• Praveenkumar Hulakund's avatar
    Bug#19070633 - POSSIBLE ACCESS TO FREED MEMORY IN IS_FREE_LOCK() · 508c74ac
    Praveenkumar Hulakund authored
                    AND IS_USED_LOCK().
    
    Analysis:
    -----------
    In functions Item_func_is_free_lock::val_int() and 
    Item_func_is_used_lock::val_int(), for the specified user lock
    name, pointer to its "User_level_lock" object is obtained from hash
    "hash_user_locks". Mutex "LOCK_user_locks" is acquired for this
    and released immediately. And we are accessing members of
    User_level_lock after releasing the mutex. If same user lock is
    deleted(released) from concurrent thread then accessing members
    results in invalid(freed) memory access issue.
    
    Deleting of user lock is also protected from the mutex
    "LOCK_user_locks". Since this mutex is released in "val_int" 
    functions mentioned above, delete operation proceeds while concurrent
    thread tries to access its members.
    
    With the test case, valgrind reports invalid read issues in val_int
    functions.
    
    Fix:
    -----------
    To fix this issue, in "val_int" function of classes
    "Item_func_is_free_lock" and "Item_func_is_used_lock", now releasing
    mutex "LOCK_user_locks" after accessing User_level_lock members.
    508c74ac
item_func.cc 168 KB