Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-16826

[draft]different crashes

    XMLWordPrintable

Details

    • Bug
    • Status: Open (View Workflow)
    • Major
    • Resolution: Unresolved
    • 10.3(EOL)
    • None
    • None
    • None

    Description

      10.4 8cf7e3459d7309ce122824146260c4aecfa6ca77

      =================================================================
      ==16360==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000165dd8 at pc 0x560cdd689c16 bp 0x7f3a43ed3ac0 sp 0x7f3a43ed3ab0
      READ of size 4 at 0x615000165dd8 thread T32
          #0 0x560cdd689c15 in sf_malloc_usable_size /git/10.4/mysys/safemalloc.c:215
          #1 0x560cdd65bedf in my_free /git/10.4/mysys/my_malloc.c:212
          #2 0x560cdca9d80c in maria_create /git/10.4/storage/maria/ma_create.c:1275
          #3 0x560cdcabae7f in ha_maria::create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/storage/maria/ha_maria.cc:3227
          #4 0x560cdc5d2899 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/sql/handler.cc:4630
          #5 0x560cdc5d56b8 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /git/10.4/sql/handler.cc:5004
          #6 0x560cdc195c9b in rea_create_table(THD*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, HA_CREATE_INFO*, handler*, bool) /git/10.4/sql/unireg.cc:514
          #7 0x560cdc0b5693 in create_table_impl /git/10.4/sql/sql_table.cc:4952
          #8 0x560cdc0b6190 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /git/10.4/sql/sql_table.cc:5074
          #9 0x560cdc0b6bb5 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /git/10.4/sql/sql_table.cc:5163
          #10 0x560cdbebc792 in mysql_execute_command(THD*) /git/10.4/sql/sql_parse.cc:4282
          #11 0x560cdbed4443 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.4/sql/sql_parse.cc:8103
          #12 0x560cdbeaf265 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.4/sql/sql_parse.cc:1850
          #13 0x560cdbeac3fd in do_command(THD*) /git/10.4/sql/sql_parse.cc:1395
          #14 0x560cdc2034da in do_handle_one_connection(CONNECT*) /git/10.4/sql/sql_connect.cc:1402
          #15 0x560cdc202eb7 in handle_one_connection /git/10.4/sql/sql_connect.cc:1308
          #16 0x7f3a72f466b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
          #17 0x7f3a723db41c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)
       
      0x615000165dd8 is located 88 bytes inside of 500-byte region [0x615000165d80,0x615000165f74)
      freed by thread T32 here:
          #0 0x7f3a741a52ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
          #1 0x560cdd68a494 in free_memory /git/10.4/mysys/safemalloc.c:279
          #2 0x560cdd689b1e in sf_free /git/10.4/mysys/safemalloc.c:197
          #3 0x560cdd65bf15 in my_free /git/10.4/mysys/my_malloc.c:221
          #4 0x560cdca9cffd in maria_create /git/10.4/storage/maria/ma_create.c:1171
          #5 0x560cdcabae7f in ha_maria::create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/storage/maria/ha_maria.cc:3227
          #6 0x560cdc5d2899 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/sql/handler.cc:4630
          #7 0x560cdc5d56b8 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /git/10.4/sql/handler.cc:5004
          #8 0x560cdc195c9b in rea_create_table(THD*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, HA_CREATE_INFO*, handler*, bool) /git/10.4/sql/unireg.cc:514
          #9 0x560cdc0b5693 in create_table_impl /git/10.4/sql/sql_table.cc:4952
          #10 0x560cdc0b6190 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /git/10.4/sql/sql_table.cc:5074
          #11 0x560cdc0b6bb5 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /git/10.4/sql/sql_table.cc:5163
          #12 0x560cdbebc792 in mysql_execute_command(THD*) /git/10.4/sql/sql_parse.cc:4282
          #13 0x560cdbed4443 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.4/sql/sql_parse.cc:8103
          #14 0x560cdbeaf265 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.4/sql/sql_parse.cc:1850
          #15 0x560cdbeac3fd in do_command(THD*) /git/10.4/sql/sql_parse.cc:1395
          #16 0x560cdc2034da in do_handle_one_connection(CONNECT*) /git/10.4/sql/sql_connect.cc:1402
          #17 0x560cdc202eb7 in handle_one_connection /git/10.4/sql/sql_connect.cc:1308
          #18 0x7f3a72f466b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
       
      previously allocated by thread T32 here:
          #0 0x7f3a741a5602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
          #1 0x560cdd6894ef in sf_malloc /git/10.4/mysys/safemalloc.c:118
          #2 0x560cdd65b692 in my_malloc /git/10.4/mysys/my_malloc.c:101
          #3 0x560cdca9cb9b in maria_create /git/10.4/storage/maria/ma_create.c:1091
          #4 0x560cdcabae7f in ha_maria::create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/storage/maria/ha_maria.cc:3227
          #5 0x560cdc5d2899 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/sql/handler.cc:4630
          #6 0x560cdc5d56b8 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /git/10.4/sql/handler.cc:5004
          #7 0x560cdc195c9b in rea_create_table(THD*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, HA_CREATE_INFO*, handler*, bool) /git/10.4/sql/unireg.cc:514
          #8 0x560cdc0b5693 in create_table_impl /git/10.4/sql/sql_table.cc:4952
          #9 0x560cdc0b6190 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /git/10.4/sql/sql_table.cc:5074
          #10 0x560cdc0b6bb5 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /git/10.4/sql/sql_table.cc:5163
          #11 0x560cdbebc792 in mysql_execute_command(THD*) /git/10.4/sql/sql_parse.cc:4282
          #12 0x560cdbed4443 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.4/sql/sql_parse.cc:8103
          #13 0x560cdbeaf265 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.4/sql/sql_parse.cc:1850
          #14 0x560cdbeac3fd in do_command(THD*) /git/10.4/sql/sql_parse.cc:1395
          #15 0x560cdc2034da in do_handle_one_connection(CONNECT*) /git/10.4/sql/sql_connect.cc:1402
          #16 0x560cdc202eb7 in handle_one_connection /git/10.4/sql/sql_connect.cc:1308
          #17 0x7f3a72f466b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
       
      Thread T32 created by T0 here:
          #0 0x7f3a74143253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)
          #1 0x560cdd6b4c01 in spawn_thread_noop /git/10.4/mysys/psi_noop.c:187
          #2 0x560cdbc1fe74 in inline_mysql_thread_create /git/10.4/include/mysql/psi/mysql_thread.h:1268
          #3 0x560cdbc3505c in create_thread_to_handle_connection(CONNECT*) /git/10.4/sql/mysqld.cc:6333
          #4 0x560cdbc3575c in create_new_thread(CONNECT*) /git/10.4/sql/mysqld.cc:6403
          #5 0x560cdbc35ae7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /git/10.4/sql/mysqld.cc:6520
          #6 0x560cdbc36764 in handle_connections_sockets() /git/10.4/sql/mysqld.cc:6685
          #7 0x560cdbc3451c in mysqld_main(int, char**) /git/10.4/sql/mysqld.cc:5955
          #8 0x560cdbc1e59f in main /git/10.4/sql/main.cc:25
          #9 0x7f3a722f482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
       
      SUMMARY: AddressSanitizer: heap-use-after-free /git/10.4/mysys/safemalloc.c:215 sf_malloc_usable_size
      Shadow bytes around the buggy address:
        0x0c2a80024b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c2a80024b70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c2a80024b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c2a80024b90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c2a80024ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      =>0x0c2a80024bb0: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
        0x0c2a80024bc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c2a80024bd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c2a80024be0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
        0x0c2a80024bf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c2a80024c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
      ==16360==ABORTING
      

      Attachments

        Issue Links

          Activity

            People

              alice Alice Sherepa
              alice Alice Sherepa
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.