From f815246486444ca2dc5d408099439e1d973d3a7b Mon Sep 17 00:00:00 2001 From: Magne Mahre Date: Fri, 18 Dec 2009 11:48:34 +0100 Subject: [PATCH] Backport to 5.1 branch (next-mr revid: 2921) Bug#35589 SET PASSWORD caused a crash Bug#35591 FLUSH PRIVILEGES caused a crash A race condition on the privilege hash tables (proc_priv_hash and func_priv_hash) caused one thread to try to delete elements that had already been deleted by another thread. The bug was caused by reading and saving the pointers to the hash tables outside mutex protection. This led to an inconsistency where a thread copied a pointer to a hash, another thread did the same, the first thread then deleted the hash, and the second then crashed when it in turn tried to delete the deleted hash. The fix is to ensure that operations on the shared hash structures happens under mutex protection (moving the locking up a little) --- sql/sql_acl.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sql/sql_acl.cc b/sql/sql_acl.cc index 3b81a85c368..b30c012e633 100644 --- a/sql/sql_acl.cc +++ b/sql/sql_acl.cc @@ -3765,11 +3765,11 @@ static my_bool grant_reload_procs_priv(THD *thd) DBUG_RETURN(TRUE); } + rw_wrlock(&LOCK_grant); /* Save a copy of the current hash if we need to undo the grant load */ old_proc_priv_hash= proc_priv_hash; old_func_priv_hash= func_priv_hash; - rw_wrlock(&LOCK_grant); if ((return_val= grant_load_procs_priv(table.table))) { /* Error; Reverting to old hash */