IC69015: TRYING TO DO A THREAD CLEANUP WHILE CURRENTLY PROCESSING A SPL CAN LEAD TO ACCESSING FREED MEMORY WHICH CAN ASSERT FAIL/CRASH TH

APAR status

• Closed as program error.

Error description

• Due to an ASF/network error while executing a SPL, the server
  calls destroy_session(), which calls sqscb_cleanup().  In
  sqscb_cleanup() we call releasesdb() for every statement the
  session has.  This leads to freeing up all statement heaps.
  However, later on in sqscb_cleanup() we call rmstproc() which
  calls drpcurlist() which tries to access sqtcb->procenv if it's
  not null.  But if we were currently trying to execute a SPL that
  pointer would not be null, so we now have a pointer that isn't
  null, but it is now pointing into memory that was previously
  freed in sqscb_cleanup().  This can lead to crashes that would
  have stacks that might look something like this:
  
  ( 1)  afstack
  ( 2)  afhandler
  ( 3)  affail_interface
  ( 4)  mt_ex_throw_sig
  ( 5)  afsig_handler
  ( 6)  _sigreturn
  ( 7)  drpcurlist
  ( 8)  rmstproc
  ( 9)  sqscb_cleanup
  (10)  destroy_session
  (11)   sqsetconerr
  (12)  asf_recv
  (13)  _iread
  (14)  _igetint
  (15)  sq_file_open8
  (16)  sq_file_open
  (17)  mi_lo_to_file8
  (18)  blob_to_file
  (19)  udrlm_clang_execute_internal
  (20)  udrlm_clang_execute
  (21)  udrlm_exec_routine
  (22)  udr_execute
  (23)  exroutine
  (24)  geval
  (25)  evalcols
  (26)  getrow
  (27)  fetchrow
  (28)  doselect
  (29)  exsubq
  (30)  ev_cb
  (31)  new_eval
  (32)  ip_evalexpr
  (33)  runproc
  (34)  udrlm_spl_execute
  (35)  udrlm_exec_routine
  (36)  udr_execute
  (37)  udr_spl_curnext
  (38)  ip_curnext
  (39)  ip_fetch
  (40)  getrow
  (41)  fetchrow
  (42)  exfetch
  (43)  sql_nfetch
  (44)  sq_nfetch
  (45)  sqmain
  (46)  listen_verify
  (47)  spawn_thread
  (48)  startup
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * Customers using blob_to_file(...,client) in stored procedure *
  * and client failing when server is waiting to receive         *
  * communication from client.                                   *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * Server can crash while communicating with client, while      *
  * executing blob_to_file(..., client) inside stored procedure. *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Upgrade to IDS-11.50.xC8 or above when available.            *
  ****************************************************************
  

Problem conclusion

• Problem first fixed in IDS-11.50.xC8.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM IDS ENTRP E

• Fixed component ID

  5724L2304

Applicable component levels

• RB15 PSN

     UP