Skip to content

Commit 4980fcb

Browse files
committed
MDEV-33867 main.query_cache_debug fails with heap-use-after-free
What's happening: 1. Query_cache::insert() locks the QC and verifies that it's enabled 2. parallel thread tries to disable it. trylock fails (QC is locked) so the status becomes DISABLE_REQUEST 3. Query_cache::insert() calls Query_cache::write_result_data() which allocates a new block and unlocks the QC. 4. Query_cache::unlock() notices there are no more QC users and a pending DISABLE_REQUEST so it disables the QC and frees all the memory, including the new block that was just allocated 5. Query_cache::write_result_data() proceeds to write into the freed block Fix: change m_cache_status under a mutex. Approved by Oleksandr Byelkin <sanja@mariadb.com>
1 parent d4936c8 commit 4980fcb

File tree

1 file changed

+2
-7
lines changed

1 file changed

+2
-7
lines changed

sql/sql_cache.cc

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2530,14 +2530,9 @@ void Query_cache::destroy()
25302530

25312531
void Query_cache::disable_query_cache(THD *thd)
25322532
{
2533+
lock(thd);
25332534
m_cache_status= DISABLE_REQUEST;
2534-
/*
2535-
If there is no requests in progress try to free buffer.
2536-
try_lock(TRY) will exit immediately if there is lock.
2537-
unlock() should free block.
2538-
*/
2539-
if (m_requests_in_progress == 0 && !try_lock(thd, TRY))
2540-
unlock();
2535+
unlock();
25412536
}
25422537

25432538

0 commit comments

Comments
 (0)