Bug#28637947 - XPLUGIN CRASH FOR LARGE NUMBER OF SESSION OPEN/CLOSE OPERATIONS

Description
===========

Assigning, copying 'std::shared_ptr' by multiple threads is an undefined
behavior. X Plugin is resassigning Client::m_session field, after succesful
reset-session operation. In the same time other thread copyied m_session
to do THD verification. Both instances of shared_ptr were trying to free
same shared-ptr control block.

Fix
===

Access to m_session from other thread was wrapped in 'm_session_exit_mutex'
lock.

Change-Id: Ifefcfd71d4e2a47a9422e13c582491bdecf0fadb
RB: 20543
Reviewed-by: Grzegorz Szwarc <[email protected]>

Author: lkotula

plugin/x/ngs/include/ngs/client.h

@@ -127,7 +127,7 @@ class Client : public Client_interface {
 
   Protocol_monitor_interface *m_protocol_monitor;
 
-  xpl::Mutex m_session_exit_mutex;
+  mutable xpl::Mutex m_session_exit_mutex;
 
   enum {
     Not_closing,

plugin/x/ngs/src/client.cc

@@ -399,7 +399,10 @@ void Client::on_session_reset(Session_interface &s MY_ATTRIBUTE((unused))) {
       session.reset();
       m_state = Client_closing;
     } else {
-      m_session = session;
+      {
+        MUTEX_LOCK(lock_session_exit, get_session_exit_mutex());
+        m_session = session;
+      }
       m_encoder->send_ok();
     }
   }

plugin/x/src/xpl_client.cc

@@ -142,6 +142,7 @@ bool Client::is_handler_thd(THD *thd) {
   // shared_pointer to be sure that the session is
   // not reseted (by Mysqlx::Session::Reset) in middle
   // of this operations.
+  MUTEX_LOCK(lock_session_exit, m_session_exit_mutex);
   auto session = this->session_smart_ptr();
 
   return thd && session && (session->get_thd() == thd);