Details
-
Bug
-
Status: Closed (View Workflow)
-
Major
-
Resolution: Fixed
-
10.3(EOL), 10.4(EOL)
-
None
Description
Note: it always fails for me on 10.3 ASAN build with the configured 100 loops (usually within first few), but it can vary on different machines and builds. Modify $run in the first line if needed.
--let $run= 100
|
|
|
CREATE SEQUENCE s1 ENGINE=Aria; |
|
|
while ($run)
|
{
|
--connection default |
SELECT NEXTVAL(s1) UNION SELECT NEXTVAL(s1); |
LOCK TABLE s1 READ; |
|
|
--connect (con1,localhost,root,,test) |
--send |
SELECT NEXTVAL(s1) ; |
|
|
--connect (con2,localhost,root,,test) |
SELECT * FROM s1; |
|
|
--connect (con3,localhost,root,,test) |
--send |
FLUSH TABLES;
|
|
|
--disconnect con2 |
--disconnect con1 |
--disconnect con3 |
|
|
--connection default |
UNLOCK TABLES;
|
|
|
--dec $run |
}
|
|
|
DROP SEQUENCE s1; |
|
10.3 d27bea9e9a ASAN |
==28605==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290001182b0 at pc 0x55fd1c701b9e bp 0x7f88f8fdc500 sp 0x7f88f8fdc4f8
|
READ of size 8 at 0x6290001182b0 thread T6
|
#0 0x55fd1c701b9d in _ma_get_status /data/src/10.3/storage/maria/ma_state.c:293
|
#1 0x55fd1d33debb in wait_for_lock /data/src/10.3/mysys/thr_lock.c:638
|
#2 0x55fd1d33fcad in thr_lock /data/src/10.3/mysys/thr_lock.c:1014
|
#3 0x55fd1d34163b in thr_multi_lock /data/src/10.3/mysys/thr_lock.c:1295
|
#4 0x55fd1c4f1189 in mysql_lock_tables(THD*, st_mysql_lock*, unsigned int) /data/src/10.3/sql/lock.cc:355
|
#5 0x55fd1c4f0c75 in mysql_lock_tables(THD*, TABLE**, unsigned int, unsigned int) /data/src/10.3/sql/lock.cc:304
|
#6 0x55fd1b9cfbe7 in lock_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /data/src/10.3/sql/sql_base.cc:5261
|
#7 0x55fd1b9ce307 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5005
|
#8 0x55fd1b93f488 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:502
|
#9 0x55fd1bb28735 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6469
|
#10 0x55fd1bb17579 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3769
|
#11 0x55fd1bb31fa0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8092
|
#12 0x55fd1bb0c078 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1851
|
#13 0x55fd1bb09100 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
|
#14 0x55fd1be7b364 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
|
#15 0x55fd1be7ad70 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
|
#16 0x55fd1c9ad0f7 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
|
#17 0x7f8905a91493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
|
#18 0x7f8903e7793e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
|
|
|
0x6290001182b0 is located 176 bytes inside of 18396-byte region [0x629000118200,0x62900011c9dc)
|
freed by thread T5 here:
|
#0 0x7f8905cfb527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
|
#1 0x55fd1d359b22 in free_memory /data/src/10.3/mysys/safemalloc.c:279
|
#2 0x55fd1d359128 in sf_free /data/src/10.3/mysys/safemalloc.c:197
|
#3 0x55fd1d329b22 in my_free /data/src/10.3/mysys/my_malloc.c:222
|
#4 0x55fd1c89ed6e in maria_close /data/src/10.3/storage/maria/ma_close.c:269
|
#5 0x55fd1c7300d9 in ha_maria::close() /data/src/10.3/storage/maria/ha_maria.cc:1275
|
#6 0x55fd1d2b793b in ha_sequence::close() /data/src/10.3/sql/ha_sequence.h:135
|
#7 0x55fd1c238160 in handler::ha_close() /data/src/10.3/sql/handler.cc:2751
|
#8 0x55fd1bdc2370 in closefrm(TABLE*) /data/src/10.3/sql/table.cc:3580
|
#9 0x55fd1c026a4c in intern_close_table /data/src/10.3/sql/table_cache.cc:222
|
#10 0x55fd1c026cb2 in tc_remove_table /data/src/10.3/sql/table_cache.cc:260
|
#11 0x55fd1c027f8e in tc_release_table(TABLE*) /data/src/10.3/sql/table_cache.cc:474
|
#12 0x55fd1b9bb389 in close_thread_table(THD*, TABLE**) /data/src/10.3/sql/sql_base.cc:912
|
#13 0x55fd1b9baaa8 in close_thread_tables(THD*) /data/src/10.3/sql/sql_base.cc:854
|
#14 0x55fd1b9c195f in Locked_tables_list::unlock_locked_tables(THD*) /data/src/10.3/sql/sql_base.cc:2273
|
#15 0x55fd1bb1f6db in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:5168
|
#16 0x55fd1bb31fa0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8092
|
#17 0x55fd1bb0c078 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1851
|
#18 0x55fd1bb09100 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
|
#19 0x55fd1be7b364 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
|
#20 0x55fd1be7ad70 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
|
#21 0x55fd1c9ad0f7 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
|
#22 0x7f8905a91493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
|
|
|
previously allocated by thread T5 here:
|
#0 0x7f8905cfb73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
|
#1 0x55fd1d358898 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
|
#2 0x55fd1d329215 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
|
#3 0x55fd1d306e6a in my_multi_malloc /data/src/10.3/mysys/mulalloc.c:51
|
#4 0x55fd1c7cd6ad in maria_clone_internal /data/src/10.3/storage/maria/ma_open.c:117
|
#5 0x55fd1c7d6b87 in maria_open /data/src/10.3/storage/maria/ma_open.c:1056
|
#6 0x55fd1c72f22c in ha_maria::open(char const*, int, unsigned int) /data/src/10.3/storage/maria/ha_maria.cc:1201
|
#7 0x55fd1d2b4164 in ha_sequence::open(char const*, int, unsigned int) /data/src/10.3/sql/ha_sequence.cc:84
|
#8 0x55fd1c237266 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/src/10.3/sql/handler.cc:2685
|
#9 0x55fd1bdc14ae in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/src/10.3/sql/table.cc:3482
|
#10 0x55fd1b9bf946 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.3/sql/sql_base.cc:1975
|
#11 0x55fd1b9c7022 in open_and_process_table /data/src/10.3/sql/sql_base.cc:3596
|
#12 0x55fd1b9c9a03 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4121
|
#13 0x55fd1b9ce21b in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4996
|
#14 0x55fd1b93f488 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:502
|
#15 0x55fd1bb28735 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6469
|
#16 0x55fd1bb17579 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3769
|
#17 0x55fd1bb31fa0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8092
|
#18 0x55fd1bb0c078 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1851
|
#19 0x55fd1bb09100 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
|
#20 0x55fd1be7b364 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
|
#21 0x55fd1be7ad70 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
|
#22 0x55fd1c9ad0f7 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
|
#23 0x7f8905a91493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
|
|
|
Thread T6 created by T0 here:
|
#0 0x7f8905ccabba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
|
#1 0x55fd1c9ad6bf in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
|
#2 0x55fd1b873d68 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
|
#3 0x55fd1b889efa in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6572
|
#4 0x55fd1b88a5ff in create_new_thread /data/src/10.3/sql/mysqld.cc:6642
|
#5 0x55fd1b88b616 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6917
|
#6 0x55fd1b8893b7 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6194
|
#7 0x55fd1b871def in main /data/src/10.3/sql/main.cc:25
|
#8 0x7f8903daf2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
|
|
|
Thread T5 created by T0 here:
|
#0 0x7f8905ccabba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
|
#1 0x55fd1c9ad6bf in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
|
#2 0x55fd1b873d68 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
|
#3 0x55fd1b889efa in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6572
|
#4 0x55fd1b88a5ff in create_new_thread /data/src/10.3/sql/mysqld.cc:6642
|
#5 0x55fd1b88b616 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6917
|
#6 0x55fd1b8893b7 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6194
|
#7 0x55fd1b871def in main /data/src/10.3/sql/main.cc:25
|
#8 0x7f8903daf2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
|
|
|
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/maria/ma_state.c:293 _ma_get_status
|
Shadow bytes around the buggy address:
|
0x0c528001b000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c528001b010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c528001b020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c528001b030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c528001b040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
=>0x0c528001b050: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd
|
0x0c528001b060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c528001b070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c528001b080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c528001b090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c528001b0a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Heap right redzone: fb
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack partial redzone: f4
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Contiguous container OOB:fc
|
ASan internal: fe
|
==28605==ABORTING
|
Couldn't reproduce on 10.4, although it doesn't necessarily mean the problem doesn't exist.
The test case is not applicable to 10.2, cannot check it.
Didn't get a failure by switching from Aria to MyISAM.
Attachments
Activity
| Field | Original Value | New Value |
|---|---|---|
| Fix Version/s | 10.4 [ 22408 ] | |
| Affects Version/s | 10.4 [ 22408 ] |
| Assignee | Michael Widenius [ monty ] | Vladislav Lesin [ vlad.lesin ] |
| Status | Open [ 1 ] | In Progress [ 3 ] |
The test can be simplified a little bit:
--let $run= 100 |
CREATE SEQUENCE s1 ENGINE=Aria;
|
|
|
while ($run) |
{
|
--connection default |
SELECT NEXTVAL(s1) UNION SELECT NEXTVAL(s1);
|
LOCK TABLE s1 READ;
|
|
|
--connect (con1,localhost,root,,test)
|
--send
|
SELECT NEXTVAL(s1) ;
|
|
|
--connect (con3,localhost,root,,test)
|
--send
|
FLUSH TABLES;
|
|
|
--disconnect con1
|
--disconnect con3
|
|
|
--connection default |
UNLOCK TABLES;
|
|
|
--dec $run
|
}
|
|
|
DROP SEQUENCE s1;
|
When "UNION" statement is executed, two instances of ha_maria are created, the instance per each SELECT in UNION. And ha_maria->file->state of the second instance points to the ha_maria->file->state_save of the first instance. The following code does this:
(gdb) l
|
373
|
374
|
375 void _ma_copy_status(void* to, void *from) |
376 { |
377 ((MARIA_HA*) to)->state= &((MARIA_HA*) from)->state_save; |
378 } |
379
|
380
|
381 void _ma_reset_update_flag(void *param, |
382 my_bool concurrent_insert __attribute__((unused))) |
(gdb) bt
|
#0 _ma_copy_status (to=0x6290000e1270, from=0x6290000e6270) at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_state.c:378 |
#1 0x0000555557c8b6ad in thr_multi_lock (data=0x62b000001b78, count=2, owner=0x62a000049d80, lock_wait_timeout=86400) at /home/unencrypted/work/git/mariadb-server/mysys/thr_lock.c:1330 |
#2 0x0000555556e97b6a in mysql_lock_tables (thd=0x62a000048270, sql_lock=0x62b000001b48, flags=0) at /home/unencrypted/work/git/mariadb-server/sql/lock.cc:347 |
#3 0x0000555556e9774a in mysql_lock_tables (thd=0x62a000048270, tables=0x62b000001b38, count=2, flags=0) at /home/unencrypted/work/git/mariadb-server/sql/lock.cc:299 |
#4 0x00005555563b27bc in lock_tables (thd=0x62a000048270, tables=0x62b000000390, count=2, flags=0) at /home/unencrypted/work/git/mariadb-server/sql/sql_base.cc:5303 |
#5 0x00005555563b0f82 in open_and_lock_tables (thd=0x62a000048270, options=..., tables=0x62b000000390, derived=true, flags=0, prelocking_strategy=0x7fffeb131170) |
at /home/unencrypted/work/git/mariadb-server/sql/sql_base.cc:5048 |
#6 0x00005555563287f6 in open_and_lock_tables (thd=0x62a000048270, tables=0x62b000000390, derived=true, flags=0) at /home/unencrypted/work/git/mariadb-server/sql/sql_base.h:513 |
#7 0x00005555565037d3 in execute_sqlcom_select (thd=0x62a000048270, all_tables=0x62b000000390) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:6476 |
#8 0x00005555564f2c83 in mysql_execute_command (thd=0x62a000048270) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:3818 |
#9 0x000055555650cb68 in mysql_parse (thd=0x62a000048270, rawbuf=0x62b000000288 "SELECT NEXTVAL(s1) UNION SELECT NEXTVAL(s1)", length=43, parser_state=0x7fffeb1329a0, is_com_multi=false, |
is_next_command=false) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:8098 |
#10 0x00005555564e7670 in dispatch_command (command=COM_QUERY, thd=0x62a000048270, packet=0x6290000cd271 "SELECT NEXTVAL(s1) UNION SELECT NEXTVAL(s1)", packet_length=43, is_com_multi=false, |
is_next_command=false) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:1858 |
#11 0x00005555564e47d4 in do_command (thd=0x62a000048270) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:1404 |
#12 0x000055555683a878 in do_handle_one_connection (connect=0x611000004bb0) at /home/unencrypted/work/git/mariadb-server/sql/sql_connect.cc:1402 |
#13 0x000055555683a255 in handle_one_connection (arg=0x611000004bb0) at /home/unencrypted/work/git/mariadb-server/sql/sql_connect.cc:1308 |
#14 0x0000555557b82845 in pfs_spawn_thread (arg=0x6160000030f0) at /home/unencrypted/work/git/mariadb-server/storage/perfschema/pfs.cc:1862 |
#15 0x00007ffff5b3f6db in start_thread (arg=0x7fffeb134300) at pthread_create.c:463 |
#16 0x00007ffff4f2988f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 |
When tables are unlocked their ha_maria->file->state are restored in _ma_update_status():
Thread 6 "mysqld" hit Breakpoint 3, _ma_update_status (param=0x6290000e6270) at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_state.c:309 |
309 MARIA_HA *info=(MARIA_HA*) param; |
(gdb) bt
|
#0 _ma_update_status (param=0x6290000e6270) at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_state.c:309 |
#1 0x00005555577ccb15 in _ma_update_status_with_lock (info=0x6290000e6270) at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_state.c:361 |
#2 0x00005555577c7dcc in maria_lock_database (info=0x6290000e6270, lock_type=2) at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_locking.c:66 |
#3 0x0000555557802ccd in ha_maria::external_lock (this=0x61d0001b1308, thd=0x62a000048270, lock_type=2) at /home/unencrypted/work/git/mariadb-server/storage/maria/ha_maria.cc:2727 |
#4 0x0000555557c06c5e in ha_sequence::external_lock (this=0x61a000029508, thd=0x62a000048270, lock_type=2) at /home/unencrypted/work/git/mariadb-server/sql/ha_sequence.cc:319 |
#5 0x0000555556bfffbf in handler::ha_external_lock (this=0x61a000029508, thd=0x62a000048270, lock_type=2) at /home/unencrypted/work/git/mariadb-server/sql/handler.cc:6345 |
#6 0x0000555556e9a9a4 in unlock_external (thd=0x62a000048270, table=0x62b000001b88, count=2) at /home/unencrypted/work/git/mariadb-server/sql/lock.cc:708 |
#7 0x0000555556e9876d in mysql_unlock_tables (thd=0x62a000048270, sql_lock=0x62b000001b48, free_lock=false) at /home/unencrypted/work/git/mariadb-server/sql/lock.cc:429 |
#8 0x0000555556e985c0 in mysql_unlock_tables (thd=0x62a000048270, sql_lock=0x62b000001b48) at /home/unencrypted/work/git/mariadb-server/sql/lock.cc:415 |
#9 0x000055555639db17 in close_thread_tables (thd=0x62a000048270) at /home/unencrypted/work/git/mariadb-server/sql/sql_base.cc:854 |
#10 0x000055555650274b in mysql_execute_command (thd=0x62a000048270) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:6376 |
#11 0x000055555650cb68 in mysql_parse (thd=0x62a000048270, rawbuf=0x62b000000288 "SELECT NEXTVAL(s1) UNION SELECT NEXTVAL(s1)", length=43, parser_state=0x7fffeb1329a0, is_com_multi=false, |
is_next_command=false) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:8098 |
#12 0x00005555564e7670 in dispatch_command (command=COM_QUERY, thd=0x62a000048270, packet=0x6290000cd271 "", packet_length=43, is_com_multi=false, is_next_command=false) |
at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:1858 |
#13 0x00005555564e47d4 in do_command (thd=0x62a000048270) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:1404 |
#14 0x000055555683a878 in do_handle_one_connection (connect=0x611000004bb0) at /home/unencrypted/work/git/mariadb-server/sql/sql_connect.cc:1402 |
#15 0x000055555683a255 in handle_one_connection (arg=0x611000004bb0) at /home/unencrypted/work/git/mariadb-server/sql/sql_connect.cc:1308 |
#16 0x0000555557b82845 in pfs_spawn_thread (arg=0x6160000030f0) at /home/unencrypted/work/git/mariadb-server/storage/perfschema/pfs.cc:1862 |
#17 0x00007ffff5b3f6db in start_thread (arg=0x7fffeb134300) at pthread_create.c:463 |
#18 0x00007ffff4f2988f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 |
But _ma_update_status() does not take into account the case when MARIA_HA::state points to the MARIA_HA::state_save of the another MARIA_HA instance, and that is why MARIA_HA::state is not restored for the second ha_maria instance. But the firs MARIA_HA instance is deallocated (see the corresponding stack trace of ASAN output in the issue description), the second MARIA_HA::state of the second instance can point to deallocated memory.
The fix is to restore MARIA_HA state in _ma_update_status() if it points not to the initial share->state.state. The fix is implemented in the following branch https://github.com/vlad-lesin/mariadb-server/tree/10.3-MDEV-18207-ma_get_status-ASAN, and it's currently under testing.
The following picture was useful to analyse the case: https://docs.google.com/presentation/d/1dHmY2NeoAgszrmSXLYHJswWUWhCTS2yOGRrejNKin_s/edit?usp=sharing.
Local testing shows two failed tests, which also fail without the fix: main.ft-debug main.func_regexp_pcre.
According to Monty's code review notes the fix described above does not look safe because of the following reasons:
1) for log tables _ma_update_status() is called for each write and this might not be correct to change info->state here
2) the code may also break if read only tables are used, as in this case ma_update_status will never be called
The correct fix is to restore the state is ha_maria::external_lock() after maria_lock_database() call. It's important to restore the MARIA_HA::state after maria_lock_database() call because share->state.state can be updated with the following stack trace:
0x00005555577cc7ea in _ma_update_status (param=0x6290000c8270) at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_state.c:334 |
334 share->state.state= *info->state; |
(gdb) bt
|
#0 0x00005555577cc7ea in _ma_update_status (param=0x6290000c8270) at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_state.c:334 |
#1 0x00005555577ccb15 in _ma_update_status_with_lock (info=0x6290000c8270) |
at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_state.c:361 |
#2 0x00005555577c7dcc in maria_lock_database (info=0x6290000c8270, lock_type=2) |
at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_locking.c:66 |
#3 0x0000555557802cc5 in ha_maria::external_lock (this=0x61d00019a108, thd=0x62a000048270, lock_type=2) |
at /home/unencrypted/work/git/mariadb-server/storage/maria/ha_maria.cc:2729 |
#4 0x0000555557c06d6a in ha_sequence::external_lock (this=0x61a000029b08, thd=0x62a000048270, lock_type=2) |
at /home/unencrypted/work/git/mariadb-server/sql/ha_sequence.cc:319 |
#5 0x0000555556bfffbf in handler::ha_external_lock (this=0x61a000029b08, thd=0x62a000048270, lock_type=2) |
at /home/unencrypted/work/git/mariadb-server/sql/handler.cc:6345 |
#6 0x0000555556e9a9a4 in unlock_external (thd=0x62a000048270, table=0x62b000002c90, count=1) |
at /home/unencrypted/work/git/mariadb-server/sql/lock.cc:708 |
#7 0x0000555556e9876d in mysql_unlock_tables (thd=0x62a000048270, sql_lock=0x62b000002c60, free_lock=false) |
at /home/unencrypted/work/git/mariadb-server/sql/lock.cc:429 |
#8 0x0000555556e985c0 in mysql_unlock_tables (thd=0x62a000048270, sql_lock=0x62b000002c60) |
at /home/unencrypted/work/git/mariadb-server/sql/lock.cc:415 |
#9 0x000055555639db17 in close_thread_tables (thd=0x62a000048270) at /home/unencrypted/work/git/mariadb-server/sql/sql_base.cc:854 |
#10 0x000055555699833b in sequence_insert (thd=0x62a000048270, lex=0x62a00004c070, org_table_list=0x62b0000004b8) |
at /home/unencrypted/work/git/mariadb-server/sql/sql_sequence.cc:363 |
#11 0x00005555566ecfb5 in mysql_create_table_no_lock (thd=0x62a000048270, db=0x62b0000004d0, table_name=0x62b0000004e0, |
create_info=0x7fffeb131f90, alter_info=0x7fffeb131cf0, is_trans=0x7fffeb131650, create_table_mode=0, table_list=0x62b0000004b8) |
at /home/unencrypted/work/git/mariadb-server/sql/sql_table.cc:5090 |
#12 0x00005555566ed853 in mysql_create_table (thd=0x62a000048270, create_table=0x62b0000004b8, create_info=0x7fffeb131f90, |
alter_info=0x7fffeb131cf0) at /home/unencrypted/work/git/mariadb-server/sql/sql_table.cc:5169 |
#13 0x00005555564f503c in mysql_execute_command (thd=0x62a000048270) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:4329 |
#14 0x000055555650cb68 in mysql_parse (thd=0x62a000048270, rawbuf=0x62b0000003d0 "CREATE SEQUENCE s1 ENGINE=Aria", length=30, |
I have updated the above branch with new fix and it's under testing now.
| Fix Version/s | 10.4.6 [ 23412 ] | |
| Fix Version/s | 10.3.16 [ 23410 ] | |
| Fix Version/s | 10.2.25 [ 23408 ] | |
| Fix Version/s | 10.3 [ 22126 ] | |
| Fix Version/s | 10.4 [ 22408 ] | |
| Resolution | Fixed [ 1 ] | |
| Status | In Progress [ 3 ] | Closed [ 6 ] |
| Workflow | MariaDB v3 [ 91634 ] | MariaDB v4 [ 155493 ] |
Similar one on 10.4 e80bcd7f64fc8ff6f46:
#0 0x55c8a7fa7ef1 in _ma_get_status /10.4/storage/maria/ma_state.c:294#1 0x55c8a8b9c305 in thr_lock /10.4/mysys/thr_lock.c:839#2 0x55c8a8b9e8cd in thr_multi_lock /10.4/mysys/thr_lock.c:1295#3 0x55c8a7d8455b in mysql_lock_tables(THD*, st_mysql_lock*, unsigned int) /10.4/sql/lock.cc:353#4 0x55c8a7d8413b in mysql_lock_tables(THD*, TABLE**, unsigned int, unsigned int) /10.4/sql/lock.cc:305#5 0x55c8a7236be5 in lock_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /10.4/sql/sql_base.cc:5406#6 0x55c8a759ea64 in simple_rename_or_index_change /10.4/sql/sql_table.cc:8932#7 0x55c8a75a0e38 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /10.4/sql/sql_table.cc:9376#8 0x55c8a76e48e4 in Sql_cmd_alter_table::execute(THD*) /10.4/sql/sql_alter.cc:499#9 0x55c8a73977cb in mysql_execute_command(THD*) /10.4/sql/sql_parse.cc:6309#10 0x55c8a73a2013 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/sql/sql_parse.cc:8120#11 0x55c8a737aca8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/sql/sql_parse.cc:1806#12 0x55c8a7377e12 in do_command(THD*) /10.4/sql/sql_parse.cc:1356#13 0x55c8a76d594f in do_handle_one_connection(CONNECT*) /10.4/sql/sql_connect.cc:1399#14 0x55c8a76d5319 in handle_one_connection /10.4/sql/sql_connect.cc:1302#15 0x7f630eb986b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)#16 0x7f630de2941c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)