• Sergei Golubchik's avatar
    MDEV-33867 main.query_cache_debug fails with heap-use-after-free · 4980fcb9
    Sergei Golubchik authored
    What's happening:
    1. Query_cache::insert() locks the QC and verifies that it's enabled
    2. parallel thread tries to disable it. trylock fails (QC is locked)
       so the status becomes DISABLE_REQUEST
    3. Query_cache::insert() calls Query_cache::write_result_data()
       which allocates a new block and unlocks the QC.
    4. Query_cache::unlock() notices there are no more QC users and a
       pending DISABLE_REQUEST so it disables the QC and frees all the
       memory, including the new block that was just allocated
    5. Query_cache::write_result_data() proceeds to write into the freed block
    
    Fix: change m_cache_status under a mutex.
    
    Approved by Oleksandr Byelkin <sanja@mariadb.com>
    4980fcb9
sql_cache.cc 161 KB