From 2e4717ffcd8a3c7a025be78a7328ec219bed97db Mon Sep 17 00:00:00 2001 From: Marc Alff Date: Wed, 15 Sep 2010 12:20:48 -0600 Subject: [PATCH] Bug#56761 Segfault on CHECKSUM TABLE performance_schema.EVENTS_WAITS_HISTORY EXTENDED Before this fix, the server could crash inside a memcpy when reading data from the EVENTS_WAITS_CURRENT / HISTORY / HISTORY_LONG tables. The root cause is that the length used in a memcpy could be corrupted, when another thread writes data in the wait record being read. Reading unsafe data is ok, per design choice, and the code does sanitize the data in general, but did not sanitize the length given to memcpy. The fix is to also sanitize the schema name / object name / file name length when extracting the data to produce a row. --- mysql-test/suite/perfschema/r/checksum.result | 34 ++++++++++ mysql-test/suite/perfschema/t/checksum.test | 64 +++++++++++++++++++ storage/perfschema/table_events_waits.cc | 20 ++++-- storage/perfschema/table_events_waits.h | 2 +- 4 files changed, 112 insertions(+), 8 deletions(-) create mode 100644 mysql-test/suite/perfschema/r/checksum.result create mode 100644 mysql-test/suite/perfschema/t/checksum.test diff --git a/mysql-test/suite/perfschema/r/checksum.result b/mysql-test/suite/perfschema/r/checksum.result new file mode 100644 index 00000000000..323cb303dae --- /dev/null +++ b/mysql-test/suite/perfschema/r/checksum.result @@ -0,0 +1,34 @@ +checksum table performance_schema.COND_INSTANCES; +checksum table performance_schema.EVENTS_WAITS_CURRENT; +checksum table performance_schema.EVENTS_WAITS_HISTORY; +checksum table performance_schema.EVENTS_WAITS_HISTORY_LONG; +checksum table performance_schema.EVENTS_WAITS_SUMMARY_BY_INSTANCE; +checksum table performance_schema.EVENTS_WAITS_SUMMARY_BY_THREAD_BY_EVENT_NAME; +checksum table performance_schema.EVENTS_WAITS_SUMMARY_GLOBAL_BY_EVENT_NAME; +checksum table performance_schema.FILE_INSTANCES; +checksum table performance_schema.FILE_SUMMARY_BY_EVENT_NAME; +checksum table performance_schema.FILE_SUMMARY_BY_INSTANCE; +checksum table performance_schema.MUTEX_INSTANCES; +checksum table performance_schema.PERFORMANCE_TIMERS; +checksum table performance_schema.RWLOCK_INSTANCES; +checksum table performance_schema.SETUP_CONSUMERS; +checksum table performance_schema.SETUP_INSTRUMENTS; +checksum table performance_schema.SETUP_TIMERS; +checksum table performance_schema.THREADS; +checksum table performance_schema.COND_INSTANCES extended; +checksum table performance_schema.EVENTS_WAITS_CURRENT extended; +checksum table performance_schema.EVENTS_WAITS_HISTORY extended; +checksum table performance_schema.EVENTS_WAITS_HISTORY_LONG extended; +checksum table performance_schema.EVENTS_WAITS_SUMMARY_BY_INSTANCE extended; +checksum table performance_schema.EVENTS_WAITS_SUMMARY_BY_THREAD_BY_EVENT_NAME extended; +checksum table performance_schema.EVENTS_WAITS_SUMMARY_GLOBAL_BY_EVENT_NAME extended; +checksum table performance_schema.FILE_INSTANCES extended; +checksum table performance_schema.FILE_SUMMARY_BY_EVENT_NAME extended; +checksum table performance_schema.FILE_SUMMARY_BY_INSTANCE extended; +checksum table performance_schema.MUTEX_INSTANCES extended; +checksum table performance_schema.PERFORMANCE_TIMERS extended; +checksum table performance_schema.RWLOCK_INSTANCES extended; +checksum table performance_schema.SETUP_CONSUMERS extended; +checksum table performance_schema.SETUP_INSTRUMENTS extended; +checksum table performance_schema.SETUP_TIMERS extended; +checksum table performance_schema.THREADS extended; diff --git a/mysql-test/suite/perfschema/t/checksum.test b/mysql-test/suite/perfschema/t/checksum.test new file mode 100644 index 00000000000..d7fdd7b4c2c --- /dev/null +++ b/mysql-test/suite/perfschema/t/checksum.test @@ -0,0 +1,64 @@ +# Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved. +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software Foundation, +# 51 Franklin Street, Suite 500, Boston, MA 02110-1335 USA */ + +# Tests for PERFORMANCE_SCHEMA + +--source include/not_embedded.inc +--source include/have_perfschema.inc + +# +# The checksum value itself is random (data is volatile), +# just testing that this does not crash +# +--disable_result_log + +checksum table performance_schema.COND_INSTANCES; +checksum table performance_schema.EVENTS_WAITS_CURRENT; +checksum table performance_schema.EVENTS_WAITS_HISTORY; +checksum table performance_schema.EVENTS_WAITS_HISTORY_LONG; +checksum table performance_schema.EVENTS_WAITS_SUMMARY_BY_INSTANCE; +checksum table performance_schema.EVENTS_WAITS_SUMMARY_BY_THREAD_BY_EVENT_NAME; +checksum table performance_schema.EVENTS_WAITS_SUMMARY_GLOBAL_BY_EVENT_NAME; +checksum table performance_schema.FILE_INSTANCES; +checksum table performance_schema.FILE_SUMMARY_BY_EVENT_NAME; +checksum table performance_schema.FILE_SUMMARY_BY_INSTANCE; +checksum table performance_schema.MUTEX_INSTANCES; +checksum table performance_schema.PERFORMANCE_TIMERS; +checksum table performance_schema.RWLOCK_INSTANCES; +checksum table performance_schema.SETUP_CONSUMERS; +checksum table performance_schema.SETUP_INSTRUMENTS; +checksum table performance_schema.SETUP_TIMERS; +checksum table performance_schema.THREADS; + +checksum table performance_schema.COND_INSTANCES extended; +checksum table performance_schema.EVENTS_WAITS_CURRENT extended; +checksum table performance_schema.EVENTS_WAITS_HISTORY extended; +checksum table performance_schema.EVENTS_WAITS_HISTORY_LONG extended; +checksum table performance_schema.EVENTS_WAITS_SUMMARY_BY_INSTANCE extended; +checksum table performance_schema.EVENTS_WAITS_SUMMARY_BY_THREAD_BY_EVENT_NAME extended; +checksum table performance_schema.EVENTS_WAITS_SUMMARY_GLOBAL_BY_EVENT_NAME extended; +checksum table performance_schema.FILE_INSTANCES extended; +checksum table performance_schema.FILE_SUMMARY_BY_EVENT_NAME extended; +checksum table performance_schema.FILE_SUMMARY_BY_INSTANCE extended; +checksum table performance_schema.MUTEX_INSTANCES extended; +checksum table performance_schema.PERFORMANCE_TIMERS extended; +checksum table performance_schema.RWLOCK_INSTANCES extended; +checksum table performance_schema.SETUP_CONSUMERS extended; +checksum table performance_schema.SETUP_INSTRUMENTS extended; +checksum table performance_schema.SETUP_TIMERS extended; +checksum table performance_schema.THREADS extended; + +--enable_result_log + diff --git a/storage/perfschema/table_events_waits.cc b/storage/perfschema/table_events_waits.cc index 5e5972b68f1..d34f6fbe722 100644 --- a/storage/perfschema/table_events_waits.cc +++ b/storage/perfschema/table_events_waits.cc @@ -187,7 +187,7 @@ void table_events_waits_common::clear_object_columns() */ void table_events_waits_common::make_row(bool thread_own_wait, PFS_thread *pfs_thread, - PFS_events_waits *wait) + volatile PFS_events_waits *wait) { pfs_lock lock; PFS_thread *safe_thread; @@ -251,21 +251,27 @@ void table_events_waits_common::make_row(bool thread_own_wait, case WAIT_CLASS_TABLE: m_row.m_object_type= "TABLE"; m_row.m_object_type_length= 5; - memcpy(m_row.m_object_schema, wait->m_schema_name, - wait->m_schema_name_length); m_row.m_object_schema_length= wait->m_schema_name_length; - memcpy(m_row.m_object_name, wait->m_object_name, - wait->m_object_name_length); + if (unlikely((m_row.m_object_schema_length == 0) || + (m_row.m_object_schema_length > sizeof(m_row.m_object_schema)))) + return; + memcpy(m_row.m_object_schema, wait->m_schema_name, m_row.m_object_schema_length); m_row.m_object_name_length= wait->m_object_name_length; + if (unlikely((m_row.m_object_name_length == 0) || + (m_row.m_object_name_length > sizeof(m_row.m_object_name)))) + return; + memcpy(m_row.m_object_name, wait->m_object_name, m_row.m_object_name_length); safe_class= &global_table_class; break; case WAIT_CLASS_FILE: m_row.m_object_type= "FILE"; m_row.m_object_type_length= 4; m_row.m_object_schema_length= 0; - memcpy(m_row.m_object_name, wait->m_object_name, - wait->m_object_name_length); m_row.m_object_name_length= wait->m_object_name_length; + if (unlikely((m_row.m_object_name_length == 0) || + (m_row.m_object_name_length > sizeof(m_row.m_object_name)))) + return; + memcpy(m_row.m_object_name, wait->m_object_name, m_row.m_object_name_length); safe_class= sanitize_file_class((PFS_file_class*) wait->m_class); break; case NO_WAIT_CLASS: diff --git a/storage/perfschema/table_events_waits.h b/storage/perfschema/table_events_waits.h index 2aa88b54be4..aa4edb4a368 100644 --- a/storage/perfschema/table_events_waits.h +++ b/storage/perfschema/table_events_waits.h @@ -137,7 +137,7 @@ protected: void clear_object_columns(); void make_row(bool thread_own_wait, PFS_thread *pfs_thread, - PFS_events_waits *wait); + volatile PFS_events_waits *wait); /** Current row. */ row_events_waits m_row;