Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.3(EOL)
-
None
-
None
-
None
Description
10.4 8cf7e3459d7309ce122824146260c4aecfa6ca77
=================================================================
|
==16360==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000165dd8 at pc 0x560cdd689c16 bp 0x7f3a43ed3ac0 sp 0x7f3a43ed3ab0
|
READ of size 4 at 0x615000165dd8 thread T32
|
#0 0x560cdd689c15 in sf_malloc_usable_size /git/10.4/mysys/safemalloc.c:215
|
#1 0x560cdd65bedf in my_free /git/10.4/mysys/my_malloc.c:212
|
#2 0x560cdca9d80c in maria_create /git/10.4/storage/maria/ma_create.c:1275
|
#3 0x560cdcabae7f in ha_maria::create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/storage/maria/ha_maria.cc:3227
|
#4 0x560cdc5d2899 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/sql/handler.cc:4630
|
#5 0x560cdc5d56b8 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /git/10.4/sql/handler.cc:5004
|
#6 0x560cdc195c9b in rea_create_table(THD*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, HA_CREATE_INFO*, handler*, bool) /git/10.4/sql/unireg.cc:514
|
#7 0x560cdc0b5693 in create_table_impl /git/10.4/sql/sql_table.cc:4952
|
#8 0x560cdc0b6190 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /git/10.4/sql/sql_table.cc:5074
|
#9 0x560cdc0b6bb5 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /git/10.4/sql/sql_table.cc:5163
|
#10 0x560cdbebc792 in mysql_execute_command(THD*) /git/10.4/sql/sql_parse.cc:4282
|
#11 0x560cdbed4443 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.4/sql/sql_parse.cc:8103
|
#12 0x560cdbeaf265 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.4/sql/sql_parse.cc:1850
|
#13 0x560cdbeac3fd in do_command(THD*) /git/10.4/sql/sql_parse.cc:1395
|
#14 0x560cdc2034da in do_handle_one_connection(CONNECT*) /git/10.4/sql/sql_connect.cc:1402
|
#15 0x560cdc202eb7 in handle_one_connection /git/10.4/sql/sql_connect.cc:1308
|
#16 0x7f3a72f466b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
|
#17 0x7f3a723db41c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)
|
|
0x615000165dd8 is located 88 bytes inside of 500-byte region [0x615000165d80,0x615000165f74)
|
freed by thread T32 here:
|
#0 0x7f3a741a52ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
|
#1 0x560cdd68a494 in free_memory /git/10.4/mysys/safemalloc.c:279
|
#2 0x560cdd689b1e in sf_free /git/10.4/mysys/safemalloc.c:197
|
#3 0x560cdd65bf15 in my_free /git/10.4/mysys/my_malloc.c:221
|
#4 0x560cdca9cffd in maria_create /git/10.4/storage/maria/ma_create.c:1171
|
#5 0x560cdcabae7f in ha_maria::create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/storage/maria/ha_maria.cc:3227
|
#6 0x560cdc5d2899 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/sql/handler.cc:4630
|
#7 0x560cdc5d56b8 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /git/10.4/sql/handler.cc:5004
|
#8 0x560cdc195c9b in rea_create_table(THD*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, HA_CREATE_INFO*, handler*, bool) /git/10.4/sql/unireg.cc:514
|
#9 0x560cdc0b5693 in create_table_impl /git/10.4/sql/sql_table.cc:4952
|
#10 0x560cdc0b6190 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /git/10.4/sql/sql_table.cc:5074
|
#11 0x560cdc0b6bb5 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /git/10.4/sql/sql_table.cc:5163
|
#12 0x560cdbebc792 in mysql_execute_command(THD*) /git/10.4/sql/sql_parse.cc:4282
|
#13 0x560cdbed4443 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.4/sql/sql_parse.cc:8103
|
#14 0x560cdbeaf265 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.4/sql/sql_parse.cc:1850
|
#15 0x560cdbeac3fd in do_command(THD*) /git/10.4/sql/sql_parse.cc:1395
|
#16 0x560cdc2034da in do_handle_one_connection(CONNECT*) /git/10.4/sql/sql_connect.cc:1402
|
#17 0x560cdc202eb7 in handle_one_connection /git/10.4/sql/sql_connect.cc:1308
|
#18 0x7f3a72f466b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
|
|
previously allocated by thread T32 here:
|
#0 0x7f3a741a5602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
|
#1 0x560cdd6894ef in sf_malloc /git/10.4/mysys/safemalloc.c:118
|
#2 0x560cdd65b692 in my_malloc /git/10.4/mysys/my_malloc.c:101
|
#3 0x560cdca9cb9b in maria_create /git/10.4/storage/maria/ma_create.c:1091
|
#4 0x560cdcabae7f in ha_maria::create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/storage/maria/ha_maria.cc:3227
|
#5 0x560cdc5d2899 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/sql/handler.cc:4630
|
#6 0x560cdc5d56b8 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /git/10.4/sql/handler.cc:5004
|
#7 0x560cdc195c9b in rea_create_table(THD*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, HA_CREATE_INFO*, handler*, bool) /git/10.4/sql/unireg.cc:514
|
#8 0x560cdc0b5693 in create_table_impl /git/10.4/sql/sql_table.cc:4952
|
#9 0x560cdc0b6190 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /git/10.4/sql/sql_table.cc:5074
|
#10 0x560cdc0b6bb5 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /git/10.4/sql/sql_table.cc:5163
|
#11 0x560cdbebc792 in mysql_execute_command(THD*) /git/10.4/sql/sql_parse.cc:4282
|
#12 0x560cdbed4443 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.4/sql/sql_parse.cc:8103
|
#13 0x560cdbeaf265 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.4/sql/sql_parse.cc:1850
|
#14 0x560cdbeac3fd in do_command(THD*) /git/10.4/sql/sql_parse.cc:1395
|
#15 0x560cdc2034da in do_handle_one_connection(CONNECT*) /git/10.4/sql/sql_connect.cc:1402
|
#16 0x560cdc202eb7 in handle_one_connection /git/10.4/sql/sql_connect.cc:1308
|
#17 0x7f3a72f466b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
|
|
Thread T32 created by T0 here:
|
#0 0x7f3a74143253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)
|
#1 0x560cdd6b4c01 in spawn_thread_noop /git/10.4/mysys/psi_noop.c:187
|
#2 0x560cdbc1fe74 in inline_mysql_thread_create /git/10.4/include/mysql/psi/mysql_thread.h:1268
|
#3 0x560cdbc3505c in create_thread_to_handle_connection(CONNECT*) /git/10.4/sql/mysqld.cc:6333
|
#4 0x560cdbc3575c in create_new_thread(CONNECT*) /git/10.4/sql/mysqld.cc:6403
|
#5 0x560cdbc35ae7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /git/10.4/sql/mysqld.cc:6520
|
#6 0x560cdbc36764 in handle_connections_sockets() /git/10.4/sql/mysqld.cc:6685
|
#7 0x560cdbc3451c in mysqld_main(int, char**) /git/10.4/sql/mysqld.cc:5955
|
#8 0x560cdbc1e59f in main /git/10.4/sql/main.cc:25
|
#9 0x7f3a722f482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
|
|
SUMMARY: AddressSanitizer: heap-use-after-free /git/10.4/mysys/safemalloc.c:215 sf_malloc_usable_size
|
Shadow bytes around the buggy address:
|
0x0c2a80024b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c2a80024b70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c2a80024b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c2a80024b90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c2a80024ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
=>0x0c2a80024bb0: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
|
0x0c2a80024bc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c2a80024bd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c2a80024be0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
|
0x0c2a80024bf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c2a80024c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Heap right redzone: fb
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack partial redzone: f4
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
==16360==ABORTING
|
Attachments
Issue Links
- relates to
-
MDEV-23222 MDEV-23222 SIGSEG in maria_create() because of double free
- Closed