[MDEV-16042] Server crash or ASAN use-after-poison in Query_arena::free_items after executing a failing PS which reads from versioned table - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Critical
Resolution: Duplicate
Affects Version/s: 10.3(EOL)
Fix Version/s: 10.3.7
Component/s: Prepared Statements, Versioned Tables
Labels:
None

Description

Note: I don't know why versioning is important here, but I couldn't get rid of it, neither by adding invisible columns nor virtual columns nor both, while with system versioning it happens regardless it's timestamp- or trx-based, explicit or implicit, InnoDB or MyISAM.

CREATE TABLE t1 (a INT) WITH SYSTEM VERSIONING;

PREPARE stmt FROM "CREATE TABLE tmp AS SELECT * FROM t1 WHERE EXP(20010609211642053929)";

--error ER_DATA_OUT_OF_RANGE

EXECUTE stmt;

# Cleanup

--connection default

DROP TABLE t1;

10.3 ASAN 99fa7c6c2f9c
=================================================================
==4078==ERROR: AddressSanitizer: use-after-poison on address 0x62b00002d010 at pc 0x555f6fb7e20c bp 0x7f670453f980 sp 0x7f670453f978
READ of size 8 at 0x62b00002d010 thread T5
#0 0x555f6fb7e20b in Query_arena::free_items() /data/src/10.3/sql/sql_class.cc:3782
#1 0x555f6fcb6c1f in Prepared_statement::~Prepared_statement() /data/src/10.3/sql/sql_prepare.cc:3803
#2 0x555f6fcb709f in Prepared_statement::~Prepared_statement() /data/src/10.3/sql/sql_prepare.cc:3812
#3 0x555f6fb7f8b4 in delete_statement_as_hash_key /data/src/10.3/sql/sql_class.cc:3926
#4 0x555f713eac1f in my_hash_free_elements /data/src/10.3/mysys/hash.c:129
#5 0x555f713eaef9 in my_hash_reset /data/src/10.3/mysys/hash.c:171
#6 0x555f6fb801b5 in Statement_map::reset() /data/src/10.3/sql/sql_class.cc:4058
#7 0x555f6fb6c272 in THD::free_connection() /data/src/10.3/sql/sql_class.cc:1656
#8 0x555f6f9cb036 in unlink_thd(THD*) /data/src/10.3/sql/mysqld.cc:2945
#9 0x555f6f9cb98c in one_thread_per_connection_end(THD*, bool) /data/src/10.3/sql/mysqld.cc:3086
#10 0x555f6ffb532e in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1421
#11 0x555f6ffb4b21 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
#12 0x555f70abb749 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
#13 0x7f6710b03493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
#14 0x7f670eee993e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x62b00002d010 is located 11792 bytes inside of 24716-byte region [0x62b00002a200,0x62b00003028c)
allocated by thread T5 here:
#0 0x7f6710d6d73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x555f7147c862 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
#2 0x555f7144b56a in my_malloc /data/src/10.3/mysys/my_malloc.c:101
#3 0x555f71429d5b in init_alloc_root /data/src/10.3/mysys/my_alloc.c:81
#4 0x555f6ff2ba59 in init_sql_alloc(st_mem_root, char const, unsigned int, unsigned int, unsigned long) /data/src/10.3/sql/thr_malloc.cc:65
#5 0x555f6fcb6417 in Prepared_statement::Prepared_statement(THD*) /data/src/10.3/sql/sql_prepare.cc:3732
#6 0x555f6fcb141a in mysql_sql_stmt_prepare(THD*) /data/src/10.3/sql/sql_prepare.cc:2777
#7 0x555f6fc5a61b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3779
#8 0x555f6fc74702 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8001
#9 0x555f6fc4efa8 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1846
#10 0x555f6fc4c03f in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1391
#11 0x555f6ffb510c in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
#12 0x555f6ffb4b21 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
#13 0x555f70abb749 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
#14 0x7f6710b03493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

Thread T5 created by T0 here:
#0 0x7f6710d3cbba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
#1 0x555f70abbd11 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
#2 0x555f6f9c0c8e in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
#3 0x555f6f9d69b3 in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6554
#4 0x555f6f9d70b8 in create_new_thread /data/src/10.3/sql/mysqld.cc:6624
#5 0x555f6f9d80c9 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6899
#6 0x555f6f9d5e70 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6176
#7 0x555f6f9bf02f in main /data/src/10.3/sql/main.cc:25
#8 0x7f670ee212b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: use-after-poison /data/src/10.3/sql/sql_class.cc:3782 Query_arena::free_items()
Shadow bytes around the buggy address:
0x0c567fffd9b0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffd9c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffd9d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffd9e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffd9f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
=>0x0c567fffda00: f7 f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffda10: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffda20: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffda30: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffda40: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffda50: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==4078==ABORTING

10.3 debug 99fa7c6c2f9 via client (not MTR)
#3 <signal handler called>
#4 0x0000563bec8e777b in Item::delete_self (this=0x7fd67c0274b0) at /data/src/10.3/sql/item.h:1873
#5 0x0000563bec8dd9e5 in Query_arena::free_items (this=0x7fd67c0221b8) at /data/src/10.3/sql/sql_class.cc:3785
#6 0x0000563bec962821 in Prepared_statement::~Prepared_statement (this=0x7fd67c0221a0, __in_chrg=<optimized out>) at /data/src/10.3/sql/sql_prepare.cc:3803
#7 0x0000563bec9629b0 in Prepared_statement::~Prepared_statement (this=0x7fd67c0221a0, __in_chrg=<optimized out>) at /data/src/10.3/sql/sql_prepare.cc:3812
#8 0x0000563bec8de13b in delete_statement_as_hash_key (key=0x7fd67c0221a0) at /data/src/10.3/sql/sql_class.cc:3926
#9 0x0000563bed3a21ab in my_hash_free_elements (hash=0x7fd67c002788) at /data/src/10.3/mysys/hash.c:129
#10 0x0000563bed3a22c5 in my_hash_reset (hash=0x7fd67c002788) at /data/src/10.3/mysys/hash.c:171
#11 0x0000563bec8de5b6 in Statement_map::reset (this=0x7fd67c002788) at /data/src/10.3/sql/sql_class.cc:4058
#12 0x0000563bec8d698a in THD::free_connection (this=0x7fd67c000b00) at /data/src/10.3/sql/sql_class.cc:1656
#13 0x0000563bec819adc in unlink_thd (thd=0x7fd67c000b00) at /data/src/10.3/sql/mysqld.cc:2945
#14 0x0000563bec819fa5 in one_thread_per_connection_end (thd=0x7fd67c000b00, put_in_cache=true) at /data/src/10.3/sql/mysqld.cc:3086
#15 0x0000563beca96976 in do_handle_one_connection (connect=0x563befe5bfa0) at /data/src/10.3/sql/sql_connect.cc:1421
#16 0x0000563beca9661a in handle_one_connection (arg=0x563befe5bfa0) at /data/src/10.3/sql/sql_connect.cc:1308
#17 0x00007fd6e3632494 in start_thread (arg=0x7fd6cc182700) at pthread_create.c:333
#18 0x00007fd6e1a1893f in clone () from /lib/x86_64-linux-gnu/libc.so.6

Attachments

- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List
- Download All

mdev16042_asan_LEX.test
2018-04-27 10:35
2 kB
Elena Stepanova
mdev16042_fix_prepare_information.test
2018-04-27 10:38
3 kB
Elena Stepanova

Issue Links

duplicates

MDEV-16043 Assertion `thd->Item_change_list::is_empty()' failed in mysql_parse upon SELECT from a view reading from a versioned table

Closed

relates to

MDEV-16043 Assertion `thd->Item_change_list::is_empty()' failed in mysql_parse upon SELECT from a view reading from a versioned table

Closed

Activity

Ascending order - Click to sort in descending order

Elena Stepanova added a comment - 2018-04-27 10:39

See also ~~MDEV-16043~~, and below are some other representations of apparently the same problem. Dirty test cases are attached, they can't be put in the MTR suite, but need to be checked after the bugfix.

test case: mdev16042_asan_LEX.test

10.3 ASAN 99fa7c6c2f9c8
==8796==ERROR: AddressSanitizer: use-after-poison on address 0x62b000024f00 at pc 0x560d7abd6aa7 bp 0x7f5f50e60860 sp 0x7f5f50e60858
READ of size 8 at 0x62b000024f00 thread T6
#0 0x560d7abd6aa6 in Mem_root_array<st_order*, true>::size() const /data/src/10.3/sql/mem_root_array.h:228
#1 0x560d7abd698b in Mem_root_array<st_order*, true>::empty() const /data/src/10.3/sql/mem_root_array.h:227
#2 0x560d7abd5f7b in Mem_root_array<st_order*, true>::clear() (/data/bld/10.3-asan/bin/mysqld+0xe1af7b)
#3 0x560d7ab9bf0b in LEX::start(THD*) /data/src/10.3/sql/sql_lex.cc:713
#4 0x560d7ab9b394 in lex_start(THD*) /data/src/10.3/sql/sql_lex.cc:658
#5 0x560d7ac17169 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7941
#6 0x560d7abf1fa8 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1846
#7 0x560d7abef03f in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1391
#8 0x560d7af5810c in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
#9 0x560d7af57b21 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
#10 0x560d7ba5e749 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
#11 0x7f5f5d936493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
#12 0x7f5f5bd1c93e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

0x62b000024f00 is located 7424 bytes inside of 24716-byte region [0x62b000023200,0x62b00002928c)
allocated by thread T6 here:
#0 0x7f5f5dba073f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
#1 0x560d7c41f862 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
#2 0x560d7c3ee56a in my_malloc /data/src/10.3/mysys/my_malloc.c:101
#3 0x560d7c3ccd5b in init_alloc_root /data/src/10.3/mysys/my_alloc.c:81
#4 0x560d7aecea59 in init_sql_alloc(st_mem_root, char const, unsigned int, unsigned int, unsigned long) /data/src/10.3/sql/thr_malloc.cc:65
#5 0x560d7ac59417 in Prepared_statement::Prepared_statement(THD*) /data/src/10.3/sql/sql_prepare.cc:3732
#6 0x560d7ac5441a in mysql_sql_stmt_prepare(THD*) /data/src/10.3/sql/sql_prepare.cc:2777
#7 0x560d7abfd61b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3779
#8 0x560d7ac17702 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8001
#9 0x560d7abf1fa8 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1846
#10 0x560d7abef03f in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1391
#11 0x560d7af5810c in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
#12 0x560d7af57b21 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
#13 0x560d7ba5e749 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
#14 0x7f5f5d936493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)

Thread T6 created by T0 here:
#0 0x7f5f5db6fbba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
#1 0x560d7ba5ed11 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
#2 0x560d7a963c8e in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
#3 0x560d7a9799b3 in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6554
#4 0x560d7a97a0b8 in create_new_thread /data/src/10.3/sql/mysqld.cc:6624
#5 0x560d7a97b0c9 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6899
#6 0x560d7a978e70 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6176
#7 0x560d7a96202f in main /data/src/10.3/sql/main.cc:25
#8 0x7f5f5bc542b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: use-after-poison /data/src/10.3/sql/mem_root_array.h:228 Mem_root_array<st_order*, true>::size() const
Shadow bytes around the buggy address:
0x0c567fffc990: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffc9a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffc9b0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffc9c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffc9d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
=>0x0c567fffc9e0:[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffc9f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffca00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffca10: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffca20: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0c567fffca30: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==8796==ABORTING
180427 13:32:46 [ERROR] mysqld got signal 6 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.

To report this bug, see https://mariadb.com/kb/en/reporting-bugs

We will try our best to scrape up some info that will hopefully help
diagnose the problem, but since we have already crashed,
something is definitely wrong and this may fail.

Server version: 10.3.7-MariaDB-debug-log
key_buffer_size=1048576
read_buffer_size=131072
max_used_connections=2
max_threads=153
thread_count=3
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63272 K bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

Thread pointer: 0x62a000060270
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = 0x7f5f50e61df0 thread_stack 0x49000
/usr/lib/x86_64-linux-gnu/libasan.so.1(backtrace+0x3a)[0x7f5f5db7748a]
mysys/stacktrace.c:269(my_print_stacktrace)[0x560d7c3ff004]
sql/signal_handler.cc:168(handle_fatal_signal)[0x560d7b2dece9]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x110c0)[0x7f5f5d9400c0]
linux/raise.c:51(__GI_raise)[0x7f5f5bc66fcf]
stdlib/abort.c:91(__GI_abort)[0x7f5f5bc683fa]
/usr/lib/x86_64-linux-gnu/libasan.so.1(+0x61f29)[0x7f5f5dbadf29]
/usr/lib/x86_64-linux-gnu/libasan.so.1(+0x59ca5)[0x7f5f5dba5ca5]
/usr/lib/x86_64-linux-gnu/libasan.so.1(+0x5daa2)[0x7f5f5dba9aa2]
/usr/lib/x86_64-linux-gnu/libasan.so.1(__asan_report_error+0x3d9)[0x7f5f5dba5139]
/usr/lib/x86_64-linux-gnu/libasan.so.1(__asan_report_load8+0x24)[0x7f5f5dba6014]
sql/mem_root_array.h:228(Mem_root_array<st_order*, true>::size() const)[0x560d7abd6aa7]
sql/mem_root_array.h:227(Mem_root_array<st_order*, true>::empty() const)[0x560d7abd698c]
sql/mem_root_array.h:97(Mem_root_array<st_order*, true>::clear())[0x560d7abd5f7c]
sql/sql_lex.cc:714(LEX::start(THD*))[0x560d7ab9bf0c]
sql/sql_lex.cc:659(lex_start(THD*))[0x560d7ab9b395]
sql/sql_parse.cc:7942(mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool))[0x560d7ac1716a]
sql/sql_parse.cc:1848(dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool))[0x560d7abf1fa9]
sql/sql_parse.cc:1391(do_command(THD*))[0x560d7abef040]
sql/sql_connect.cc:1402(do_handle_one_connection(CONNECT*))[0x560d7af5810d]
sql/sql_connect.cc:1309(handle_one_connection)[0x560d7af57b22]
perfschema/pfs.cc:1864(pfs_spawn_thread)[0x560d7ba5e74a]
nptl/pthread_create.c:333(start_thread)[0x7f5f5d936494]
x86_64/clone.S:99(clone)[0x7f5f5bd1c93f]

Trying to get some variables.
Some pointers may be invalid and cause the dump to abort.
Query (0x62b000023288): SHOW WARNINGS
Connection ID (thread ID): 5
Status: NOT_KILLED

Test case: mdev16042_fix_prepare_information.test

10.3 99fa7c6c2f9
#3 <signal handler called>
#4 0x000055ce6cb6d87f in Mem_root_array<st_order*, true>::push_back (this=0x7fb694045b40, element=@0x7fb6a42bdc60: 0x7fb694044830) at /data/src/10.3/sql/mem_root_array.h:169
#5 0x000055ce6cb5aac4 in st_select_lex::fix_prepare_information (this=0x7fb6940050d0, thd=0x7fb694000b00, conds=0x7fb69405d860, having_conds=0x7fb69405d608) at /data/src/10.3/sql/sql_lex.cc:3811
#6 0x000055ce6cbc1f21 in JOIN::prepare (this=0x7fb69405d458, tables_init=0x7fb694043560, wild_num=0, conds_init=0x7fb694044190, og_num=3, order_init=0x7fb694044bb0, skip_order_by=false, group_init=0x7fb694044830, having_init=0x7fb694044888, proc_param_init=0x0, select_lex_arg=0x7fb6940050d0, unit_arg=0x7fb694004958) at /data/src/10.3/sql/sql_select.cc:1184
#7 0x000055ce6cbcc589 in mysql_select (thd=0x7fb694000b00, tables=0x7fb694043560, wild_num=0, fields=..., conds=0x7fb694044190, og_num=3, order=0x7fb694044bb0, group=0x7fb694044830, having=0x7fb694044888, proc_param=0x0, select_options=551903562500, result=0x7fb694047db0, unit=0x7fb694004958, select_lex=0x7fb6940050d0) at /data/src/10.3/sql/sql_select.cc:4132
#8 0x000055ce6cc04a42 in mysql_explain_union (thd=0x7fb694000b00, unit=0x7fb694004958, result=0x7fb694047db0) at /data/src/10.3/sql/sql_select.cc:25640
#9 0x000055ce6cb8991f in execute_sqlcom_select (thd=0x7fb694000b00, all_tables=0x7fb694043560) at /data/src/10.3/sql/sql_parse.cc:6478
#10 0x000055ce6cb80456 in mysql_execute_command (thd=0x7fb694000b00) at /data/src/10.3/sql/sql_parse.cc:3768
#11 0x000055ce6cb8d706 in mysql_parse (thd=0x7fb694000b00, rawbuf=0x7fb694042878 "EXPLAIN EXTENDED SELECT DAYOFYEAR( ( BINARY ( EXTRACT( SECOND_MICROSECOND FROM ( `col_int_key` & `col_date_key` ) ) ) ) ) AS field1 FROM `view_D` WHERE NULL < ( ExtractValue( '16:03:08.022288', '/cdc/"..., length=629, parser_state=0x7fb6a42bf5d0, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:8001
#12 0x000055ce6cb7aee9 in dispatch_command (command=COM_QUERY, thd=0x7fb694000b00, packet=0x7fb69408fa01 "", packet_length=629, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1846
#13 0x000055ce6cb79928 in do_command (thd=0x7fb694000b00) at /data/src/10.3/sql/sql_parse.cc:1391
#14 0x000055ce6ccdc88d in do_handle_one_connection (connect=0x55ce6f9b3230) at /data/src/10.3/sql/sql_connect.cc:1402
#15 0x000055ce6ccdc61a in handle_one_connection (arg=0x55ce6f9b3230) at /data/src/10.3/sql/sql_connect.cc:1308
#16 0x000055ce6d160f27 in pfs_spawn_thread (arg=0x55ce6fa756a0) at /data/src/10.3/storage/perfschema/pfs.cc:1862
#17 0x00007fb6abdef494 in start_thread (arg=0x7fb6a42c0700) at pthread_create.c:333
#18 0x00007fb6aa1d593f in clone () from /lib/x86_64-linux-gnu/libc.so.6

Elena Stepanova added a comment - 2018-04-27 10:39 See also MDEV-16043 , and below are some other representations of apparently the same problem. Dirty test cases are attached, they can't be put in the MTR suite, but need to be checked after the bugfix. test case: mdev16042_asan_LEX.test 10.3 ASAN 99fa7c6c2f9c8 ==8796==ERROR: AddressSanitizer: use-after-poison on address 0x62b000024f00 at pc 0x560d7abd6aa7 bp 0x7f5f50e60860 sp 0x7f5f50e60858 READ of size 8 at 0x62b000024f00 thread T6 #0 0x560d7abd6aa6 in Mem_root_array<st_order*, true>::size() const /data/src/10.3/sql/mem_root_array.h:228 #1 0x560d7abd698b in Mem_root_array<st_order*, true>::empty() const /data/src/10.3/sql/mem_root_array.h:227 #2 0x560d7abd5f7b in Mem_root_array<st_order*, true>::clear() (/data/bld/10.3-asan/bin/mysqld+0xe1af7b) #3 0x560d7ab9bf0b in LEX::start(THD*) /data/src/10.3/sql/sql_lex.cc:713 #4 0x560d7ab9b394 in lex_start(THD*) /data/src/10.3/sql/sql_lex.cc:658 #5 0x560d7ac17169 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7941 #6 0x560d7abf1fa8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1846 #7 0x560d7abef03f in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1391 #8 0x560d7af5810c in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402 #9 0x560d7af57b21 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308 #10 0x560d7ba5e749 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862 #11 0x7f5f5d936493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493) #12 0x7f5f5bd1c93e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e) 0x62b000024f00 is located 7424 bytes inside of 24716-byte region [0x62b000023200,0x62b00002928c) allocated by thread T6 here: #0 0x7f5f5dba073f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f) #1 0x560d7c41f862 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118 #2 0x560d7c3ee56a in my_malloc /data/src/10.3/mysys/my_malloc.c:101 #3 0x560d7c3ccd5b in init_alloc_root /data/src/10.3/mysys/my_alloc.c:81 #4 0x560d7aecea59 in init_sql_alloc(st_mem_root*, char const*, unsigned int, unsigned int, unsigned long) /data/src/10.3/sql/thr_malloc.cc:65 #5 0x560d7ac59417 in Prepared_statement::Prepared_statement(THD*) /data/src/10.3/sql/sql_prepare.cc:3732 #6 0x560d7ac5441a in mysql_sql_stmt_prepare(THD*) /data/src/10.3/sql/sql_prepare.cc:2777 #7 0x560d7abfd61b in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3779 #8 0x560d7ac17702 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8001 #9 0x560d7abf1fa8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1846 #10 0x560d7abef03f in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1391 #11 0x560d7af5810c in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402 #12 0x560d7af57b21 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308 #13 0x560d7ba5e749 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862 #14 0x7f5f5d936493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493) Thread T6 created by T0 here: #0 0x7f5f5db6fbba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba) #1 0x560d7ba5ed11 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912 #2 0x560d7a963c8e in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268 #3 0x560d7a9799b3 in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6554 #4 0x560d7a97a0b8 in create_new_thread /data/src/10.3/sql/mysqld.cc:6624 #5 0x560d7a97b0c9 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6899 #6 0x560d7a978e70 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6176 #7 0x560d7a96202f in main /data/src/10.3/sql/main.cc:25 #8 0x7f5f5bc542b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0) SUMMARY: AddressSanitizer: use-after-poison /data/src/10.3/sql/mem_root_array.h:228 Mem_root_array<st_order*, true>::size() const Shadow bytes around the buggy address: 0x0c567fffc990: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c567fffc9a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c567fffc9b0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c567fffc9c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c567fffc9d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 =>0x0c567fffc9e0:[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c567fffc9f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c567fffca00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c567fffca10: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c567fffca20: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 0x0c567fffca30: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe ==8796==ABORTING 180427 13:32:46 [ERROR] mysqld got signal 6 ; This could be because you hit a bug. It is also possible that this binary or one of the libraries it was linked against is corrupt, improperly built, or misconfigured. This error can also be caused by malfunctioning hardware. To report this bug, see https://mariadb.com/kb/en/reporting-bugs We will try our best to scrape up some info that will hopefully help diagnose the problem, but since we have already crashed, something is definitely wrong and this may fail. Server version: 10.3.7-MariaDB-debug-log key_buffer_size=1048576 read_buffer_size=131072 max_used_connections=2 max_threads=153 thread_count=3 It is possible that mysqld could use up to key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63272 K bytes of memory Hope that's ok; if not, decrease some variables in the equation. Thread pointer: 0x62a000060270 Attempting backtrace. You can use the following information to find out where mysqld died. If you see no messages after this, something went terribly wrong... stack_bottom = 0x7f5f50e61df0 thread_stack 0x49000 /usr/lib/x86_64-linux-gnu/libasan.so.1(backtrace+0x3a)[0x7f5f5db7748a] mysys/stacktrace.c:269(my_print_stacktrace)[0x560d7c3ff004] sql/signal_handler.cc:168(handle_fatal_signal)[0x560d7b2dece9] /lib/x86_64-linux-gnu/libpthread.so.0(+0x110c0)[0x7f5f5d9400c0] linux/raise.c:51(__GI_raise)[0x7f5f5bc66fcf] stdlib/abort.c:91(__GI_abort)[0x7f5f5bc683fa] /usr/lib/x86_64-linux-gnu/libasan.so.1(+0x61f29)[0x7f5f5dbadf29] /usr/lib/x86_64-linux-gnu/libasan.so.1(+0x59ca5)[0x7f5f5dba5ca5] /usr/lib/x86_64-linux-gnu/libasan.so.1(+0x5daa2)[0x7f5f5dba9aa2] /usr/lib/x86_64-linux-gnu/libasan.so.1(__asan_report_error+0x3d9)[0x7f5f5dba5139] /usr/lib/x86_64-linux-gnu/libasan.so.1(__asan_report_load8+0x24)[0x7f5f5dba6014] sql/mem_root_array.h:228(Mem_root_array<st_order*, true>::size() const)[0x560d7abd6aa7] sql/mem_root_array.h:227(Mem_root_array<st_order*, true>::empty() const)[0x560d7abd698c] sql/mem_root_array.h:97(Mem_root_array<st_order*, true>::clear())[0x560d7abd5f7c] sql/sql_lex.cc:714(LEX::start(THD*))[0x560d7ab9bf0c] sql/sql_lex.cc:659(lex_start(THD*))[0x560d7ab9b395] sql/sql_parse.cc:7942(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x560d7ac1716a] sql/sql_parse.cc:1848(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x560d7abf1fa9] sql/sql_parse.cc:1391(do_command(THD*))[0x560d7abef040] sql/sql_connect.cc:1402(do_handle_one_connection(CONNECT*))[0x560d7af5810d] sql/sql_connect.cc:1309(handle_one_connection)[0x560d7af57b22] perfschema/pfs.cc:1864(pfs_spawn_thread)[0x560d7ba5e74a] nptl/pthread_create.c:333(start_thread)[0x7f5f5d936494] x86_64/clone.S:99(clone)[0x7f5f5bd1c93f] Trying to get some variables. Some pointers may be invalid and cause the dump to abort. Query (0x62b000023288): SHOW WARNINGS Connection ID (thread ID): 5 Status: NOT_KILLED Test case: mdev16042_fix_prepare_information.test 10.3 99fa7c6c2f9 #3 <signal handler called> #4 0x000055ce6cb6d87f in Mem_root_array<st_order*, true>::push_back (this=0x7fb694045b40, element=@0x7fb6a42bdc60: 0x7fb694044830) at /data/src/10.3/sql/mem_root_array.h:169 #5 0x000055ce6cb5aac4 in st_select_lex::fix_prepare_information (this=0x7fb6940050d0, thd=0x7fb694000b00, conds=0x7fb69405d860, having_conds=0x7fb69405d608) at /data/src/10.3/sql/sql_lex.cc:3811 #6 0x000055ce6cbc1f21 in JOIN::prepare (this=0x7fb69405d458, tables_init=0x7fb694043560, wild_num=0, conds_init=0x7fb694044190, og_num=3, order_init=0x7fb694044bb0, skip_order_by=false, group_init=0x7fb694044830, having_init=0x7fb694044888, proc_param_init=0x0, select_lex_arg=0x7fb6940050d0, unit_arg=0x7fb694004958) at /data/src/10.3/sql/sql_select.cc:1184 #7 0x000055ce6cbcc589 in mysql_select (thd=0x7fb694000b00, tables=0x7fb694043560, wild_num=0, fields=..., conds=0x7fb694044190, og_num=3, order=0x7fb694044bb0, group=0x7fb694044830, having=0x7fb694044888, proc_param=0x0, select_options=551903562500, result=0x7fb694047db0, unit=0x7fb694004958, select_lex=0x7fb6940050d0) at /data/src/10.3/sql/sql_select.cc:4132 #8 0x000055ce6cc04a42 in mysql_explain_union (thd=0x7fb694000b00, unit=0x7fb694004958, result=0x7fb694047db0) at /data/src/10.3/sql/sql_select.cc:25640 #9 0x000055ce6cb8991f in execute_sqlcom_select (thd=0x7fb694000b00, all_tables=0x7fb694043560) at /data/src/10.3/sql/sql_parse.cc:6478 #10 0x000055ce6cb80456 in mysql_execute_command (thd=0x7fb694000b00) at /data/src/10.3/sql/sql_parse.cc:3768 #11 0x000055ce6cb8d706 in mysql_parse (thd=0x7fb694000b00, rawbuf=0x7fb694042878 "EXPLAIN EXTENDED SELECT DAYOFYEAR( ( BINARY ( EXTRACT( SECOND_MICROSECOND FROM ( `col_int_key` & `col_date_key` ) ) ) ) ) AS field1 FROM `view_D` WHERE NULL < ( ExtractValue( '16:03:08.022288', '/cdc/"..., length=629, parser_state=0x7fb6a42bf5d0, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:8001 #12 0x000055ce6cb7aee9 in dispatch_command (command=COM_QUERY, thd=0x7fb694000b00, packet=0x7fb69408fa01 "", packet_length=629, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1846 #13 0x000055ce6cb79928 in do_command (thd=0x7fb694000b00) at /data/src/10.3/sql/sql_parse.cc:1391 #14 0x000055ce6ccdc88d in do_handle_one_connection (connect=0x55ce6f9b3230) at /data/src/10.3/sql/sql_connect.cc:1402 #15 0x000055ce6ccdc61a in handle_one_connection (arg=0x55ce6f9b3230) at /data/src/10.3/sql/sql_connect.cc:1308 #16 0x000055ce6d160f27 in pfs_spawn_thread (arg=0x55ce6fa756a0) at /data/src/10.3/storage/perfschema/pfs.cc:1862 #17 0x00007fb6abdef494 in start_thread (arg=0x7fb6a42c0700) at pthread_create.c:333 #18 0x00007fb6aa1d593f in clone () from /lib/x86_64-linux-gnu/libc.so.6

Aleksey Midenkov added a comment - 2018-05-04 16:15

The crash is caused by commit 9477a2a9ba17c0db362e2bb39d5048e369096f39 (return without restore_active_arena()). See details.

Aleksey Midenkov added a comment - 2018-05-04 16:15 The crash is caused by commit 9477a2a9ba17c0db362e2bb39d5048e369096f39 (return without restore_active_arena() ). See details .

MariaDB Server

Server crash or ASAN use-after-poison in Query_arena::free_items after executing a failing PS which reads from versioned table

Details

Description

Attachments

Attachments

Issue Links

Activity

People

Dates

Git Integration