Bug#33899: Deadlock in mysql_real_query with shared memory connections

The problem is that the read and write methods of the shared
memory transport (protocol) didn't react to asynchronous close
events, which could lead to a lock up as the client would wait
(until time out) for a server response that will never come.

The solution is to also wait for close events while waiting
for I/O from or to the server.

1 files changed, 13 insertions, 7 deletions

diff --git a/vio/viosocket.c b/vio/viosocket.c
index 13fbf5d98d8..59ec78014d0 100644
--- a/vio/viosocket.c
+++ b/vio/viosocket.c
@@ -479,26 +479,28 @@ int vio_read_shared_memory(Vio * vio, gptr buf, int size)
   int length;
   int remain_local;
   char *current_postion;
+  HANDLE events[2];
 
   DBUG_ENTER("vio_read_shared_memory");
   DBUG_PRINT("enter", ("sd: %d  buf: 0x%lx  size: %d", vio->sd, buf, size));
 
   remain_local = size;
   current_postion=buf;
+
+  events[0]= vio->event_server_wrote;
+  events[1]= vio->event_conn_closed;
+
   do
   {
     if (vio->shared_memory_remain == 0)
     {
-      HANDLE events[2];
-      events[0]= vio->event_server_wrote;
-      events[1]= vio->event_conn_closed;
       /*
         WaitForMultipleObjects can return next values:
          WAIT_OBJECT_0+0 - event from vio->event_server_wrote
          WAIT_OBJECT_0+1 - event from vio->event_conn_closed. We can't read anything
          WAIT_ABANDONED_0 and WAIT_TIMEOUT - fail.  We can't read anything
       */
-      if (WaitForMultipleObjects(2, (HANDLE*)&events,FALSE,
+      if (WaitForMultipleObjects(array_elements(events), events, FALSE,
                                  vio->net->read_timeout*1000) != WAIT_OBJECT_0)
       {
         DBUG_RETURN(-1);
@@ -537,19 +539,23 @@ int vio_write_shared_memory(Vio * vio, const gptr buf, int size)
 {
   int length;
   uint remain;
-  HANDLE pos;
   int sz;
   char *current_postion;
+  HANDLE pos, events[2];
 
   DBUG_ENTER("vio_write_shared_memory");
   DBUG_PRINT("enter", ("sd: %d  buf: 0x%lx  size: %d", vio->sd, buf, size));
 
   remain = size;
   current_postion = buf;
+
+  events[0]= vio->event_server_read;
+  events[1]= vio->event_conn_closed;
+
   while (remain != 0)
   {
-    if (WaitForSingleObject(vio->event_server_read, vio->net->write_timeout*1000) 
-                            != WAIT_OBJECT_0)
+    if (WaitForMultipleObjects(array_elements(events), events, FALSE,
+                               vio->net->write_timeout*1000) != WAIT_OBJECT_0)
     {
       DBUG_RETURN(-1);
     };