Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-16123

ASAN heap-use-after-free handler::ha_index_or_rnd_end

Details

    Description

      Source 10.3 commit 005d53f6d59fe8e1e118c63b9af57fea2a31f4f2.
      The build with ASAN claims to be a 10.3.6-MariaDB-debug-log.
      RQG test (sorry the call was generated by a tool and looks ugly)

      runall-new.pl --grammar=conf/mariadb/oltp-transactional.yy --gendata=conf/mariadb/oltp.zz --no-mask --queries=10M --duration=350 --threads=2 --threads=4 --threads=8 --threads=16 --threads=32 --seed=1 --seed=3 --seed=6 --seed=12 --seed=24 --views --validators=none --redefine=conf/mariadb/general-workarounds.yy --redefine=conf/mariadb/alter_table.yy --redefine=conf/mariadb/bulk_insert.yy --redefine=conf/mariadb/xa.yy --redefine=conf/mariadb/versioning.yy --redefine=conf/mariadb/sequences.yy --mysqld=--log_output=FILE --mysqld=--log-bin --mysqld=--log_bin_trust_function_creators=1 --mysqld=--loose-max-statement-time=30 --mysqld=--loose-debug_assert_on_not_freed_memory=0 --reporters=Backtrace,ErrorLog,Deadlock --engine=InnoDB --mysqld=--innodb-buffer-pool-size=256M --mysqld=--innodb_use_native_aio=0 --mtr-build-thread=318 ....
      

      =306592==ERROR: AddressSanitizer: heap-use-after-free on address 0x61c00011aa38 at pc 0x560b2282e75f bp 0x7fb7e83ad4a0 sp 0x7fb7e83ad490
      READ of size 4 at 0x61c00011aa38 thread T42
          #0 0x560b2282e75e in handler::ha_index_or_rnd_end() /work_m/MariaDB/sql/handler.h:3082
          #1 0x560b22a95c54 in Stat_table_write_iter::cleanup() (/mnt/r0/mleich/MariaDB/bld_asan/sql/mysqld+0x11a5c54)
          #2 0x560b22a95c8f in Stat_table_write_iter::~Stat_table_write_iter() (/mnt/r0/mleich/MariaDB/bld_asan/sql/mysqld+0x11a5c8f)
          #3 0x560b22a8bd3d in rename_table_in_stat_tables(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*) /work_m/MariaDB/sql/sql_statistics.cc:3543
          #4 0x560b22928954 in do_rename /work_m/MariaDB/sql/sql_rename.cc:300
          #5 0x560b22928fee in rename_tables /work_m/MariaDB/sql/sql_rename.cc:388
          #6 0x560b22927d68 in mysql_rename_tables(THD*, TABLE_LIST*, bool) /work_m/MariaDB/sql/sql_rename.cc:155
          #7 0x560b228c3e96 in mysql_execute_command(THD*) /work_m/MariaDB/sql/sql_parse.cc:4448
          #8 0x560b228dac41 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /work_m/MariaDB/sql/sql_parse.cc:8013
          #9 0x560b228b59a5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /work_m/MariaDB/sql/sql_parse.cc:1842
          #10 0x560b228b2a0a in do_command(THD*) /work_m/MariaDB/sql/sql_parse.cc:1386
          #11 0x560b22c0d73f in do_handle_one_connection(CONNECT*) /work_m/MariaDB/sql/sql_connect.cc:1402
          #12 0x560b22c0d124 in handle_one_connection /work_m/MariaDB/sql/sql_connect.cc:1308
          #13 0x7fb81efba6d9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76d9)
          #14 0x7fb81e44cd7e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x108d7e)
      

      Please change the priority if requited.

      Attachments

        Activity

          Regarding the replay test based on RQG.
          The environment used by me gets created by:
          git clone https://github.com/mleich1/rqg RQG_mleich1 # IMHO it is quite unlikely that my version of RQG
          cd RQG_mleich1 # (fork of Elena's RQG) has an impact on the test
          git checkout experimental

          1. IMHO it is quite unlikely that my version of RQG (fork of Elena's RQG) has an impact on the test outcome.
          2. In case Elena's RQG is used than please pick also the branch 'experimental'.
            Compile MariaDB with "-DWITH_ASAN:BOOL=ON".
            export ASAN_OPTIONS=abort_on_error=1 # Abort but no core file
            ... start the test ...
          mleich Matthias Leich added a comment - Regarding the replay test based on RQG. The environment used by me gets created by: git clone https://github.com/mleich1/rqg RQG_mleich1 # IMHO it is quite unlikely that my version of RQG cd RQG_mleich1 # (fork of Elena's RQG) has an impact on the test git checkout experimental IMHO it is quite unlikely that my version of RQG (fork of Elena's RQG) has an impact on the test outcome. In case Elena's RQG is used than please pick also the branch 'experimental'. Compile MariaDB with "-DWITH_ASAN:BOOL=ON". export ASAN_OPTIONS=abort_on_error=1 # Abort but no core file ... start the test ...

          Bug which mentioned as duplicate is for 10.0 and up

          sanja Oleksandr Byelkin added a comment - Bug which mentioned as duplicate is for 10.0 and up

          With 10.3, easiest to use BUILD/compile-pentium64-asan-max to build.

          Anyway, I was able to reproduce the bug with ASAN and now working on it

          monty Michael Widenius added a comment - With 10.3, easiest to use BUILD/compile-pentium64-asan-max to build. Anyway, I was able to reproduce the bug with ASAN and now working on it

          Bug was that there where code in destructor that used files that where closed earlier.
          Fixed by removing all code from the destructor

          monty Michael Widenius added a comment - Bug was that there where code in destructor that used files that where closed earlier. Fixed by removing all code from the destructor

          Problem was that destructor called methods for closed table.
          Fixed by removing code in destructor.

          monty Michael Widenius added a comment - Problem was that destructor called methods for closed table. Fixed by removing code in destructor.

          People

            monty Michael Widenius
            mleich Matthias Leich
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.