Bug 75290

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.1) Gecko/20020827

Description of problem:
Remote access to mysqld [mysql-server-3.23.49-3] crashes server.
Curiously, this only occurs with glibc-2.2.5-40, not with glibc-2.2.5-39. Cf.
bug 75128, where jakub claims that this is a mysql bug, not a glibc bug.

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1.On sever machine w/ mysql-server-3.23.49-3 & glibc-2.2.5-40, start mysql,
attach with mysql client as privileged user and:

mysql> use mysql
mysql> GRANT ALL PRIVILEGES ON test.* TO tester@<client-machine>;

2.On any client machine (not necessarily even running Linux):

%  mysql --host=<server-machine> --user tester

	

Actual Results:  On client machine:

% mysql --host=<server-machine> --user tester
ERROR 2013: Lost connection to MySQL server during query

In server machine's mysqld.log:

Number of processes running now: 1
mysqld process hanging, pid <NNNNN> - killed
021006 <HH:MM:SS>  mysqld restarted



Expected Results:  %  mysql --host=<server-machine> --user tester
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 2 to server version: 3.23.49

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql>

Additional info:

One mysqld thread dies, and safe_mysqld kills the others.

strace of thread which dies reveals:

select(5, [3 4], NULL, NULL, NULL)      = 1 (in [3])
fcntl64(3, F_SETFL, O_RDWR|O_NONBLOCK)  = 0
accept(3, {sin_family=AF_INET, sin_port=htons(33104),
sin_addr=inet_addr("10.10.10.16")}}, [16]) = 7
fcntl64(3, F_SETFL, O_RDWR)             = 0
getsockname(7, {sin_family=AF_INET, sin_port=htons(3306),
sin_addr=inet_addr("10.10.10.130")}}, [16]) = 0
fcntl64(7, F_GETFL)                     = 0x2 (flags O_RDWR)
fcntl64(7, F_SETFL, O_RDWR|O_NONBLOCK)  = 0
setsockopt(7, SOL_IP, IP_TOS, [8], 4)   = 0
setsockopt(7, SOL_TCP, TCP_NODELAY, [1], 4) = 0
time(NULL)                              = 1033940661
rt_sigprocmask(SIG_SETMASK, NULL, [HUP QUIT PIPE TERM TSTP RTMIN], 8) = 0
write(6, "\240P\4@\0\0\0\0\340\2279\10@\240\r\10\250\24>\10\5P\10"..., 148) = 148
rt_sigprocmask(SIG_SETMASK, NULL, [HUP QUIT PIPE TERM TSTP RTMIN], 8) = 0
rt_sigsuspend([HUP QUIT PIPE TERM TSTP] <unfinished ...>
--- SIGRTMIN (Real-time signal 0) ---
<... rt_sigsuspend resumed> )           = -1 EINTR (Interrupted system call)
sigreturn()                             = ? (mask now [HUP QUIT PIPE TERM TSTP
RTMIN])
select(5, [3 4], NULL, NULL, NULL)      = ? ERESTARTNOHAND (To be restarted)
--- SIGSEGV (Segmentation fault) ---

Something similar apparently happens with Red Hat 8.0, cf. bug 74943

!!! For my site, this is a security problem as it kills mysql logging inside my
firewall from the snort IDS sensor I have running outside my firewall. Please
fix this ASAP.