[MDEV-17005] ASAN heap-use-after-free in innobase_get_computed_value - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Critical
Resolution: Fixed
Affects Version/s: 10.2(EOL), 10.3(EOL), 10.4(EOL)
Fix Version/s: 10.2.26, 10.3.17, 10.4.7
Component/s: Data Definition - Alter Table, Locking, Storage Engine - InnoDB, Virtual Columns
Labels:
- affects-tests

Description

10.2 05153a670de6ee
==10706==ERROR: AddressSanitizer: heap-use-after-free on address 0x6230001712ec at pc 0x5568429cf673 bp 0x7f55d3e2fc30 sp 0x7f55d3e2fc28
READ of size 5 at 0x6230001712ec thread T33
#0 0x5568429cf672 in innobase_get_computed_value(dtuple_t const, dict_v_col_t const, dict_index_t const, mem_block_info_t, mem_block_info_t, dict_field_t const, THD, TABLE, unsigned char, dict_table_t const, upd_t, dict_foreign_t*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:22078
#1 0x556842c946ad in row_upd_store_v_row /data/src/10.2/storage/innobase/row/row0upd.cc:2188
#2 0x556842c94c84 in row_upd_store_row(upd_node_t, THD, TABLE*) /data/src/10.2/storage/innobase/row/row0upd.cc:2252
#3 0x556842c98727 in row_upd_del_mark_clust_rec /data/src/10.2/storage/innobase/row/row0upd.cc:2975
#4 0x556842c99574 in row_upd_clust_step /data/src/10.2/storage/innobase/row/row0upd.cc:3158
#5 0x556842c9a015 in row_upd /data/src/10.2/storage/innobase/row/row0upd.cc:3279
#6 0x556842c9ad2e in row_upd_step(que_thr_t*) /data/src/10.2/storage/innobase/row/row0upd.cc:3425
#7 0x556842bf493d in row_update_for_mysql(row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:1829
#8 0x55684299ba67 in ha_innobase::delete_row(unsigned char const*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9228
#9 0x5568422110e4 in handler::ha_delete_row(unsigned char const*) /data/src/10.2/sql/handler.cc:6019
#10 0x556841bb0f2e in write_record(THD, TABLE, st_copy_info*) /data/src/10.2/sql/sql_insert.cc:1893
#11 0x5568425f5664 in read_sep_field /data/src/10.2/sql/sql_load.cc:1256
#12 0x5568425f1458 in mysql_load(THD, sql_exchange, TABLE_LIST*, List<Item>&, List<Item>&, List<Item>&, enum_duplicates, bool, bool) /data/src/10.2/sql/sql_load.cc:649
#13 0x556841c1113f in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4833
#14 0x556841c25139 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:8009
#15 0x556841bffd20 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1824
#16 0x556841bfcdc4 in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1378
#17 0x556841f3f825 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
#18 0x556841f3f23a in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
#19 0x7f55f4bc9493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
#20 0x7f55f2faf93e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

ASAN:SIGSEGV
==10706==AddressSanitizer: while reporting a bug found another one.Ignoring.

To reproduce:

git clone https://github.com/elenst/rqg --branch mdev17005 rqg-mdev17005

cd rqg-mdev17005

perl ./runall-new.pl --basedir=/data/bld/10.2-asan --vardir=/dev/shm/vardir --duration=350 --threads=4  --grammar=mdev17005.yy --skip-gendata --gendata-advanced --vcols

Notes:

Don't forget to change the basedir value.
The grammar is quite big and could definitely use some automatic simplification, but I'm not sure it's necessary, possibly the problem will be obvious right away.
Reproducible on 10.2 and 10.3. On 10.0 and 10.1 I hit MDEV-17004 instead.

The test reproduces the problem for me almost every time, but sometimes it misses the mark. Just run it again. You can also use this command line to run the same test a desired number of times:

perl ./runall-trials.pl --trials=10 --basedir=/data/bld/10.2-asan --vardir=/dev/shm/vardir --duration=350 --threads=4  --grammar=mdev17005.yy --skip-gendata --gendata-advanced --vcols

runall-new.pl is replaced by runall-trials.pl --trials=N, all other options are the same. It will stop when the test fails for the first time.

Attachments

- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List
- Download All

mdev-17005.tgz
4 kB
2018-11-02 16:12

Issue Links

relates to

MDEV-5800 indexes on virtual (not materialized) columns

Closed

MDEV-19486 Server crashes in row_upd or row_upd_del_mark_clust_rec on REPLACE into a versioned table

Closed

MDEV-20143 innodb.innodb-virtual-columns-debug failed in buildbot with wrong result

Closed

MDEV-16856 Crash

Closed

MDEV-18546 ASAN heap-use-after-free in innobase_get_computed_value / row_purge

Closed

MDEV-18891 ASAN heap-use-after-free in innobase_get_computed_value on concurrent DELETE from table with long index

Closed

(1 relates to)

Sub-Tasks

Variety of test cases and stack traces which are likely to be related to MDEV-17005 and need to be re-checked after the fix

Closed

Unassigned

Activity

Ascending order - Click to sort in descending order

Elena Stepanova created issue - 2018-08-16 17:01

Elena Stepanova made changes - 2018-08-16 17:01

Field	Original Value	New Value
Assignee	Elena Stepanova [ elenst ]	Marko Mäkelä [ marko ]

Elena Stepanova made changes - 2018-08-16 17:27

Description

{noformat:title=10.2 05153a670de6ee}
==10706==ERROR: AddressSanitizer: heap-use-after-free on address 0x6230001712ec at pc 0x5568429cf673 bp 0x7f55d3e2fc30 sp 0x7f55d3e2fc28
READ of size 5 at 0x6230001712ec thread T33
    #0 0x5568429cf672 in innobase_get_computed_value(dtuple_t const*, dict_v_col_t const*, dict_index_t const*, mem_block_info_t**, mem_block_info_t*, dict_field_t const*, THD*, TABLE*, unsigned char*, dict_table_t const*, upd_t*, dict_foreign_t*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:22078
    #1 0x556842c946ad in row_upd_store_v_row /data/src/10.2/storage/innobase/row/row0upd.cc:2188
    #2 0x556842c94c84 in row_upd_store_row(upd_node_t*, THD*, TABLE*) /data/src/10.2/storage/innobase/row/row0upd.cc:2252
    #3 0x556842c98727 in row_upd_del_mark_clust_rec /data/src/10.2/storage/innobase/row/row0upd.cc:2975
    #4 0x556842c99574 in row_upd_clust_step /data/src/10.2/storage/innobase/row/row0upd.cc:3158
    #5 0x556842c9a015 in row_upd /data/src/10.2/storage/innobase/row/row0upd.cc:3279
    #6 0x556842c9ad2e in row_upd_step(que_thr_t*) /data/src/10.2/storage/innobase/row/row0upd.cc:3425
    #7 0x556842bf493d in row_update_for_mysql(row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:1829
    #8 0x55684299ba67 in ha_innobase::delete_row(unsigned char const*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9228
    #9 0x5568422110e4 in handler::ha_delete_row(unsigned char const*) /data/src/10.2/sql/handler.cc:6019
    #10 0x556841bb0f2e in write_record(THD*, TABLE*, st_copy_info*) /data/src/10.2/sql/sql_insert.cc:1893
    #11 0x5568425f5664 in read_sep_field /data/src/10.2/sql/sql_load.cc:1256
    #12 0x5568425f1458 in mysql_load(THD*, sql_exchange*, TABLE_LIST*, List<Item>&, List<Item>&, List<Item>&, enum_duplicates, bool, bool) /data/src/10.2/sql/sql_load.cc:649
    #13 0x556841c1113f in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4833
    #14 0x556841c25139 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:8009
    #15 0x556841bffd20 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1824
    #16 0x556841bfcdc4 in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1378
    #17 0x556841f3f825 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
    #18 0x556841f3f23a in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
    #19 0x7f55f4bc9493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
    #20 0x7f55f2faf93e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

ASAN:SIGSEGV
==10706==AddressSanitizer: while reporting a bug found another one.Ignoring.
{noformat}

To reproduce:
{noformat}
git clone https://github.com/elenst/rqg --branch mdev16962 rqg-mdev16962
cd rqg-mdev16962
perl ./runall-new.pl --basedir=/data/bld/10.2-asan --vardir=/dev/shm/vardir --duration=350 --threads=4 --grammar=mdev16962.yy --skip-gendata --gendata-advanced --vcols
{noformat}

Notes:

- Don't forget to change the {{basedir}} value.
- The grammar is quite big and could definitely use some automatic simplification, but I'm not sure it's necessary, possibly the problem will be obvious right away.
- Reproducible on 10.2 and 10.3. On 10.0 and 10.1 I hit MDEV-17004 instead.
- The test reproduces the problem for me _almost_ every time, but sometimes it misses the mark. Just run it again. You can also use this command line to run the same test a desired number of times:
{noformat}
perl ./runall-trials.pl --trials=10 --basedir=/data/bld/10.2-asan --vardir=/dev/shm/vardir --duration=350 --threads=4 --grammar=mdev16962.yy --skip-gendata --gendata-advanced --vcols
{noformat}
{{runall-new.pl}} is replaced by {{runall-trials.pl --trials=N}}, all other options are the same. It will stop when the test fails for the first time.

{noformat:title=10.2 05153a670de6ee}
==10706==ERROR: AddressSanitizer: heap-use-after-free on address 0x6230001712ec at pc 0x5568429cf673 bp 0x7f55d3e2fc30 sp 0x7f55d3e2fc28
READ of size 5 at 0x6230001712ec thread T33
    #0 0x5568429cf672 in innobase_get_computed_value(dtuple_t const*, dict_v_col_t const*, dict_index_t const*, mem_block_info_t**, mem_block_info_t*, dict_field_t const*, THD*, TABLE*, unsigned char*, dict_table_t const*, upd_t*, dict_foreign_t*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:22078
    #1 0x556842c946ad in row_upd_store_v_row /data/src/10.2/storage/innobase/row/row0upd.cc:2188
    #2 0x556842c94c84 in row_upd_store_row(upd_node_t*, THD*, TABLE*) /data/src/10.2/storage/innobase/row/row0upd.cc:2252
    #3 0x556842c98727 in row_upd_del_mark_clust_rec /data/src/10.2/storage/innobase/row/row0upd.cc:2975
    #4 0x556842c99574 in row_upd_clust_step /data/src/10.2/storage/innobase/row/row0upd.cc:3158
    #5 0x556842c9a015 in row_upd /data/src/10.2/storage/innobase/row/row0upd.cc:3279
    #6 0x556842c9ad2e in row_upd_step(que_thr_t*) /data/src/10.2/storage/innobase/row/row0upd.cc:3425
    #7 0x556842bf493d in row_update_for_mysql(row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:1829
    #8 0x55684299ba67 in ha_innobase::delete_row(unsigned char const*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9228
    #9 0x5568422110e4 in handler::ha_delete_row(unsigned char const*) /data/src/10.2/sql/handler.cc:6019
    #10 0x556841bb0f2e in write_record(THD*, TABLE*, st_copy_info*) /data/src/10.2/sql/sql_insert.cc:1893
    #11 0x5568425f5664 in read_sep_field /data/src/10.2/sql/sql_load.cc:1256
    #12 0x5568425f1458 in mysql_load(THD*, sql_exchange*, TABLE_LIST*, List<Item>&, List<Item>&, List<Item>&, enum_duplicates, bool, bool) /data/src/10.2/sql/sql_load.cc:649
    #13 0x556841c1113f in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4833
    #14 0x556841c25139 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:8009
    #15 0x556841bffd20 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1824
    #16 0x556841bfcdc4 in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1378
    #17 0x556841f3f825 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
    #18 0x556841f3f23a in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
    #19 0x7f55f4bc9493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
    #20 0x7f55f2faf93e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

ASAN:SIGSEGV
==10706==AddressSanitizer: while reporting a bug found another one.Ignoring.
{noformat}

To reproduce:
{noformat}
git clone https://github.com/elenst/rqg --branch mdev17005 rqg-mdev17005
cd rqg-mdev17005
perl ./runall-new.pl --basedir=/data/bld/10.2-asan --vardir=/dev/shm/vardir --duration=350 --threads=4 --grammar=mdev17005.yy --skip-gendata --gendata-advanced --vcols
{noformat}

Notes:

- Don't forget to change the {{basedir}} value.
- The grammar is quite big and could definitely use some automatic simplification, but I'm not sure it's necessary, possibly the problem will be obvious right away.
- Reproducible on 10.2 and 10.3. On 10.0 and 10.1 I hit MDEV-17004 instead.
- The test reproduces the problem for me _almost_ every time, but sometimes it misses the mark. Just run it again. You can also use this command line to run the same test a desired number of times:
{noformat}
perl ./runall-trials.pl --trials=10 --basedir=/data/bld/10.2-asan --vardir=/dev/shm/vardir --duration=350 --threads=4 --grammar=mdev17005.yy --skip-gendata --gendata-advanced --vcols
{noformat}
{{runall-new.pl}} is replaced by {{runall-trials.pl --trials=N}}, all other options are the same. It will stop when the test fails for the first time.

Elena Stepanova made changes - 2018-10-07 11:32

Link

This issue relates to ~~MDEV-16856~~ [ ~~MDEV-16856~~ ]

Marko Mäkelä made changes - 2018-11-01 09:22

Link

This issue relates to ~~MDEV-5800~~ [ ~~MDEV-5800~~ ]

Marko Mäkelä made changes - 2018-11-01 10:29

Component/s		Data Definition - Alter Table [ 10114 ]
Component/s		Locking [ 10900 ]
Component/s		Virtual Columns [ 10803 ]

Marko Mäkelä made changes - 2018-11-01 10:32

Assignee

Marko Mäkelä [ marko ]

Sergey Vojtovich [ svoj ]

Marko Mäkelä made changes - 2018-11-01 10:32

Status

Open [ 1 ]

Confirmed [ 10101 ]

Matthias Leich made changes - 2018-11-02 16:12

Attachment

mdev-17005.tgz [ 46660 ]

Elena Stepanova made changes - 2019-01-27 11:42

Fix Version/s		10.4 [ 22408 ]
Affects Version/s		10.4 [ 22408 ]

Elena Stepanova made changes - 2019-02-25 20:12

Link

This issue relates to ~~MDEV-18546~~ [ ~~MDEV-18546~~ ]

Elena Stepanova made changes - 2019-03-12 12:17

Link

This issue relates to ~~MDEV-18891~~ [ ~~MDEV-18891~~ ]

Sergey Vojtovich made changes - 2019-04-03 14:41

Assignee

Sergey Vojtovich [ svoj ]

Marko Mäkelä [ marko ]

Marko Mäkelä made changes - 2019-04-04 08:18

Assignee

Marko Mäkelä [ marko ]

Nikita Malyavin [ nikitamalyavin ]

Elena Stepanova made changes - 2019-05-12 21:15

Priority

Major [ 3 ]

Critical [ 2 ]

Elena Stepanova made changes - 2019-05-12 21:16

Labels

affects-tests

Elena Stepanova made changes - 2019-05-15 14:49

Link

This issue relates to ~~MDEV-19486~~ [ ~~MDEV-19486~~ ]

Nikita Malyavin made changes - 2019-07-10 03:35

Status

Confirmed [ 10101 ]

In Progress [ 3 ]

Nikita Malyavin made changes - 2019-07-15 15:08

Assignee	Nikita Malyavin [ nikitamalyavin ]	Marko Mäkelä [ marko ]
Status	In Progress [ 3 ]	In Review [ 10002 ]

Marko Mäkelä made changes - 2019-07-18 13:40

Assignee	Marko Mäkelä [ marko ]	Nikita Malyavin [ nikitamalyavin ]
Status	In Review [ 10002 ]	Stalled [ 10000 ]

Nikita Malyavin made changes - 2019-07-22 07:25

Status

Stalled [ 10000 ]

In Progress [ 3 ]

Nikita Malyavin made changes - 2019-07-22 11:25

Fix Version/s		10.2.27 [ 23717 ]
Fix Version/s	10.2 [ 14601 ]
Fix Version/s	10.3 [ 22126 ]
Fix Version/s	10.4 [ 22408 ]
Resolution		Fixed [ 1 ]
Status	In Progress [ 3 ]	Closed [ 6 ]

Nikita Malyavin made changes - 2019-07-22 11:55

Fix Version/s		10.2.26 [ 23409 ]
Fix Version/s	10.2.27 [ 23717 ]

Nikita Malyavin made changes - 2019-07-22 11:57

Fix Version/s		10.3.17 [ 23411 ]
Fix Version/s		10.4.7 [ 23720 ]

Marko Mäkelä made changes - 2019-09-10 08:33

Link

This issue relates to ~~MDEV-20143~~ [ ~~MDEV-20143~~ ]

Sergei Golubchik made changes - 2021-12-06 21:47

Workflow

MariaDB v3 [ 88960 ]

MariaDB v4 [ 154812 ]

People

Assignee:: Nikita Malyavin

Reporter:: Elena Stepanova

Votes:: 0 Vote for this issue

Watchers:: 6 Start watching this issue

Dates

Created:: 2018-08-16 17:01

Updated:: 2019-10-11 07:02

Resolved:: 2019-07-22 11:25

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server

Details

Description

Attachments

Attachments

Issue Links

Sub-Tasks

Activity

People

Dates

Git Integration