pingcap / pingcap/tidb

executor: sysSessionPool tx_isolation leak in executeAlterUser and executeSetPwd

Open
#67,975 0 comments 0 reactions 0 assignees View on GitHub
contribution
Dominant language
Go
Stars
40.5k
Forks
6.2k
PR merge metrics
PR metrics pending

Description

## Bug Report

### Description

`executeAlterUser` and `executeSetPwd` in `pkg/executor/simple.go` pollute the `sysSessionPool` by setting `tx_isolation = 'READ-COMMITTED'` on a system session without restoring it before returning the session to the pool.

### Code Locations

1. `executeAlterUser` — gets sysSession via `GetSysSession()`, then:
```go
_, err = sqlExecutor.ExecuteInternal(ctx, "set tx_isolation = 'READ-COMMITTED'")
```

2. `executeSetPwd` — same pattern:
```go
_, err = sqlExecutor.ExecuteInternal(ctx, "set tx_isolation = 'READ-COMMITTED'")
```

Both call `ReleaseSysSession` which only does `rollback` + `Put` back to pool — it does **not** restore `tx_isolation` to the default `REPEATABLE-READ`.

### Impact

After any `ALTER USER` or `SET PASSWORD` execution, a system session in the pool permanently has `tx_isolation = READ-COMMITTED` instead of the default `REPEATABLE-READ`. Subsequent internal operations that reuse this session may read uncommitted data if they rely on RR snapshot consistency within a transaction.

### Expected Behavior

The `tx_isolation` should be restored to its original value before the session is returned to the pool, or `ReleaseSysSession` should reset session variables that were modified.

### Minimal Example

```sql
-- Any ALTER USER or SET PASSWORD triggers the leak
ALTER USER 'root'@'%' IDENTIFIED BY 'newpass';
-- Now a sysSessionPool session has tx_isolation = 'READ-COMMITTED' permanently
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.