2015-08-27 ] |
|
Removed all calls to gwbuf_free when a write fails. |