diff options
| author | Sergey Vojtovich <svoj@mariadb.org> | 2016-06-15 13:57:44 +0400 |
|---|---|---|
| committer | Sergey Vojtovich <svoj@mariadb.org> | 2016-06-21 17:04:57 +0400 |
| commit | 82a96926a77b38a36a031e34b2c4ff3e36406f3d (patch) | |
| tree | 89f6b8f0cc11ffd682142c099b0da94c1c44ab34 /sql/mdl.cc | |
| parent | 15313216bfeee4882fb1362d2fe2aec508551917 (diff) | |
| download | mariadb-git-82a96926a77b38a36a031e34b2c4ff3e36406f3d.tar.gz | |
MDEV-9728 - Hard crash in metadata_lock_info
metadata_lock_info plugin called MDL_context::find_ticket() to obtain lock
duration, which in turn iterates foreign thread private lists. These lists
can be updated by owner thread without protection.
Fixed by iterating threads (instead of MDL locks and tickets) and obtaining
data through APC.
Also fixed mdl_iterate_lock() to initialize iterator under prlock protection.
Diffstat (limited to 'sql/mdl.cc')
| -rw-r--r-- | sql/mdl.cc | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sql/mdl.cc b/sql/mdl.cc index b94a3710fd1..28d2006b023 100644 --- a/sql/mdl.cc +++ b/sql/mdl.cc @@ -706,10 +706,10 @@ static inline int mdl_iterate_lock(MDL_lock *lock, int (*callback)(MDL_ticket *ticket, void *arg), void *arg) { - MDL_lock::Ticket_iterator ticket_it(lock->m_granted); - MDL_ticket *ticket; int res= 0; mysql_prlock_rdlock(&lock->m_rwlock); + MDL_lock::Ticket_iterator ticket_it(lock->m_granted); + MDL_ticket *ticket; while ((ticket= ticket_it++) && !(res= callback(ticket, arg))) /* no-op */; mysql_prlock_unlock(&lock->m_rwlock); return res; |