MDEV-40298 Use-After-Free when SQL Thread stops in the middle of SHOW SLAVE STATUS

MDEV-36287 acknowledged that SHOW SLAVE STATUS needed to acquire a mutex
lock before accessing the SQL Thread’s THD, as otherwise it may access
invalid memory if a concurrent STOP SLAVE deletes the THD.
But it missed that the SQL Thread’s mutex is `mi->rli.run_lock`,
not `mi->run_lock`, so the bug was still not fixed.

This commit fills the oversight in by acquiring the correct
corresponding lock for each of `Slave_IO_State` & `Slave_SQL_State`.

Author: ParadoxV5

mysql-test/main/rli_run_lock.result

@@ -0,0 +1,18 @@
+CHANGE MASTER TO master_host='127.0.0.1', master_user='root';
+START SLAVE SQL_THREAD;
+include/wait_for_slave_sql_to_start.inc
+SET @save_dbug= @@GLOBAL.debug_dbug;
+SET @@GLOBAL.debug_dbug= '+d,hold_sss_with_run_lock';
+SHOW SLAVE STATUS;
+connect  stopper, 127.0.0.1, root, , , $SERVER_MYPORT_1;
+SET @@SESSION.debug_sync= 'now WAIT_FOR sss_got_run_lock';
+STOP SLAVE SQL_THREAD;
+connect  continuer, 127.0.0.1, root, , , $SERVER_MYPORT_1;
+SET @@SESSION.debug_sync= 'now SIGNAL sss_continue';
+connection stopper;
+disconnect continuer;
+connection default;
+disconnect stopper;
+SET @@GLOBAL.debug_dbug= @save_dbug;
+SET @@SESSION.debug_sync= RESET;
+include/wait_for_slave_sql_to_stop.inc

mysql-test/main/rli_run_lock.test

@@ -0,0 +1,38 @@
+--source include/have_debug.inc
+--source include/have_debug_sync.inc
+--source include/have_binlog_format_mixed.inc # No actual replication required
+CHANGE MASTER TO master_host='127.0.0.1', master_user='root'; # basic setup
+
+START SLAVE SQL_THREAD;
+--source include/wait_for_slave_sql_to_start.inc
+
+
+SET @save_dbug= @@GLOBAL.debug_dbug;
+SET @@GLOBAL.debug_dbug= '+d,hold_sss_with_run_lock';
+--send SHOW SLAVE STATUS
+
+--connect (stopper, 127.0.0.1, root, , , $SERVER_MYPORT_1)
+  SET @@SESSION.debug_sync= 'now WAIT_FOR sss_got_run_lock';
+  --send STOP SLAVE SQL_THREAD
+  # Wait a bit for the thread to "shut down"
+  # (It should not shut down, but block waiting for the ongoing SSS;
+  #  the bug instead pulls this carpet under the SSS's feet.)
+  --sleep 3
+
+  --connect (continuer, 127.0.0.1, root, , , $SERVER_MYPORT_1)
+    SET @@SESSION.debug_sync= 'now SIGNAL sss_continue';
+  --connection stopper
+  --disconnect continuer
+
+  --reap
+--connection default
+--disconnect stopper
+
+
+--disable_result_log
+  --reap
+--enable_result_log
+
+SET @@GLOBAL.debug_dbug= @save_dbug;
+SET @@SESSION.debug_sync= RESET;
+--source include/wait_for_slave_sql_to_stop.inc

sql/slave.cc

@@ -3301,10 +3301,16 @@ static bool send_show_master_info_data(THD *thd, Master_info *mi, bool full,
       protocol->store(mi->connection_name.str, mi->connection_name.length,
                       &my_charset_bin);
 
-    mysql_mutex_lock(&mi->run_lock);
+    mysql_mutex_lock(&mi->rli.run_lock);
     THD *sql_thd= mi->rli.sql_driver_thd;
+    DBUG_EXECUTE_IF("hold_sss_with_run_lock",
+      DBUG_ASSERT(!debug_sync_set_action(thd,
+        STRING_WITH_LEN("now SIGNAL sss_got_run_lock WAIT_FOR sss_continue")));
+    );
     const char *slave_sql_running_state=
       sql_thd ? sql_thd->get_proc_info() : "";
+    mysql_mutex_unlock(&mi->rli.run_lock);
+    mysql_mutex_lock(&mi->run_lock);
     THD *io_thd= mi->io_thd;
     const char *slave_io_running_state= io_thd ? io_thd->get_proc_info() : "";
     mysql_mutex_unlock(&mi->run_lock);