Query_cache::resize() frees memory containing active locks
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
MariaDB |
Fix Released
|
Medium
|
Vladislav Vaintroub |
Bug Description
Found when investigating Windows application verifier errors (application verifier is sort-of valgrind).
The callstack leading of "free" containing critical section is:
mysqld!free
my_no_flags_free
Query_
Query_
fix_query_
set_var::update
sql_set_variables
mysql_
mysql_parse
The callstack of critical section allocation is :
pthread_cond_init
my_rwlock_init
Query_
Query_
execute_
mysql_
mysql_parse
Why freeing a heap block containing active critical section is bad
- in the best case (the critical section is unlocked) it may lead to resource leakage, e.g underlying Windows event objects will be leaked.
- in the worst case (critical section is locked) it could lead to random hangs when the freed memory is again reused for another critical section
Release in 5.2.7