• Sujatha's avatar
    MDEV-19716: ASAN use-after-poison in Query_log_event::Query_log_event /... · 4bad6aa9
    Sujatha authored
    MDEV-19716: ASAN use-after-poison in Query_log_event::Query_log_event / THD::log_events_and_free_tmp_shares
    
    Analysis:
    ========
    When a given client session ends on a master, the server logs a DROP TEMPORARY
    TABLE IF EXISTS statement for each temporary table that still exists in the
    current session. It ensures a proper temporary table cleanup on the slave. In
    order to write the DROP TEMPORARY TABLE query in binary log a 'Query_log_event'
    object is created. Within the 'Query_log_event' constructor
    'thd->lex->sql_command' is read to identify what type of cache needs to be
    used to write the query. When the code reaches here as part of THD::cleanup
    the 'thd->lex->sql_command' will be in an invalid state. The 'thd->lex' could
    have been cleared or it could be pointing to a statement which was in the
    middle of execution when the session ended. In such cases ASAN reports
    use-after-poison error.
    
    Fix:
    ===
    The 'THD::Cleanup' code invokes 'THD::log_events_and_free_tmp_shares' to look
    for temporary tables and write appropriate DROP TABLE stmts for them. This
    cleanup code provides a special flag named 'direct=TRUE' to the
    Query_log_event constructor. Having 'direct=TRUE' means that this query
    doesn't require any caching. Hence in this scenario the 'Query_log_event'
    constructor should respect the 'direct' flag and simply skip the logic of
    deciding the type of cache to be used for the statement. Hence the code will
    not access the stale lex object.
    4bad6aa9
log_event.cc 472 KB