[MDEV-23236] [draft] ASAN heap-use-after-free in dict_mem_table_free - Jira

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Incomplete
Affects Version/s: None
Fix Version/s: N/A
Component/s: N/A
Labels:
None

Description

bb-10.5-oalter-v2 14ef403854ba458197031
2020-07-20 18:40:27 10 [ERROR] InnoDB: Operating system error number 17 in a file operation.
2020-07-20 18:40:27 10 [ERROR] InnoDB: Error number 17 means 'File exists'
2020-07-20 18:40:27 10 [Note] InnoDB: Some operating system error numbers are described at https://mariadb.com/kb/en/library/operating-system-error-codes/
2020-07-20 18:40:27 10 [Note] InnoDB: The file './test/FTS_00000000000001ec_000000000000026c_INDEX_1.ibd' already exists though the corresponding table did not exist in the InnoDB data dictionary. You can resolve the problem by removing the file.
2020-07-20 18:40:27 10 [ERROR] InnoDB: Cannot create file './test/FTS_00000000000001ec_000000000000026c_INDEX_1.ibd'
=================================================================
==23770==ERROR: AddressSanitizer: heap-use-after-free on address 0x6190000b53c0 at pc 0x556748b0035b bp 0x7f953d9fa440 sp 0x7f953d9fa430
READ of size 8 at 0x6190000b53c0 thread T24
#0 0x556748b0035a in dict_mem_table_free(dict_table_t*) /10.5e/storage/innobase/dict/dict0mem.cc:221
#1 0x556748bc711c in fts_create_one_index_table /10.5e/storage/innobase/fts/fts0fts.cc:2004
#2 0x556748bc76c4 in fts_create_index_tables(trx_t, dict_index_t const, unsigned long) /10.5e/storage/innobase/fts/fts0fts.cc:2058
#3 0x5567484a84f3 in prepare_inplace_alter_table_dict /10.5e/storage/innobase/handler/handler0alter.cc:6989
#4 0x5567484b31fd in ha_innobase::prepare_inplace_alter_table(TABLE, Alter_inplace_info) /10.5e/storage/innobase/handler/handler0alter.cc:8162
#5 0x55674790e373 in handler::ha_prepare_inplace_alter_table(TABLE, Alter_inplace_info) /10.5e/sql/handler.cc:4836
#6 0x55674739febe in mysql_inplace_alter_table /10.5e/sql/sql_table.cc:8113
#7 0x5567473b5432 in mysql_alter_table(THD, st_mysql_const_lex_string const, st_mysql_const_lex_string const, HA_CREATE_INFO, TABLE_LIST, Alter_info, unsigned int, st_order*, bool, bool) /10.5e/sql/sql_table.cc:10968
#8 0x55674755380f in Sql_cmd_alter_table::execute(THD*) /10.5e/sql/sql_alter.cc:711
#9 0x55674711ae6d in mysql_execute_command(THD*) /10.5e/sql/sql_parse.cc:5958
#10 0x556747128c09 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /10.5e/sql/sql_parse.cc:8020
#11 0x556747c51ff1 in Query_log_event::do_apply_event(rpl_group_info, char const, unsigned int) /10.5e/sql/log_event_server.cc:1904
#12 0x556747c4f1ce in Query_log_event::do_apply_event(rpl_group_info*) /10.5e/sql/log_event_server.cc:1578
#13 0x556746ea5624 in Log_event::apply_event(rpl_group_info*) /10.5e/sql/log_event.h:1496
#14 0x556746e86c30 in apply_event_and_update_pos_apply /10.5e/sql/slave.cc:4003
#15 0x556746e87b4c in apply_event_and_update_pos_for_parallel(Log_event, THD, rpl_group_info*) /10.5e/sql/slave.cc:4193
#16 0x556747670c50 in rpt_handle_event /10.5e/sql/rpl_parallel.cc:61
#17 0x5567476783d7 in handle_rpl_parallel_thread /10.5e/sql/rpl_parallel.cc:1344
#18 0x556748203f1c in pfs_spawn_thread /10.5e/storage/perfschema/pfs.cc:2201
#19 0x7f95729436da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
#20 0x7f9571b29a3e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x121a3e)

0x6190000b53c0 is located 1088 bytes inside of 1104-byte region [0x6190000b4f80,0x6190000b53d0)
freed by thread T24 here:
#0 0x7f95747257a8 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xde7a8)
#1 0x5567484edfc9 in ut_allocator<unsigned char, true>::deallocate(unsigned char*, unsigned long) /10.5e/storage/innobase/include/ut0new.h:423
#2 0x556748624cf5 in mem_heap_block_free(mem_block_info_t, mem_block_info_t) /10.5e/storage/innobase/mem/mem0mem.cc:417
#3 0x556748afd765 in mem_heap_free /10.5e/storage/innobase/include/mem0mem.ic:417
#4 0x556748b008ae in dict_mem_table_free(dict_table_t*) /10.5e/storage/innobase/dict/dict0mem.cc:254
#5 0x556748795ea8 in row_create_table_for_mysql(dict_table_t, trx_t, fil_encryption_t, unsigned int) /10.5e/storage/innobase/row/row0mysql.cc:2459
#6 0x556748bc700c in fts_create_one_index_table /10.5e/storage/innobase/fts/fts0fts.cc:1986
#7 0x556748bc76c4 in fts_create_index_tables(trx_t, dict_index_t const, unsigned long) /10.5e/storage/innobase/fts/fts0fts.cc:2058
#8 0x5567484a84f3 in prepare_inplace_alter_table_dict /10.5e/storage/innobase/handler/handler0alter.cc:6989
#9 0x5567484b31fd in ha_innobase::prepare_inplace_alter_table(TABLE, Alter_inplace_info) /10.5e/storage/innobase/handler/handler0alter.cc:8162
#10 0x55674790e373 in handler::ha_prepare_inplace_alter_table(TABLE, Alter_inplace_info) /10.5e/sql/handler.cc:4836
#11 0x55674739febe in mysql_inplace_alter_table /10.5e/sql/sql_table.cc:8113
#12 0x5567473b5432 in mysql_alter_table(THD, st_mysql_const_lex_string const, st_mysql_const_lex_string const, HA_CREATE_INFO, TABLE_LIST, Alter_info, unsigned int, st_order*, bool, bool) /10.5e/sql/sql_table.cc:10968
#13 0x55674755380f in Sql_cmd_alter_table::execute(THD*) /10.5e/sql/sql_alter.cc:711
#14 0x55674711ae6d in mysql_execute_command(THD*) /10.5e/sql/sql_parse.cc:5958
#15 0x556747128c09 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /10.5e/sql/sql_parse.cc:8020
#16 0x556747c51ff1 in Query_log_event::do_apply_event(rpl_group_info, char const, unsigned int) /10.5e/sql/log_event_server.cc:1904
#17 0x556747c4f1ce in Query_log_event::do_apply_event(rpl_group_info*) /10.5e/sql/log_event_server.cc:1578
#18 0x556746ea5624 in Log_event::apply_event(rpl_group_info*) /10.5e/sql/log_event.h:1496
#19 0x556746e86c30 in apply_event_and_update_pos_apply /10.5e/sql/slave.cc:4003
#20 0x556746e87b4c in apply_event_and_update_pos_for_parallel(Log_event, THD, rpl_group_info*) /10.5e/sql/slave.cc:4193
#21 0x556747670c50 in rpt_handle_event /10.5e/sql/rpl_parallel.cc:61
#22 0x5567476783d7 in handle_rpl_parallel_thread /10.5e/sql/rpl_parallel.cc:1344
#23 0x556748203f1c in pfs_spawn_thread /10.5e/storage/perfschema/pfs.cc:2201
#24 0x7f95729436da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)

previously allocated by thread T24 here:
#0 0x7f9574725b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40)
#1 0x556748456f46 in ut_allocator<unsigned char, true>::allocate(unsigned long, unsigned char const*, unsigned int, bool, bool) /10.5e/storage/innobase/include/ut0new.h:374
#2 0x556748623f77 in mem_heap_create_block_func(mem_block_info_t, unsigned long, char const, unsigned int, unsigned long) /10.5e/storage/innobase/mem/mem0mem.cc:277
#3 0x5567486248ed in mem_heap_add_block(mem_block_info_t*, unsigned long) /10.5e/storage/innobase/mem/mem0mem.cc:379
#4 0x556748afd3f2 in mem_heap_alloc /10.5e/storage/innobase/include/mem0mem.ic:191
#5 0x556748afd203 in mem_heap_zalloc /10.5e/storage/innobase/include/mem0mem.ic:160
#6 0x556748aff724 in dict_mem_table_create(char const, fil_space_t, unsigned long, unsigned long, unsigned long, unsigned long) /10.5e/storage/innobase/dict/dict0mem.cc:154
#7 0x556748bc595d in fts_create_in_mem_aux_table /10.5e/storage/innobase/fts/fts0fts.cc:1713
#8 0x556748bc6dc5 in fts_create_one_index_table /10.5e/storage/innobase/fts/fts0fts.cc:1949
#9 0x556748bc76c4 in fts_create_index_tables(trx_t, dict_index_t const, unsigned long) /10.5e/storage/innobase/fts/fts0fts.cc:2058
#10 0x5567484a84f3 in prepare_inplace_alter_table_dict /10.5e/storage/innobase/handler/handler0alter.cc:6989
#11 0x5567484b31fd in ha_innobase::prepare_inplace_alter_table(TABLE, Alter_inplace_info) /10.5e/storage/innobase/handler/handler0alter.cc:8162
#12 0x55674790e373 in handler::ha_prepare_inplace_alter_table(TABLE, Alter_inplace_info) /10.5e/sql/handler.cc:4836
#13 0x55674739febe in mysql_inplace_alter_table /10.5e/sql/sql_table.cc:8113
#14 0x5567473b5432 in mysql_alter_table(THD, st_mysql_const_lex_string const, st_mysql_const_lex_string const, HA_CREATE_INFO, TABLE_LIST, Alter_info, unsigned int, st_order*, bool, bool) /10.5e/sql/sql_table.cc:10968
#15 0x55674755380f in Sql_cmd_alter_table::execute(THD*) /10.5e/sql/sql_alter.cc:711
#16 0x55674711ae6d in mysql_execute_command(THD*) /10.5e/sql/sql_parse.cc:5958
#17 0x556747128c09 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /10.5e/sql/sql_parse.cc:8020
#18 0x556747c51ff1 in Query_log_event::do_apply_event(rpl_group_info, char const, unsigned int) /10.5e/sql/log_event_server.cc:1904
#19 0x556747c4f1ce in Query_log_event::do_apply_event(rpl_group_info*) /10.5e/sql/log_event_server.cc:1578
#20 0x556746ea5624 in Log_event::apply_event(rpl_group_info*) /10.5e/sql/log_event.h:1496
#21 0x556746e86c30 in apply_event_and_update_pos_apply /10.5e/sql/slave.cc:4003
#22 0x556746e87b4c in apply_event_and_update_pos_for_parallel(Log_event, THD, rpl_group_info*) /10.5e/sql/slave.cc:4193
#23 0x556747670c50 in rpt_handle_event /10.5e/sql/rpl_parallel.cc:61
#24 0x5567476783d7 in handle_rpl_parallel_thread /10.5e/sql/rpl_parallel.cc:1344
#25 0x556748203f1c in pfs_spawn_thread /10.5e/storage/perfschema/pfs.cc:2201
#26 0x7f95729436da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)

Thread T24 created by T22 here:
#0 0x7f957467ed2f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d2f)
#1 0x5567481fec6e in my_thread_create /10.5e/storage/perfschema/my_thread.h:34
#2 0x55674820430b in pfs_spawn_thread_v1 /10.5e/storage/perfschema/pfs.cc:2252
#3 0x55674766f912 in inline_mysql_thread_create /10.5e/include/mysql/psi/mysql_thread.h:1321
#4 0x556747679e43 in rpl_parallel_change_thread_count /10.5e/sql/rpl_parallel.cc:1591
#5 0x55674767b01d in rpl_parallel_activate_pool(rpl_parallel_thread_pool*) /10.5e/sql/rpl_parallel.cc:1733
#6 0x556746e8ee89 in handle_slave_sql /10.5e/sql/slave.cc:5399
#7 0x556748203f1c in pfs_spawn_thread /10.5e/storage/perfschema/pfs.cc:2201
#8 0x7f95729436da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)

Thread T22 created by T20 here:
#0 0x7f957467ed2f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d2f)
#1 0x5567481fec6e in my_thread_create /10.5e/storage/perfschema/my_thread.h:34
#2 0x55674820430b in pfs_spawn_thread_v1 /10.5e/storage/perfschema/pfs.cc:2252
#3 0x556746e6ce4f in inline_mysql_thread_create /10.5e/include/mysql/psi/mysql_thread.h:1321
#4 0x556746e756b5 in start_slave_thread(unsigned int, void* ()(void), st_mysql_mutex, st_mysql_mutex, st_mysql_cond, unsigned int volatile, unsigned long volatile, Master_info) /10.5e/sql/slave.cc:1301
#5 0x556746e76200 in start_slave_threads(THD, bool, bool, Master_info, char const, char const, int) /10.5e/sql/slave.cc:1425
#6 0x5567471a45a4 in start_slave(THD, Master_info, bool) /10.5e/sql/sql_repl.cc:3233
#7 0x55674710e019 in mysql_execute_command(THD*) /10.5e/sql/sql_parse.cc:4247
#8 0x556747128c09 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /10.5e/sql/sql_parse.cc:8020
#9 0x5567470fef5c in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /10.5e/sql/sql_parse.cc:1874
#10 0x5567470fb786 in do_command(THD*) /10.5e/sql/sql_parse.cc:1355
#11 0x556747534b14 in do_handle_one_connection(CONNECT*, bool) /10.5e/sql/sql_connect.cc:1411
#12 0x55674753446d in handle_one_connection /10.5e/sql/sql_connect.cc:1313
#13 0x556748203f1c in pfs_spawn_thread /10.5e/storage/perfschema/pfs.cc:2201
#14 0x7f95729436da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)

Thread T20 created by T0 here:
#0 0x7f957467ed2f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d2f)
#1 0x5567481fec6e in my_thread_create /10.5e/storage/perfschema/my_thread.h:34
#2 0x55674820430b in pfs_spawn_thread_v1 /10.5e/storage/perfschema/pfs.cc:2252
#3 0x556746dfef6c in inline_mysql_thread_create /10.5e/include/mysql/psi/mysql_thread.h:1321
#4 0x556746e14766 in create_thread_to_handle_connection(CONNECT*) /10.5e/sql/mysqld.cc:6035
#5 0x556746e14dc7 in create_new_thread(CONNECT*) /10.5e/sql/mysqld.cc:6094
#6 0x556746e150ed in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.5e/sql/mysqld.cc:6159
#7 0x556746e15c1b in handle_connections_sockets() /10.5e/sql/mysqld.cc:6286
#8 0x556746e13fae in mysqld_main(int, char**) /10.5e/sql/mysqld.cc:5704
#9 0x556746dfd699 in main /10.5e/sql/main.cc:25
#10 0x7f9571a29b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

SUMMARY: AddressSanitizer: heap-use-after-free /10.5e/storage/innobase/dict/dict0mem.cc:221 in dict_mem_table_free(dict_table_t*)
Shadow bytes around the buggy address:
0x0c328000ea20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c328000ea30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c328000ea40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c328000ea50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c328000ea60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c328000ea70: fd fd fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa
0x0c328000ea80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c328000ea90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c328000eaa0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c328000eab0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c328000eac0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==23770==ABORTING

seems not related to split alter, just got it on that branch.
server was killed and restarted -> Operating system error number 17,..

on 10.5, while when disk is full I got:

2020-07-13 16:19:50 14 [ERROR] InnoDB: preallocating 65536 bytes for file ./test/FTS_00000000000000e8_0000000000000153_INDEX_4.ibd failed with error 28

2020-07-13 16:19:50 14 [Warning] InnoDB: Cannot create table `test`.`FTS_00000000000000e8_0000000000000153_INDEX_4` because tablespace full

=================================================================

==30915==ERROR: AddressSanitizer: heap-use-after-free on address 0x6190006d41d0 at pc 0x55d3c4d19c43 bp 0x7f99c5149570 sp 0x7f99c5149568

READ of size 8 at 0x6190006d41d0 thread T29

    #0 0x55d3c4d19c42 in dict_mem_table_free(dict_table_t*) /10.5/storage/innobase/dict/dict0mem.cc:230

    #1 0x55d3c4ddd168 in fts_create_one_index_table /10.5/storage/innobase/fts/fts0fts.cc:2004

    #2 0x55d3c4ddd716 in fts_create_index_tables(trx_t*, dict_index_t const*, unsigned long) /10.5/storage/innobase/fts/fts0fts.cc:2058

    #3 0x55d3c46d85bf in prepare_inplace_alter_table_dict /10.5/storage/innobase/handler/handler0alter.cc:6989

    #4 0x55d3c46e3262 in ha_innobase::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5/storage/innobase/handler/handler0alter.cc:8162

    #5 0x55d3c3b5fcfb in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5/sql/handler.cc:4819

    #6 0x55d3c35fac5a in mysql_inplace_alter_table /10.5/sql/sql_table.cc:7952

    #7 0x55d3c360dd75 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /10.5/sql/sql_table.cc:10564

    #8 0x55d3c37a3181 in Sql_cmd_alter_table::execute(THD*) /10.5/sql/sql_alter.cc:532

    #9 0x55d3c3382176 in mysql_execute_command(THD*) /10.5/sql/sql_parse.cc:5951

    #10 0x55d3c338f7a5 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/sql/sql_parse.cc:7993

    #11 0x55d3c33666be in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/sql/sql_parse.cc:1866

    #12 0x55d3c3362fd6 in do_command(THD*) /10.5/sql/sql_parse.cc:1347

    #13 0x55d3c378775c in do_handle_one_connection(CONNECT*, bool) /10.5/sql/sql_connect.cc:1411

    #14 0x55d3c37870b9 in handle_one_connection /10.5/sql/sql_connect.cc:1313

    #15 0x55d3c443dfe9 in pfs_spawn_thread /10.5/storage/perfschema/pfs.cc:2201

    #16 0x7f99f17e5fa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486

    #17 0x7f99f0dec4ce in clone (/lib/x86_64-linux-gnu/libc.so.6+0xf94ce)

0x6190006d41d0 is located 1104 bytes inside of 1120-byte region [0x6190006d3d80,0x6190006d41e0)

freed by thread T29 here:

    #0 0x7f99f18e7fb0 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe8fb0)

    #1 0x55d3c471f65f in ut_allocator<unsigned char, true>::deallocate(unsigned char*, unsigned long) /10.5/storage/innobase/include/ut0new.h:423

    #2 0x55d3c48519d3 in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /10.5/storage/innobase/mem/mem0mem.cc:416

    #3 0x55d3c4d170c0 in mem_heap_free /10.5/storage/innobase/include/mem0mem.ic:417

    #4 0x55d3c4d1a1e0 in dict_mem_table_free(dict_table_t*) /10.5/storage/innobase/dict/dict0mem.cc:265

    #5 0x55d3c49c0a4d in row_create_table_for_mysql(dict_table_t*, trx_t*, fil_encryption_t, unsigned int) /10.5/storage/innobase/row/row0mysql.cc:2436

    #6 0x55d3c4ddd058 in fts_create_one_index_table /10.5/storage/innobase/fts/fts0fts.cc:1986

    #7 0x55d3c4ddd716 in fts_create_index_tables(trx_t*, dict_index_t const*, unsigned long) /10.5/storage/innobase/fts/fts0fts.cc:2058

    #8 0x55d3c46d85bf in prepare_inplace_alter_table_dict /10.5/storage/innobase/handler/handler0alter.cc:6989

    #9 0x55d3c46e3262 in ha_innobase::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5/storage/innobase/handler/handler0alter.cc:8162

    #10 0x55d3c3b5fcfb in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5/sql/handler.cc:4819

    #11 0x55d3c35fac5a in mysql_inplace_alter_table /10.5/sql/sql_table.cc:7952

    #12 0x55d3c360dd75 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /10.5/sql/sql_table.cc:10564

    #13 0x55d3c37a3181 in Sql_cmd_alter_table::execute(THD*) /10.5/sql/sql_alter.cc:532

    #14 0x55d3c3382176 in mysql_execute_command(THD*) /10.5/sql/sql_parse.cc:5951

    #15 0x55d3c338f7a5 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/sql/sql_parse.cc:7993

    #16 0x55d3c33666be in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/sql/sql_parse.cc:1866

    #17 0x55d3c3362fd6 in do_command(THD*) /10.5/sql/sql_parse.cc:1347

    #18 0x55d3c378775c in do_handle_one_connection(CONNECT*, bool) /10.5/sql/sql_connect.cc:1411

    #19 0x55d3c37870b9 in handle_one_connection /10.5/sql/sql_connect.cc:1313

    #20 0x55d3c443dfe9 in pfs_spawn_thread /10.5/storage/perfschema/pfs.cc:2201

    #21 0x7f99f17e5fa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486

previously allocated by thread T29 here:

    #0 0x7f99f18e8330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330)

    #1 0x55d3c46859ff in ut_allocator<unsigned char, true>::allocate(unsigned long, unsigned char const*, unsigned int, bool, bool) /10.5/storage/innobase/include/ut0new.h:374

    #2 0x55d3c4850c9e in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /10.5/storage/innobase/mem/mem0mem.cc:277

    #3 0x55d3c48515ce in mem_heap_add_block(mem_block_info_t*, unsigned long) /10.5/storage/innobase/mem/mem0mem.cc:378

    #4 0x55d3c4d16d4d in mem_heap_alloc /10.5/storage/innobase/include/mem0mem.ic:191

    #5 0x55d3c4d16b5e in mem_heap_zalloc /10.5/storage/innobase/include/mem0mem.ic:160

    #6 0x55d3c4d18fa4 in dict_mem_table_create(char const*, fil_space_t*, unsigned long, unsigned long, unsigned long, unsigned long, bool) /10.5/storage/innobase/dict/dict0mem.cc:161

    #7 0x55d3c4ddb96b in fts_create_in_mem_aux_table /10.5/storage/innobase/fts/fts0fts.cc:1709

    #8 0x55d3c4ddce11 in fts_create_one_index_table /10.5/storage/innobase/fts/fts0fts.cc:1949

    #9 0x55d3c4ddd716 in fts_create_index_tables(trx_t*, dict_index_t const*, unsigned long) /10.5/storage/innobase/fts/fts0fts.cc:2058

    #10 0x55d3c46d85bf in prepare_inplace_alter_table_dict /10.5/storage/innobase/handler/handler0alter.cc:6989

    #11 0x55d3c46e3262 in ha_innobase::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5/storage/innobase/handler/handler0alter.cc:8162

    #12 0x55d3c3b5fcfb in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5/sql/handler.cc:4819

    #13 0x55d3c35fac5a in mysql_inplace_alter_table /10.5/sql/sql_table.cc:7952

    #14 0x55d3c360dd75 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /10.5/sql/sql_table.cc:10564

    #15 0x55d3c37a3181 in Sql_cmd_alter_table::execute(THD*) /10.5/sql/sql_alter.cc:532

    #16 0x55d3c3382176 in mysql_execute_command(THD*) /10.5/sql/sql_parse.cc:5951

    #17 0x55d3c338f7a5 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/sql/sql_parse.cc:7993

    #18 0x55d3c33666be in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/sql/sql_parse.cc:1866

    #19 0x55d3c3362fd6 in do_command(THD*) /10.5/sql/sql_parse.cc:1347

    #20 0x55d3c378775c in do_handle_one_connection(CONNECT*, bool) /10.5/sql/sql_connect.cc:1411

    #21 0x55d3c37870b9 in handle_one_connection /10.5/sql/sql_connect.cc:1313

    #22 0x55d3c443dfe9 in pfs_spawn_thread /10.5/storage/perfschema/pfs.cc:2201

    #23 0x7f99f17e5fa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486

Thread T29 created by T0 here:

    #0 0x7f99f184fdb0 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x50db0)

    #1 0x55d3c4438ee0 in my_thread_create /10.5/storage/perfschema/my_thread.h:34

    #2 0x55d3c443e3d8 in pfs_spawn_thread_v1 /10.5/storage/perfschema/pfs.cc:2252

    #3 0x55d3c306ef94 in inline_mysql_thread_create /10.5/include/mysql/psi/mysql_thread.h:1321

    #4 0x55d3c30845d8 in create_thread_to_handle_connection(CONNECT*) /10.5/sql/mysqld.cc:6018

    #5 0x55d3c3084c46 in create_new_thread(CONNECT*) /10.5/sql/mysqld.cc:6077

    #6 0x55d3c3084faa in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.5/sql/mysqld.cc:6142

    #7 0x55d3c3085be9 in handle_connections_sockets() /10.5/sql/mysqld.cc:6269

    #8 0x55d3c3083e3f in mysqld_main(int, char**) /10.5/sql/mysqld.cc:5664

    #9 0x55d3c306d774 in main /10.5/sql/main.cc:25

    #10 0x7f99f0d1709a in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free /10.5/storage/innobase/dict/dict0mem.cc:230 in dict_mem_table_free(dict_table_t*)

Shadow bytes around the buggy address:

  0x0c32800d27e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c32800d27f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c32800d2800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c32800d2810: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c32800d2820: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c32800d2830: fd fd fd fd fd fd fd fd fd fd[fd]fd fa fa fa fa

  0x0c32800d2840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c32800d2850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c32800d2860: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c32800d2870: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c32800d2880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==30915==ABORTING

2020-07-13 16:19:50 15 [ERROR] InnoDB: preallocating 98304 bytes for file ./test/FTS_000000000000006c_DELETED_CACHE.ibd failed with error 28

2020-07-13 16:19:50 15 [Warning] InnoDB: Failed to create FTS common table test/FTS_000000000000006c_DELETED_CACHE

=================================================================

==30575==ERROR: AddressSanitizer: heap-use-after-free on address 0x619000218562 at pc 0x5606ff60a804 bp 0x7f1915d17b80 sp 0x7f1915d17b78

READ of size 1 at 0x619000218562 thread T24

    #0 0x5606ff60a803 in dict_table_check_if_in_cache_low /10.5/storage/innobase/include/dict0priv.ic:87

    #1 0x5606ff60f363 in dict_table_open_on_name(char const*, unsigned long, unsigned long, dict_err_ignore_t) /10.5/storage/innobase/dict/dict0dict.cc:1094

    #2 0x5606ff303941 in row_drop_table_for_mysql(char const*, trx_t*, enum_sql_command, bool, bool) /10.5/storage/innobase/row/row0mysql.cc:3361

    #3 0x5606ff719fa3 in fts_create_one_common_table /10.5/storage/innobase/fts/fts0fts.cc:1798

    #4 0x5606ff71a537 in fts_create_common_tables(trx_t*, dict_table_t*, bool) /10.5/storage/innobase/fts/fts0fts.cc:1858

    #5 0x5606fef89dcd in create_table_info_t::create_table(bool) /10.5/storage/innobase/handler/ha_innodb.cc:12673

    #6 0x5606fefc0c3c in ha_innobase::create(char const*, TABLE*, HA_CREATE_INFO*, bool, trx_t*) (/10.5/sql/mariadbd+0x2de4c3c)

    #7 0x5606fef8bf93 in ha_innobase::create(char const*, TABLE*, HA_CREATE_INFO*) /10.5/storage/innobase/handler/ha_innodb.cc:13202

    #8 0x5606fe49f5fd in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /10.5/sql/handler.cc:5072

    #9 0x5606fe4a3c70 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /10.5/sql/handler.cc:5536

    #10 0x5606fdf4c411 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /10.5/sql/sql_table.cc:10625

    #11 0x5606fe0e1181 in Sql_cmd_alter_table::execute(THD*) /10.5/sql/sql_alter.cc:532

    #12 0x5606fdcc0176 in mysql_execute_command(THD*) /10.5/sql/sql_parse.cc:5951

    #13 0x5606fdccd7a5 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/sql/sql_parse.cc:7993

    #14 0x5606fdca46be in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/sql/sql_parse.cc:1866

    #15 0x5606fdca0fd6 in do_command(THD*) /10.5/sql/sql_parse.cc:1347

    #16 0x5606fe0c575c in do_handle_one_connection(CONNECT*, bool) /10.5/sql/sql_connect.cc:1411

    #17 0x5606fe0c50b9 in handle_one_connection /10.5/sql/sql_connect.cc:1313

    #18 0x5606fed7bfe9 in pfs_spawn_thread /10.5/storage/perfschema/pfs.cc:2201

    #19 0x7f193a6f5fa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486

    #20 0x7f1939cfc4ce in clone (/lib/x86_64-linux-gnu/libc.so.6+0xf94ce)

0x619000218562 is located 226 bytes inside of 1120-byte region [0x619000218480,0x6190002188e0)

freed by thread T24 here:

    #0 0x7f193a7f7fb0 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe8fb0)

    #1 0x5606ff05d65f in ut_allocator<unsigned char, true>::deallocate(unsigned char*, unsigned long) /10.5/storage/innobase/include/ut0new.h:423

    #2 0x5606ff18f9d3 in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /10.5/storage/innobase/mem/mem0mem.cc:416

    #3 0x5606ff6550c0 in mem_heap_free /10.5/storage/innobase/include/mem0mem.ic:417

    #4 0x5606ff6581e0 in dict_mem_table_free(dict_table_t*) /10.5/storage/innobase/dict/dict0mem.cc:265

    #5 0x5606ff719e43 in fts_create_one_common_table /10.5/storage/innobase/fts/fts0fts.cc:1793

    #6 0x5606ff71a537 in fts_create_common_tables(trx_t*, dict_table_t*, bool) /10.5/storage/innobase/fts/fts0fts.cc:1858

    #7 0x5606fef89dcd in create_table_info_t::create_table(bool) /10.5/storage/innobase/handler/ha_innodb.cc:12673

    #8 0x5606fefc0c3c in ha_innobase::create(char const*, TABLE*, HA_CREATE_INFO*, bool, trx_t*) (/10.5/sql/mariadbd+0x2de4c3c)

    #9 0x5606fef8bf93 in ha_innobase::create(char const*, TABLE*, HA_CREATE_INFO*) /10.5/storage/innobase/handler/ha_innodb.cc:13202

    #10 0x5606fe49f5fd in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /10.5/sql/handler.cc:5072

    #11 0x5606fe4a3c70 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /10.5/sql/handler.cc:5536

    #12 0x5606fdf4c411 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /10.5/sql/sql_table.cc:10625

    #13 0x5606fe0e1181 in Sql_cmd_alter_table::execute(THD*) /10.5/sql/sql_alter.cc:532

    #14 0x5606fdcc0176 in mysql_execute_command(THD*) /10.5/sql/sql_parse.cc:5951

    #15 0x5606fdccd7a5 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/sql/sql_parse.cc:7993

    #16 0x5606fdca46be in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/sql/sql_parse.cc:1866

    #17 0x5606fdca0fd6 in do_command(THD*) /10.5/sql/sql_parse.cc:1347

    #18 0x5606fe0c575c in do_handle_one_connection(CONNECT*, bool) /10.5/sql/sql_connect.cc:1411

    #19 0x5606fe0c50b9 in handle_one_connection /10.5/sql/sql_connect.cc:1313

    #20 0x5606fed7bfe9 in pfs_spawn_thread /10.5/storage/perfschema/pfs.cc:2201

    #21 0x7f193a6f5fa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486

previously allocated by thread T24 here:

    #0 0x7f193a7f8330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330)

    #1 0x5606fefc39ff in ut_allocator<unsigned char, true>::allocate(unsigned long, unsigned char const*, unsigned int, bool, bool) /10.5/storage/innobase/include/ut0new.h:374

    #2 0x5606ff18ec9e in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /10.5/storage/innobase/mem/mem0mem.cc:277

    #3 0x5606ff18f5ce in mem_heap_add_block(mem_block_info_t*, unsigned long) /10.5/storage/innobase/mem/mem0mem.cc:378

    #4 0x5606ff654d4d in mem_heap_alloc /10.5/storage/innobase/include/mem0mem.ic:191

    #5 0x5606ff654b5e in mem_heap_zalloc /10.5/storage/innobase/include/mem0mem.ic:160

    #6 0x5606ff656fa4 in dict_mem_table_create(char const*, fil_space_t*, unsigned long, unsigned long, unsigned long, unsigned long, bool) /10.5/storage/innobase/dict/dict0mem.cc:161

    #7 0x5606ff71996b in fts_create_in_mem_aux_table /10.5/storage/innobase/fts/fts0fts.cc:1709

    #8 0x5606ff719c2e in fts_create_one_common_table /10.5/storage/innobase/fts/fts0fts.cc:1746

    #9 0x5606ff71a537 in fts_create_common_tables(trx_t*, dict_table_t*, bool) /10.5/storage/innobase/fts/fts0fts.cc:1858

    #10 0x5606fef89dcd in create_table_info_t::create_table(bool) /10.5/storage/innobase/handler/ha_innodb.cc:12673

    #11 0x5606fefc0c3c in ha_innobase::create(char const*, TABLE*, HA_CREATE_INFO*, bool, trx_t*) (/10.5/sql/mariadbd+0x2de4c3c)

    #12 0x5606fef8bf93 in ha_innobase::create(char const*, TABLE*, HA_CREATE_INFO*) /10.5/storage/innobase/handler/ha_innodb.cc:13202

    #13 0x5606fe49f5fd in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /10.5/sql/handler.cc:5072

    #14 0x5606fe4a3c70 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /10.5/sql/handler.cc:5536

    #15 0x5606fdf4c411 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /10.5/sql/sql_table.cc:10625

    #16 0x5606fe0e1181 in Sql_cmd_alter_table::execute(THD*) /10.5/sql/sql_alter.cc:532

    #17 0x5606fdcc0176 in mysql_execute_command(THD*) /10.5/sql/sql_parse.cc:5951

    #18 0x5606fdccd7a5 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/sql/sql_parse.cc:7993

    #19 0x5606fdca46be in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/sql/sql_parse.cc:1866

    #20 0x5606fdca0fd6 in do_command(THD*) /10.5/sql/sql_parse.cc:1347

    #21 0x5606fe0c575c in do_handle_one_connection(CONNECT*, bool) /10.5/sql/sql_connect.cc:1411

    #22 0x5606fe0c50b9 in handle_one_connection /10.5/sql/sql_connect.cc:1313

    #23 0x5606fed7bfe9 in pfs_spawn_thread /10.5/storage/perfschema/pfs.cc:2201

    #24 0x7f193a6f5fa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486

Thread T24 created by T0 here:

    #0 0x7f193a75fdb0 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x50db0)

    #1 0x5606fed76ee0 in my_thread_create /10.5/storage/perfschema/my_thread.h:34

    #2 0x5606fed7c3d8 in pfs_spawn_thread_v1 /10.5/storage/perfschema/pfs.cc:2252

    #3 0x5606fd9acf94 in inline_mysql_thread_create /10.5/include/mysql/psi/mysql_thread.h:1321

    #4 0x5606fd9c25d8 in create_thread_to_handle_connection(CONNECT*) /10.5/sql/mysqld.cc:6018

    #5 0x5606fd9c2c46 in create_new_thread(CONNECT*) /10.5/sql/mysqld.cc:6077

    #6 0x5606fd9c2faa in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.5/sql/mysqld.cc:6142

    #7 0x5606fd9c3be9 in handle_connections_sockets() /10.5/sql/mysqld.cc:6269

    #8 0x5606fd9c1e3f in mysqld_main(int, char**) /10.5/sql/mysqld.cc:5664

    #9 0x5606fd9ab774 in main /10.5/sql/main.cc:25

    #10 0x7f1939c2709a in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free /10.5/storage/innobase/include/dict0priv.ic:87 in dict_table_check_if_in_cache_low

Shadow bytes around the buggy address:

  0x0c328003b050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c328003b060: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c328003b070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c328003b080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa

  0x0c328003b090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

=>0x0c328003b0a0: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd

  0x0c328003b0b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c328003b0c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c328003b0d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c328003b0e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

  0x0c328003b0f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==30575==ABORTING

Attachments

- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List
- Download All

MDEV-23236.7z
3.64 MB
2020-07-22 15:28

Issue Links

relates to

MDEV-23134 SEGV in dict_load_table_one during restart after server crash

Closed

MDEV-25070 SIGSEGV in fts_create_in_mem_aux_table

Closed

Activity

People

Assignee:: Alice Sherepa

Reporter:: Alice Sherepa

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Dates

Created:: 2020-07-20 16:46

Updated:: 2022-04-07 07:30

Resolved:: 2022-04-07 07:30

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.