MDEV-18836 ASAN: heap-use-after-free after TRUNCATE
row_drop_tables_for_mysql_in_background(): Copy the table name before closing the table handle, to avoid heap-use-after-free if another thread succeeds in dropping the table before row_drop_table_for_mysql_in_background() completes the table name lookup. dict_mem_create_temporary_tablename(): With innodb_safe_truncate=ON (the default), generate a simple, unique, collision-free table name using only the id, no pseudorandom component. This is safe, because on startup, we will drop any #sql tables that might exist in InnoDB. This is a backport from 10.3. It should have been backported already as part of backporting MDEV-14717,MDEV-14585 which were prerequisites for the MDEV-13564 backup-friendly TRUNCATE TABLE. This seems to reduce the chance of table creation failures in ha_innobase::truncate(). ha_innobase::truncate(): Do not invoke close(), but instead mimic it, so that we can restore to the original table handle in case opening the truncated copy of the table failed.
Showing
Please register or sign in to comment