Bug#33899: Deadlock in mysql_real_query with shared memory connections

The problem is that the read and write methods of the shared
memory transport (protocol) didn't react to asynchornous close
events, which could lead to a lock up as the client would wait
(until time out) for a server response that will never come.

The solution is to also wait for close events while waiting
for I/O from or to the server.

Bug report and patch submitted by: Armin Schöffmann

3 files changed, 41 insertions, 7 deletions

diff --git a/mysql-test/r/shm.result b/mysql-test/r/shm.result
index 36ab17c1e4d..c504fe222ef 100644
--- a/mysql-test/r/shm.result
+++ b/mysql-test/r/shm.result
@@ -2152,4 +2152,11 @@ Warnings:
 Warning	1052	Column 'kundentyp' in group statement is ambiguous
 drop table t1;
 mysqld is alive
+SET @max_allowed_packet= @@global.max_allowed_packet;
+SET @net_buffer_length= @@global.net_buffer_length;
+SET GLOBAL max_allowed_packet= 1024;
+SET GLOBAL net_buffer_length= 1024;
+ERROR 1153 (08S01) at line 1: Got a packet bigger than 'max_allowed_packet' bytes
+SET GLOBAL max_allowed_packet= @max_allowed_packet;
+SET GLOBAL net_buffer_length= @net_buffer_length;
 End of 5.0 tests.
diff --git a/mysql-test/t/shm.test b/mysql-test/t/shm.test
index 380607d8ebf..88e96ae7b45 100644
--- a/mysql-test/t/shm.test
+++ b/mysql-test/t/shm.test
@@ -16,4 +16,23 @@ if (`SELECT '$shm' != 'ON'`){
 #
 --exec $MYSQLADMIN --no-defaults --user=root --host=127.0.0.1 --port=$MASTER_MYPORT --shared-memory-base-name=HeyMrBaseNameXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX ping
 
+#
+# Bug #33899: Deadlock in mysql_real_query with shared memory connections
+#
+
+let $name= query_get_value("SHOW GLOBAL VARIABLES LIKE 'shared_memory_base_name'", Value, 1);
+let $stmt= `SELECT REPEAT('a', 2048)`;
+
+SET @max_allowed_packet= @@global.max_allowed_packet;
+SET @net_buffer_length= @@global.net_buffer_length;
+
+SET GLOBAL max_allowed_packet= 1024;
+SET GLOBAL net_buffer_length= 1024;
+
+--error 1
+--exec echo SELECT '$stmt'| $MYSQL --protocol=memory --shared-memory-base-name=$name 2>&1
+
+SET GLOBAL max_allowed_packet= @max_allowed_packet;
+SET GLOBAL net_buffer_length= @net_buffer_length;
+
 --echo End of 5.0 tests.
diff --git a/vio/viosocket.c b/vio/viosocket.c
index 942f0330c57..2d7fd0e08cd 100644
--- a/vio/viosocket.c
+++ b/vio/viosocket.c
@@ -480,19 +480,22 @@ size_t vio_read_shared_memory(Vio * vio, uchar* buf, size_t size)
   size_t length;
   size_t remain_local;
   char *current_postion;
+  HANDLE events[2];
+
   DBUG_ENTER("vio_read_shared_memory");
   DBUG_PRINT("enter", ("sd: %d  buf: 0x%lx  size: %d", vio->sd, (long) buf,
                        size));
 
   remain_local = size;
   current_postion=buf;
+
+  events[0]= vio->event_server_wrote;
+  events[1]= vio->event_conn_closed;
+
   do
   {
     if (vio->shared_memory_remain == 0)
     {
-      HANDLE events[2];
-      events[0]= vio->event_server_wrote;
-      events[1]= vio->event_conn_closed;
       /*
         WaitForMultipleObjects can return next values:
          WAIT_OBJECT_0+0 - event from vio->event_server_wrote
@@ -500,7 +503,7 @@ size_t vio_read_shared_memory(Vio * vio, uchar* buf, size_t size)
 		           anything
          WAIT_ABANDONED_0 and WAIT_TIMEOUT - fail.  We can't read anything
       */
-      if (WaitForMultipleObjects(2, (HANDLE*)&events,FALSE,
+      if (WaitForMultipleObjects(array_elements(events), events, FALSE,
                                  vio->net->read_timeout*1000) != WAIT_OBJECT_0)
       {
         DBUG_RETURN(-1);
@@ -543,17 +546,22 @@ size_t vio_write_shared_memory(Vio * vio, const uchar* buf, size_t size)
   size_t length, remain, sz;
   HANDLE pos;
   const uchar *current_postion;
+  HANDLE events[2];
+
   DBUG_ENTER("vio_write_shared_memory");
   DBUG_PRINT("enter", ("sd: %d  buf: 0x%lx  size: %d", vio->sd, (long) buf,
                        size));
 
   remain = size;
   current_postion = buf;
+
+  events[0]= vio->event_server_read;
+  events[1]= vio->event_conn_closed;
+
   while (remain != 0)
   {
-    if (WaitForSingleObject(vio->event_server_read,
-                            vio->net->write_timeout*1000) !=
-        WAIT_OBJECT_0)
+    if (WaitForMultipleObjects(array_elements(events), events, FALSE,
+                               vio->net->write_timeout*1000) != WAIT_OBJECT_0)
     {
       DBUG_RETURN((size_t) -1);
     }