Potential race condition use-after-free in eviction server

XMLWordPrintableJSON

    • Storage Engines
    • 2024-08-06 - Withholding Tax
    • 5
    • v8.0, v7.3, v7.0, v6.0, v5.0

      In function __evict_walk the dhandle stored in cache->walk_tree is pinned by incrementing its use count dhandle->session_inuse. When the function exits, the use count is decremented but cache->walk_tree is not cleared and can be used later.

      In theory, that dhandle can be deleted by connection sweep server and cache->walk_tree will become invalid.

              Assignee:
              Yury Ershov
              Reporter:
              Yury Ershov
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: