Bug #88697 Group replication channel observers may use null pointers on uninstall
Submitted: 29 Nov 2017 12:12 Modified: 18 Dec 2017 17:00
Reporter: Pedro Gomes Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Server: Group Replication Severity:S3 (Non-critical)
Version:5.7.22 OS:Any
Assigned to: CPU Architecture:Any

[29 Nov 2017 12:12] Pedro Gomes
Description:
NOTE: This bug was found trough code analyzes under development.
As far as we know, this was never seen in production.

-----------------------------------------------

When the plugin is uninstalled look at the execution order on 

  int plugin_group_replication_deinit

See that the channel observation manager is deleted 

  if (channel_observation_manager != NULL)
  {
    delete channel_observation_manager;

And then the observer is unregistered 

  if (unregister_binlog_transmit_observer(&binlog_transmit_observer, p))
  {
    log_message(MY_ERROR_LEVEL,
                "Failure when unregistering the binlog state observers");

So, the problem is, that if hooks are being invoked from this observer, it can met a null pointer 
The code does offer basic protection with 

  if (channel_observation_manager == NULL)

but note that in concurrency scenarios this is not enough.  

How to repeat:
No information here, since this bug was seen trough code analyzes.

In theory one could devise a test where a slave event is triggered and it invokes the plugin hook 
The code should pass the 
  if (channel_observation_manager == NULL)
and block there

Now uninstall the plugin and unblock. In theory it should segfault.

Suggested fix:
Change the order:
Unregister first and then delete the observation manager

NOTE: this assumes that the unregister method guarantees that no observer is informed after it something that may no be true if the observer is already being called....
The developer should check this with servgen
[18 Dec 2017 17:00] David Moss
Posted by developer:
 
Thanks for noting this was not seen in production. Closing without change log entry.
[23 Apr 2018 13:42] Nuno Carvalho
Fixed on 5.7.22/8.0.11
[31 May 2018 14:50] David Moss
Reclosing.
[31 May 2018 14:50] David Moss
Reclosing.