Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-16780

[draft] AddressSanitizer: use-after-poison

    XMLWordPrintable

Details

    • Bug
    • Status: Open (View Workflow)
    • Major
    • Resolution: Unresolved
    • 10.4(EOL)
    • None
    • None

    Description

      perl runall-new.pl --no-mask --seed=time --threads=8 --duration=600 --queries=100M --reporter=Backtrace,ErrorLog --engine=InnoDB --mysqld=--join_cache_level=3 --grammar=conf/optimizer/range_access.yy --gendata=conf/optimizer/outer_join.zz  --basedir=/git/10.4 --vardir=~/7
      

      Version: '10.4.0-MariaDB-debug-log'  
      =================================================================
      ==16814==ERROR: AddressSanitizer: use-after-poison on address 0x7f85e2efbd50 at pc 0x55d08b29fbcb bp 0x7f85bef3d6a0 sp 0x7f85bef3d690
      WRITE of size 8 at 0x7f85e2efbd50 thread T34
          #0 0x55d08b29fbca in trx_flush_log_if_needed /git/10.4/storage/innobase/trx/trx0trx.cc:1241
          #1 0x55d08b2a116b in trx_commit_in_memory /git/10.4/storage/innobase/trx/trx0trx.cc:1407
          #2 0x55d08b2a24e1 in trx_commit_low(trx_t*, mtr_t*) /git/10.4/storage/innobase/trx/trx0trx.cc:1534
          #3 0x55d08b2a261c in trx_commit(trx_t*) /git/10.4/storage/innobase/trx/trx0trx.cc:1558
          #4 0x55d08b2a2f6b in trx_commit_for_mysql(trx_t*) /git/10.4/storage/innobase/trx/trx0trx.cc:1694
          #5 0x55d08af3b3ed in ha_innobase::commit_inplace_alter_table(TABLE*, Alter_inplace_info*, bool) /git/10.4/storage/innobase/handler/handler0alter.cc:9595
          #6 0x55d08a6954b5 in handler::ha_commit_inplace_alter_table(TABLE*, Alter_inplace_info*, bool) /git/10.4/sql/handler.cc:4417
          #7 0x55d08a1bf7c0 in mysql_inplace_alter_table /git/10.4/sql/sql_table.cc:7616
          #8 0x55d08a1cc02b in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /git/10.4/sql/sql_table.cc:9710
          #9 0x55d089fb8cb5 in mysql_execute_command(THD*) /git/10.4/sql/sql_parse.cc:4333
          #10 0x55d089fd0128 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.4/sql/sql_parse.cc:8063
          #11 0x55d089fab24e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.4/sql/sql_parse.cc:1847
          #12 0x55d089fa83e6 in do_command(THD*) /git/10.4/sql/sql_parse.cc:1392
          #13 0x55d08a2f9201 in do_handle_one_connection(CONNECT*) /git/10.4/sql/sql_connect.cc:1402
          #14 0x55d08a2f8bde in handle_one_connection /git/10.4/sql/sql_connect.cc:1308
          #15 0x7f85efc4e6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
          #16 0x7f85ef0e341c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)
       
      0x7f85e2efbd50 is located 9552 bytes inside of 4194304-byte region [0x7f85e2ef9800,0x7f85e32f9800)
      allocated by thread T0 here:
          #0 0x7f85f105279a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
          #1 0x55d08b2aa488 in Pool<trx_t, TrxFactory, TrxPoolLock>::Pool(unsigned long) /git/10.4/storage/innobase/include/ut0pool.h:65
          #2 0x55d08b2a9300 in PoolManager<Pool<trx_t, TrxFactory, TrxPoolLock>, TrxPoolManagerLock>::add_pool(unsigned long) /git/10.4/storage/innobase/include/ut0pool.h:320
          #3 0x55d08b2a8c62 in PoolManager<Pool<trx_t, TrxFactory, TrxPoolLock>, TrxPoolManagerLock>::create() /git/10.4/storage/innobase/include/ut0pool.h:348
          #4 0x55d08b2a7fc4 in PoolManager<Pool<trx_t, TrxFactory, TrxPoolLock>, TrxPoolManagerLock>::PoolManager(unsigned long) /git/10.4/storage/innobase/include/ut0pool.h:232
          #5 0x55d08b297ad2 in trx_pool_init() /git/10.4/storage/innobase/trx/trx0trx.cc:375
          #6 0x55d08b205076 in srv_boot() /git/10.4/storage/innobase/srv/srv0srv.cc:1125
          #7 0x55d08b215864 in srv_start(bool) /git/10.4/storage/innobase/srv/srv0start.cc:1532
          #8 0x55d08ae949c2 in innodb_init /git/10.4/storage/innobase/handler/ha_innodb.cc:4269
          #9 0x55d08a67c09d in ha_initialize_handlerton(st_plugin_int*) /git/10.4/sql/handler.cc:522
          #10 0x55d089fea407 in plugin_initialize /git/10.4/sql/sql_plugin.cc:1432
          #11 0x55d089febc74 in plugin_init(int*, char**, int) /git/10.4/sql/sql_plugin.cc:1714
          #12 0x55d089d3319f in init_server_components /git/10.4/sql/mysqld.cc:5390
          #13 0x55d089d350c8 in mysqld_main(int, char**) /git/10.4/sql/mysqld.cc:5997
          #14 0x55d089d1f80f in main /git/10.4/sql/main.cc:25
          #15 0x7f85eeffc82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
       
      Thread T34 created by T0 here:
          #0 0x7f85f0ff0253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)
          #1 0x55d08b77e1be in spawn_thread_noop /git/10.4/mysys/psi_noop.c:187
          #2 0x55d089d210e4 in inline_mysql_thread_create /git/10.4/include/mysql/psi/mysql_thread.h:1268
          #3 0x55d089d3653d in create_thread_to_handle_connection(CONNECT*) /git/10.4/sql/mysqld.cc:6572
          #4 0x55d089d36c3d in create_new_thread /git/10.4/sql/mysqld.cc:6642
          #5 0x55d089d37c7a in handle_connections_sockets() /git/10.4/sql/mysqld.cc:6917
          #6 0x55d089d359fd in mysqld_main(int, char**) /git/10.4/sql/mysqld.cc:6194
          #7 0x55d089d1f80f in main /git/10.4/sql/main.cc:25
          #8 0x7f85eeffc82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
       
      SUMMARY: AddressSanitizer: use-after-poison /git/10.4/storage/innobase/trx/trx0trx.cc:1241 trx_flush_log_if_needed
      Shadow bytes around the buggy address:
        0x0ff13c5d7750: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0ff13c5d7760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0ff13c5d7770: 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00
        0x0ff13c5d7780: 00 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0ff13c5d7790: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
      =>0x0ff13c5d77a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7[f7]f7 f7 f7 f7 f7
        0x0ff13c5d77b0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0ff13c5d77c0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0ff13c5d77d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0ff13c5d77e0: f7 f7 f7 f7 f7 f7 00 f7 00 00 00 00 00 00 00 00
        0x0ff13c5d77f0: 00 00 00 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
      ==16814==ABORTING
      

      Attachments

        Issue Links

          Activity

            People

              alice Alice Sherepa
              alice Alice Sherepa
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.