Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-23236

[draft] ASAN heap-use-after-free in dict_mem_table_free

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Major
    • Resolution: Incomplete
    • Affects Version/s: None
    • Fix Version/s: N/A
    • Component/s: N/A
    • Labels:
      None

      Description

      bb-10.5-oalter-v2 14ef403854ba458197031

      2020-07-20 18:40:27 10 [ERROR] InnoDB: Operating system error number 17 in a file operation.
      2020-07-20 18:40:27 10 [ERROR] InnoDB: Error number 17 means 'File exists'
      2020-07-20 18:40:27 10 [Note] InnoDB: Some operating system error numbers are described at https://mariadb.com/kb/en/library/operating-system-error-codes/
      2020-07-20 18:40:27 10 [Note] InnoDB: The file './test/FTS_00000000000001ec_000000000000026c_INDEX_1.ibd' already exists though the corresponding table did not exist in the InnoDB data dictionary. You can resolve the problem by removing the file.
      2020-07-20 18:40:27 10 [ERROR] InnoDB: Cannot create file './test/FTS_00000000000001ec_000000000000026c_INDEX_1.ibd'
      =================================================================
      ==23770==ERROR: AddressSanitizer: heap-use-after-free on address 0x6190000b53c0 at pc 0x556748b0035b bp 0x7f953d9fa440 sp 0x7f953d9fa430
      READ of size 8 at 0x6190000b53c0 thread T24
          #0 0x556748b0035a in dict_mem_table_free(dict_table_t*) /10.5e/storage/innobase/dict/dict0mem.cc:221
          #1 0x556748bc711c in fts_create_one_index_table /10.5e/storage/innobase/fts/fts0fts.cc:2004
          #2 0x556748bc76c4 in fts_create_index_tables(trx_t*, dict_index_t const*, unsigned long) /10.5e/storage/innobase/fts/fts0fts.cc:2058
          #3 0x5567484a84f3 in prepare_inplace_alter_table_dict /10.5e/storage/innobase/handler/handler0alter.cc:6989
          #4 0x5567484b31fd in ha_innobase::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5e/storage/innobase/handler/handler0alter.cc:8162
          #5 0x55674790e373 in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5e/sql/handler.cc:4836
          #6 0x55674739febe in mysql_inplace_alter_table /10.5e/sql/sql_table.cc:8113
          #7 0x5567473b5432 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /10.5e/sql/sql_table.cc:10968
          #8 0x55674755380f in Sql_cmd_alter_table::execute(THD*) /10.5e/sql/sql_alter.cc:711
          #9 0x55674711ae6d in mysql_execute_command(THD*) /10.5e/sql/sql_parse.cc:5958
          #10 0x556747128c09 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5e/sql/sql_parse.cc:8020
          #11 0x556747c51ff1 in Query_log_event::do_apply_event(rpl_group_info*, char const*, unsigned int) /10.5e/sql/log_event_server.cc:1904
          #12 0x556747c4f1ce in Query_log_event::do_apply_event(rpl_group_info*) /10.5e/sql/log_event_server.cc:1578
          #13 0x556746ea5624 in Log_event::apply_event(rpl_group_info*) /10.5e/sql/log_event.h:1496
          #14 0x556746e86c30 in apply_event_and_update_pos_apply /10.5e/sql/slave.cc:4003
          #15 0x556746e87b4c in apply_event_and_update_pos_for_parallel(Log_event*, THD*, rpl_group_info*) /10.5e/sql/slave.cc:4193
          #16 0x556747670c50 in rpt_handle_event /10.5e/sql/rpl_parallel.cc:61
          #17 0x5567476783d7 in handle_rpl_parallel_thread /10.5e/sql/rpl_parallel.cc:1344
          #18 0x556748203f1c in pfs_spawn_thread /10.5e/storage/perfschema/pfs.cc:2201
          #19 0x7f95729436da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
          #20 0x7f9571b29a3e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x121a3e)
       
      0x6190000b53c0 is located 1088 bytes inside of 1104-byte region [0x6190000b4f80,0x6190000b53d0)
      freed by thread T24 here:
          #0 0x7f95747257a8 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xde7a8)
          #1 0x5567484edfc9 in ut_allocator<unsigned char, true>::deallocate(unsigned char*, unsigned long) /10.5e/storage/innobase/include/ut0new.h:423
          #2 0x556748624cf5 in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /10.5e/storage/innobase/mem/mem0mem.cc:417
          #3 0x556748afd765 in mem_heap_free /10.5e/storage/innobase/include/mem0mem.ic:417
          #4 0x556748b008ae in dict_mem_table_free(dict_table_t*) /10.5e/storage/innobase/dict/dict0mem.cc:254
          #5 0x556748795ea8 in row_create_table_for_mysql(dict_table_t*, trx_t*, fil_encryption_t, unsigned int) /10.5e/storage/innobase/row/row0mysql.cc:2459
          #6 0x556748bc700c in fts_create_one_index_table /10.5e/storage/innobase/fts/fts0fts.cc:1986
          #7 0x556748bc76c4 in fts_create_index_tables(trx_t*, dict_index_t const*, unsigned long) /10.5e/storage/innobase/fts/fts0fts.cc:2058
          #8 0x5567484a84f3 in prepare_inplace_alter_table_dict /10.5e/storage/innobase/handler/handler0alter.cc:6989
          #9 0x5567484b31fd in ha_innobase::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5e/storage/innobase/handler/handler0alter.cc:8162
          #10 0x55674790e373 in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5e/sql/handler.cc:4836
          #11 0x55674739febe in mysql_inplace_alter_table /10.5e/sql/sql_table.cc:8113
          #12 0x5567473b5432 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /10.5e/sql/sql_table.cc:10968
          #13 0x55674755380f in Sql_cmd_alter_table::execute(THD*) /10.5e/sql/sql_alter.cc:711
          #14 0x55674711ae6d in mysql_execute_command(THD*) /10.5e/sql/sql_parse.cc:5958
          #15 0x556747128c09 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5e/sql/sql_parse.cc:8020
          #16 0x556747c51ff1 in Query_log_event::do_apply_event(rpl_group_info*, char const*, unsigned int) /10.5e/sql/log_event_server.cc:1904
          #17 0x556747c4f1ce in Query_log_event::do_apply_event(rpl_group_info*) /10.5e/sql/log_event_server.cc:1578
          #18 0x556746ea5624 in Log_event::apply_event(rpl_group_info*) /10.5e/sql/log_event.h:1496
          #19 0x556746e86c30 in apply_event_and_update_pos_apply /10.5e/sql/slave.cc:4003
          #20 0x556746e87b4c in apply_event_and_update_pos_for_parallel(Log_event*, THD*, rpl_group_info*) /10.5e/sql/slave.cc:4193
          #21 0x556747670c50 in rpt_handle_event /10.5e/sql/rpl_parallel.cc:61
          #22 0x5567476783d7 in handle_rpl_parallel_thread /10.5e/sql/rpl_parallel.cc:1344
          #23 0x556748203f1c in pfs_spawn_thread /10.5e/storage/perfschema/pfs.cc:2201
          #24 0x7f95729436da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
       
      previously allocated by thread T24 here:
          #0 0x7f9574725b40 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40)
          #1 0x556748456f46 in ut_allocator<unsigned char, true>::allocate(unsigned long, unsigned char const*, unsigned int, bool, bool) /10.5e/storage/innobase/include/ut0new.h:374
          #2 0x556748623f77 in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /10.5e/storage/innobase/mem/mem0mem.cc:277
          #3 0x5567486248ed in mem_heap_add_block(mem_block_info_t*, unsigned long) /10.5e/storage/innobase/mem/mem0mem.cc:379
          #4 0x556748afd3f2 in mem_heap_alloc /10.5e/storage/innobase/include/mem0mem.ic:191
          #5 0x556748afd203 in mem_heap_zalloc /10.5e/storage/innobase/include/mem0mem.ic:160
          #6 0x556748aff724 in dict_mem_table_create(char const*, fil_space_t*, unsigned long, unsigned long, unsigned long, unsigned long) /10.5e/storage/innobase/dict/dict0mem.cc:154
          #7 0x556748bc595d in fts_create_in_mem_aux_table /10.5e/storage/innobase/fts/fts0fts.cc:1713
          #8 0x556748bc6dc5 in fts_create_one_index_table /10.5e/storage/innobase/fts/fts0fts.cc:1949
          #9 0x556748bc76c4 in fts_create_index_tables(trx_t*, dict_index_t const*, unsigned long) /10.5e/storage/innobase/fts/fts0fts.cc:2058
          #10 0x5567484a84f3 in prepare_inplace_alter_table_dict /10.5e/storage/innobase/handler/handler0alter.cc:6989
          #11 0x5567484b31fd in ha_innobase::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5e/storage/innobase/handler/handler0alter.cc:8162
          #12 0x55674790e373 in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5e/sql/handler.cc:4836
          #13 0x55674739febe in mysql_inplace_alter_table /10.5e/sql/sql_table.cc:8113
          #14 0x5567473b5432 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /10.5e/sql/sql_table.cc:10968
          #15 0x55674755380f in Sql_cmd_alter_table::execute(THD*) /10.5e/sql/sql_alter.cc:711
          #16 0x55674711ae6d in mysql_execute_command(THD*) /10.5e/sql/sql_parse.cc:5958
          #17 0x556747128c09 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5e/sql/sql_parse.cc:8020
          #18 0x556747c51ff1 in Query_log_event::do_apply_event(rpl_group_info*, char const*, unsigned int) /10.5e/sql/log_event_server.cc:1904
          #19 0x556747c4f1ce in Query_log_event::do_apply_event(rpl_group_info*) /10.5e/sql/log_event_server.cc:1578
          #20 0x556746ea5624 in Log_event::apply_event(rpl_group_info*) /10.5e/sql/log_event.h:1496
          #21 0x556746e86c30 in apply_event_and_update_pos_apply /10.5e/sql/slave.cc:4003
          #22 0x556746e87b4c in apply_event_and_update_pos_for_parallel(Log_event*, THD*, rpl_group_info*) /10.5e/sql/slave.cc:4193
          #23 0x556747670c50 in rpt_handle_event /10.5e/sql/rpl_parallel.cc:61
          #24 0x5567476783d7 in handle_rpl_parallel_thread /10.5e/sql/rpl_parallel.cc:1344
          #25 0x556748203f1c in pfs_spawn_thread /10.5e/storage/perfschema/pfs.cc:2201
          #26 0x7f95729436da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
       
      Thread T24 created by T22 here:
          #0 0x7f957467ed2f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d2f)
          #1 0x5567481fec6e in my_thread_create /10.5e/storage/perfschema/my_thread.h:34
          #2 0x55674820430b in pfs_spawn_thread_v1 /10.5e/storage/perfschema/pfs.cc:2252
          #3 0x55674766f912 in inline_mysql_thread_create /10.5e/include/mysql/psi/mysql_thread.h:1321
          #4 0x556747679e43 in rpl_parallel_change_thread_count /10.5e/sql/rpl_parallel.cc:1591
          #5 0x55674767b01d in rpl_parallel_activate_pool(rpl_parallel_thread_pool*) /10.5e/sql/rpl_parallel.cc:1733
          #6 0x556746e8ee89 in handle_slave_sql /10.5e/sql/slave.cc:5399
          #7 0x556748203f1c in pfs_spawn_thread /10.5e/storage/perfschema/pfs.cc:2201
          #8 0x7f95729436da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
       
      Thread T22 created by T20 here:
          #0 0x7f957467ed2f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d2f)
          #1 0x5567481fec6e in my_thread_create /10.5e/storage/perfschema/my_thread.h:34
          #2 0x55674820430b in pfs_spawn_thread_v1 /10.5e/storage/perfschema/pfs.cc:2252
          #3 0x556746e6ce4f in inline_mysql_thread_create /10.5e/include/mysql/psi/mysql_thread.h:1321
          #4 0x556746e756b5 in start_slave_thread(unsigned int, void* (*)(void*), st_mysql_mutex*, st_mysql_mutex*, st_mysql_cond*, unsigned int volatile*, unsigned long volatile*, Master_info*) /10.5e/sql/slave.cc:1301
          #5 0x556746e76200 in start_slave_threads(THD*, bool, bool, Master_info*, char const*, char const*, int) /10.5e/sql/slave.cc:1425
          #6 0x5567471a45a4 in start_slave(THD*, Master_info*, bool) /10.5e/sql/sql_repl.cc:3233
          #7 0x55674710e019 in mysql_execute_command(THD*) /10.5e/sql/sql_parse.cc:4247
          #8 0x556747128c09 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5e/sql/sql_parse.cc:8020
          #9 0x5567470fef5c in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5e/sql/sql_parse.cc:1874
          #10 0x5567470fb786 in do_command(THD*) /10.5e/sql/sql_parse.cc:1355
          #11 0x556747534b14 in do_handle_one_connection(CONNECT*, bool) /10.5e/sql/sql_connect.cc:1411
          #12 0x55674753446d in handle_one_connection /10.5e/sql/sql_connect.cc:1313
          #13 0x556748203f1c in pfs_spawn_thread /10.5e/storage/perfschema/pfs.cc:2201
          #14 0x7f95729436da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
       
      Thread T20 created by T0 here:
          #0 0x7f957467ed2f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d2f)
          #1 0x5567481fec6e in my_thread_create /10.5e/storage/perfschema/my_thread.h:34
          #2 0x55674820430b in pfs_spawn_thread_v1 /10.5e/storage/perfschema/pfs.cc:2252
          #3 0x556746dfef6c in inline_mysql_thread_create /10.5e/include/mysql/psi/mysql_thread.h:1321
          #4 0x556746e14766 in create_thread_to_handle_connection(CONNECT*) /10.5e/sql/mysqld.cc:6035
          #5 0x556746e14dc7 in create_new_thread(CONNECT*) /10.5e/sql/mysqld.cc:6094
          #6 0x556746e150ed in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.5e/sql/mysqld.cc:6159
          #7 0x556746e15c1b in handle_connections_sockets() /10.5e/sql/mysqld.cc:6286
          #8 0x556746e13fae in mysqld_main(int, char**) /10.5e/sql/mysqld.cc:5704
          #9 0x556746dfd699 in main /10.5e/sql/main.cc:25
          #10 0x7f9571a29b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
       
      SUMMARY: AddressSanitizer: heap-use-after-free /10.5e/storage/innobase/dict/dict0mem.cc:221 in dict_mem_table_free(dict_table_t*)
      Shadow bytes around the buggy address:
        0x0c328000ea20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328000ea30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328000ea40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328000ea50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328000ea60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      =>0x0c328000ea70: fd fd fd fd fd fd fd fd[fd]fd fa fa fa fa fa fa
        0x0c328000ea80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c328000ea90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328000eaa0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328000eab0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328000eac0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
      ==23770==ABORTING
      

      seems not related to split alter, just got it on that branch.
      server was killed and restarted -> Operating system error number 17,..

      on 10.5, while when disk is full I got:

      2020-07-13 16:19:50 14 [ERROR] InnoDB: preallocating 65536 bytes for file ./test/FTS_00000000000000e8_0000000000000153_INDEX_4.ibd failed with error 28
      2020-07-13 16:19:50 14 [Warning] InnoDB: Cannot create table `test`.`FTS_00000000000000e8_0000000000000153_INDEX_4` because tablespace full
      =================================================================
      ==30915==ERROR: AddressSanitizer: heap-use-after-free on address 0x6190006d41d0 at pc 0x55d3c4d19c43 bp 0x7f99c5149570 sp 0x7f99c5149568
      READ of size 8 at 0x6190006d41d0 thread T29
          #0 0x55d3c4d19c42 in dict_mem_table_free(dict_table_t*) /10.5/storage/innobase/dict/dict0mem.cc:230
          #1 0x55d3c4ddd168 in fts_create_one_index_table /10.5/storage/innobase/fts/fts0fts.cc:2004
          #2 0x55d3c4ddd716 in fts_create_index_tables(trx_t*, dict_index_t const*, unsigned long) /10.5/storage/innobase/fts/fts0fts.cc:2058
          #3 0x55d3c46d85bf in prepare_inplace_alter_table_dict /10.5/storage/innobase/handler/handler0alter.cc:6989
          #4 0x55d3c46e3262 in ha_innobase::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5/storage/innobase/handler/handler0alter.cc:8162
          #5 0x55d3c3b5fcfb in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5/sql/handler.cc:4819
          #6 0x55d3c35fac5a in mysql_inplace_alter_table /10.5/sql/sql_table.cc:7952
          #7 0x55d3c360dd75 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /10.5/sql/sql_table.cc:10564
          #8 0x55d3c37a3181 in Sql_cmd_alter_table::execute(THD*) /10.5/sql/sql_alter.cc:532
          #9 0x55d3c3382176 in mysql_execute_command(THD*) /10.5/sql/sql_parse.cc:5951
          #10 0x55d3c338f7a5 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/sql/sql_parse.cc:7993
          #11 0x55d3c33666be in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/sql/sql_parse.cc:1866
          #12 0x55d3c3362fd6 in do_command(THD*) /10.5/sql/sql_parse.cc:1347
          #13 0x55d3c378775c in do_handle_one_connection(CONNECT*, bool) /10.5/sql/sql_connect.cc:1411
          #14 0x55d3c37870b9 in handle_one_connection /10.5/sql/sql_connect.cc:1313
          #15 0x55d3c443dfe9 in pfs_spawn_thread /10.5/storage/perfschema/pfs.cc:2201
          #16 0x7f99f17e5fa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486
          #17 0x7f99f0dec4ce in clone (/lib/x86_64-linux-gnu/libc.so.6+0xf94ce)
       
      0x6190006d41d0 is located 1104 bytes inside of 1120-byte region [0x6190006d3d80,0x6190006d41e0)
      freed by thread T29 here:
          #0 0x7f99f18e7fb0 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe8fb0)
          #1 0x55d3c471f65f in ut_allocator<unsigned char, true>::deallocate(unsigned char*, unsigned long) /10.5/storage/innobase/include/ut0new.h:423
          #2 0x55d3c48519d3 in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /10.5/storage/innobase/mem/mem0mem.cc:416
          #3 0x55d3c4d170c0 in mem_heap_free /10.5/storage/innobase/include/mem0mem.ic:417
          #4 0x55d3c4d1a1e0 in dict_mem_table_free(dict_table_t*) /10.5/storage/innobase/dict/dict0mem.cc:265
          #5 0x55d3c49c0a4d in row_create_table_for_mysql(dict_table_t*, trx_t*, fil_encryption_t, unsigned int) /10.5/storage/innobase/row/row0mysql.cc:2436
          #6 0x55d3c4ddd058 in fts_create_one_index_table /10.5/storage/innobase/fts/fts0fts.cc:1986
          #7 0x55d3c4ddd716 in fts_create_index_tables(trx_t*, dict_index_t const*, unsigned long) /10.5/storage/innobase/fts/fts0fts.cc:2058
          #8 0x55d3c46d85bf in prepare_inplace_alter_table_dict /10.5/storage/innobase/handler/handler0alter.cc:6989
          #9 0x55d3c46e3262 in ha_innobase::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5/storage/innobase/handler/handler0alter.cc:8162
          #10 0x55d3c3b5fcfb in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5/sql/handler.cc:4819
          #11 0x55d3c35fac5a in mysql_inplace_alter_table /10.5/sql/sql_table.cc:7952
          #12 0x55d3c360dd75 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /10.5/sql/sql_table.cc:10564
          #13 0x55d3c37a3181 in Sql_cmd_alter_table::execute(THD*) /10.5/sql/sql_alter.cc:532
          #14 0x55d3c3382176 in mysql_execute_command(THD*) /10.5/sql/sql_parse.cc:5951
          #15 0x55d3c338f7a5 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/sql/sql_parse.cc:7993
          #16 0x55d3c33666be in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/sql/sql_parse.cc:1866
          #17 0x55d3c3362fd6 in do_command(THD*) /10.5/sql/sql_parse.cc:1347
          #18 0x55d3c378775c in do_handle_one_connection(CONNECT*, bool) /10.5/sql/sql_connect.cc:1411
          #19 0x55d3c37870b9 in handle_one_connection /10.5/sql/sql_connect.cc:1313
          #20 0x55d3c443dfe9 in pfs_spawn_thread /10.5/storage/perfschema/pfs.cc:2201
          #21 0x7f99f17e5fa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486
       
      previously allocated by thread T29 here:
          #0 0x7f99f18e8330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330)
          #1 0x55d3c46859ff in ut_allocator<unsigned char, true>::allocate(unsigned long, unsigned char const*, unsigned int, bool, bool) /10.5/storage/innobase/include/ut0new.h:374
          #2 0x55d3c4850c9e in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /10.5/storage/innobase/mem/mem0mem.cc:277
          #3 0x55d3c48515ce in mem_heap_add_block(mem_block_info_t*, unsigned long) /10.5/storage/innobase/mem/mem0mem.cc:378
          #4 0x55d3c4d16d4d in mem_heap_alloc /10.5/storage/innobase/include/mem0mem.ic:191
          #5 0x55d3c4d16b5e in mem_heap_zalloc /10.5/storage/innobase/include/mem0mem.ic:160
          #6 0x55d3c4d18fa4 in dict_mem_table_create(char const*, fil_space_t*, unsigned long, unsigned long, unsigned long, unsigned long, bool) /10.5/storage/innobase/dict/dict0mem.cc:161
          #7 0x55d3c4ddb96b in fts_create_in_mem_aux_table /10.5/storage/innobase/fts/fts0fts.cc:1709
          #8 0x55d3c4ddce11 in fts_create_one_index_table /10.5/storage/innobase/fts/fts0fts.cc:1949
          #9 0x55d3c4ddd716 in fts_create_index_tables(trx_t*, dict_index_t const*, unsigned long) /10.5/storage/innobase/fts/fts0fts.cc:2058
          #10 0x55d3c46d85bf in prepare_inplace_alter_table_dict /10.5/storage/innobase/handler/handler0alter.cc:6989
          #11 0x55d3c46e3262 in ha_innobase::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5/storage/innobase/handler/handler0alter.cc:8162
          #12 0x55d3c3b5fcfb in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.5/sql/handler.cc:4819
          #13 0x55d3c35fac5a in mysql_inplace_alter_table /10.5/sql/sql_table.cc:7952
          #14 0x55d3c360dd75 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /10.5/sql/sql_table.cc:10564
          #15 0x55d3c37a3181 in Sql_cmd_alter_table::execute(THD*) /10.5/sql/sql_alter.cc:532
          #16 0x55d3c3382176 in mysql_execute_command(THD*) /10.5/sql/sql_parse.cc:5951
          #17 0x55d3c338f7a5 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/sql/sql_parse.cc:7993
          #18 0x55d3c33666be in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/sql/sql_parse.cc:1866
          #19 0x55d3c3362fd6 in do_command(THD*) /10.5/sql/sql_parse.cc:1347
          #20 0x55d3c378775c in do_handle_one_connection(CONNECT*, bool) /10.5/sql/sql_connect.cc:1411
          #21 0x55d3c37870b9 in handle_one_connection /10.5/sql/sql_connect.cc:1313
          #22 0x55d3c443dfe9 in pfs_spawn_thread /10.5/storage/perfschema/pfs.cc:2201
          #23 0x7f99f17e5fa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486
       
      Thread T29 created by T0 here:
          #0 0x7f99f184fdb0 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x50db0)
          #1 0x55d3c4438ee0 in my_thread_create /10.5/storage/perfschema/my_thread.h:34
          #2 0x55d3c443e3d8 in pfs_spawn_thread_v1 /10.5/storage/perfschema/pfs.cc:2252
          #3 0x55d3c306ef94 in inline_mysql_thread_create /10.5/include/mysql/psi/mysql_thread.h:1321
          #4 0x55d3c30845d8 in create_thread_to_handle_connection(CONNECT*) /10.5/sql/mysqld.cc:6018
          #5 0x55d3c3084c46 in create_new_thread(CONNECT*) /10.5/sql/mysqld.cc:6077
          #6 0x55d3c3084faa in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.5/sql/mysqld.cc:6142
          #7 0x55d3c3085be9 in handle_connections_sockets() /10.5/sql/mysqld.cc:6269
          #8 0x55d3c3083e3f in mysqld_main(int, char**) /10.5/sql/mysqld.cc:5664
          #9 0x55d3c306d774 in main /10.5/sql/main.cc:25
          #10 0x7f99f0d1709a in __libc_start_main ../csu/libc-start.c:308
       
      SUMMARY: AddressSanitizer: heap-use-after-free /10.5/storage/innobase/dict/dict0mem.cc:230 in dict_mem_table_free(dict_table_t*)
      Shadow bytes around the buggy address:
        0x0c32800d27e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c32800d27f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c32800d2800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c32800d2810: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c32800d2820: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      =>0x0c32800d2830: fd fd fd fd fd fd fd fd fd fd[fd]fd fa fa fa fa
        0x0c32800d2840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c32800d2850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c32800d2860: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c32800d2870: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c32800d2880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
      ==30915==ABORTING
      

      2020-07-13 16:19:50 15 [ERROR] InnoDB: preallocating 98304 bytes for file ./test/FTS_000000000000006c_DELETED_CACHE.ibd failed with error 28
      2020-07-13 16:19:50 15 [Warning] InnoDB: Failed to create FTS common table test/FTS_000000000000006c_DELETED_CACHE
      =================================================================
      ==30575==ERROR: AddressSanitizer: heap-use-after-free on address 0x619000218562 at pc 0x5606ff60a804 bp 0x7f1915d17b80 sp 0x7f1915d17b78
      READ of size 1 at 0x619000218562 thread T24
          #0 0x5606ff60a803 in dict_table_check_if_in_cache_low /10.5/storage/innobase/include/dict0priv.ic:87
          #1 0x5606ff60f363 in dict_table_open_on_name(char const*, unsigned long, unsigned long, dict_err_ignore_t) /10.5/storage/innobase/dict/dict0dict.cc:1094
          #2 0x5606ff303941 in row_drop_table_for_mysql(char const*, trx_t*, enum_sql_command, bool, bool) /10.5/storage/innobase/row/row0mysql.cc:3361
          #3 0x5606ff719fa3 in fts_create_one_common_table /10.5/storage/innobase/fts/fts0fts.cc:1798
          #4 0x5606ff71a537 in fts_create_common_tables(trx_t*, dict_table_t*, bool) /10.5/storage/innobase/fts/fts0fts.cc:1858
          #5 0x5606fef89dcd in create_table_info_t::create_table(bool) /10.5/storage/innobase/handler/ha_innodb.cc:12673
          #6 0x5606fefc0c3c in ha_innobase::create(char const*, TABLE*, HA_CREATE_INFO*, bool, trx_t*) (/10.5/sql/mariadbd+0x2de4c3c)
          #7 0x5606fef8bf93 in ha_innobase::create(char const*, TABLE*, HA_CREATE_INFO*) /10.5/storage/innobase/handler/ha_innodb.cc:13202
          #8 0x5606fe49f5fd in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /10.5/sql/handler.cc:5072
          #9 0x5606fe4a3c70 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /10.5/sql/handler.cc:5536
          #10 0x5606fdf4c411 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /10.5/sql/sql_table.cc:10625
          #11 0x5606fe0e1181 in Sql_cmd_alter_table::execute(THD*) /10.5/sql/sql_alter.cc:532
          #12 0x5606fdcc0176 in mysql_execute_command(THD*) /10.5/sql/sql_parse.cc:5951
          #13 0x5606fdccd7a5 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/sql/sql_parse.cc:7993
          #14 0x5606fdca46be in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/sql/sql_parse.cc:1866
          #15 0x5606fdca0fd6 in do_command(THD*) /10.5/sql/sql_parse.cc:1347
          #16 0x5606fe0c575c in do_handle_one_connection(CONNECT*, bool) /10.5/sql/sql_connect.cc:1411
          #17 0x5606fe0c50b9 in handle_one_connection /10.5/sql/sql_connect.cc:1313
          #18 0x5606fed7bfe9 in pfs_spawn_thread /10.5/storage/perfschema/pfs.cc:2201
          #19 0x7f193a6f5fa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486
          #20 0x7f1939cfc4ce in clone (/lib/x86_64-linux-gnu/libc.so.6+0xf94ce)
       
      0x619000218562 is located 226 bytes inside of 1120-byte region [0x619000218480,0x6190002188e0)
      freed by thread T24 here:
          #0 0x7f193a7f7fb0 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe8fb0)
          #1 0x5606ff05d65f in ut_allocator<unsigned char, true>::deallocate(unsigned char*, unsigned long) /10.5/storage/innobase/include/ut0new.h:423
          #2 0x5606ff18f9d3 in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /10.5/storage/innobase/mem/mem0mem.cc:416
          #3 0x5606ff6550c0 in mem_heap_free /10.5/storage/innobase/include/mem0mem.ic:417
          #4 0x5606ff6581e0 in dict_mem_table_free(dict_table_t*) /10.5/storage/innobase/dict/dict0mem.cc:265
          #5 0x5606ff719e43 in fts_create_one_common_table /10.5/storage/innobase/fts/fts0fts.cc:1793
          #6 0x5606ff71a537 in fts_create_common_tables(trx_t*, dict_table_t*, bool) /10.5/storage/innobase/fts/fts0fts.cc:1858
          #7 0x5606fef89dcd in create_table_info_t::create_table(bool) /10.5/storage/innobase/handler/ha_innodb.cc:12673
          #8 0x5606fefc0c3c in ha_innobase::create(char const*, TABLE*, HA_CREATE_INFO*, bool, trx_t*) (/10.5/sql/mariadbd+0x2de4c3c)
          #9 0x5606fef8bf93 in ha_innobase::create(char const*, TABLE*, HA_CREATE_INFO*) /10.5/storage/innobase/handler/ha_innodb.cc:13202
          #10 0x5606fe49f5fd in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /10.5/sql/handler.cc:5072
          #11 0x5606fe4a3c70 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /10.5/sql/handler.cc:5536
          #12 0x5606fdf4c411 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /10.5/sql/sql_table.cc:10625
          #13 0x5606fe0e1181 in Sql_cmd_alter_table::execute(THD*) /10.5/sql/sql_alter.cc:532
          #14 0x5606fdcc0176 in mysql_execute_command(THD*) /10.5/sql/sql_parse.cc:5951
          #15 0x5606fdccd7a5 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/sql/sql_parse.cc:7993
          #16 0x5606fdca46be in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/sql/sql_parse.cc:1866
          #17 0x5606fdca0fd6 in do_command(THD*) /10.5/sql/sql_parse.cc:1347
          #18 0x5606fe0c575c in do_handle_one_connection(CONNECT*, bool) /10.5/sql/sql_connect.cc:1411
          #19 0x5606fe0c50b9 in handle_one_connection /10.5/sql/sql_connect.cc:1313
          #20 0x5606fed7bfe9 in pfs_spawn_thread /10.5/storage/perfschema/pfs.cc:2201
          #21 0x7f193a6f5fa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486
       
      previously allocated by thread T24 here:
          #0 0x7f193a7f8330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330)
          #1 0x5606fefc39ff in ut_allocator<unsigned char, true>::allocate(unsigned long, unsigned char const*, unsigned int, bool, bool) /10.5/storage/innobase/include/ut0new.h:374
          #2 0x5606ff18ec9e in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /10.5/storage/innobase/mem/mem0mem.cc:277
          #3 0x5606ff18f5ce in mem_heap_add_block(mem_block_info_t*, unsigned long) /10.5/storage/innobase/mem/mem0mem.cc:378
          #4 0x5606ff654d4d in mem_heap_alloc /10.5/storage/innobase/include/mem0mem.ic:191
          #5 0x5606ff654b5e in mem_heap_zalloc /10.5/storage/innobase/include/mem0mem.ic:160
          #6 0x5606ff656fa4 in dict_mem_table_create(char const*, fil_space_t*, unsigned long, unsigned long, unsigned long, unsigned long, bool) /10.5/storage/innobase/dict/dict0mem.cc:161
          #7 0x5606ff71996b in fts_create_in_mem_aux_table /10.5/storage/innobase/fts/fts0fts.cc:1709
          #8 0x5606ff719c2e in fts_create_one_common_table /10.5/storage/innobase/fts/fts0fts.cc:1746
          #9 0x5606ff71a537 in fts_create_common_tables(trx_t*, dict_table_t*, bool) /10.5/storage/innobase/fts/fts0fts.cc:1858
          #10 0x5606fef89dcd in create_table_info_t::create_table(bool) /10.5/storage/innobase/handler/ha_innodb.cc:12673
          #11 0x5606fefc0c3c in ha_innobase::create(char const*, TABLE*, HA_CREATE_INFO*, bool, trx_t*) (/10.5/sql/mariadbd+0x2de4c3c)
          #12 0x5606fef8bf93 in ha_innobase::create(char const*, TABLE*, HA_CREATE_INFO*) /10.5/storage/innobase/handler/ha_innodb.cc:13202
          #13 0x5606fe49f5fd in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /10.5/sql/handler.cc:5072
          #14 0x5606fe4a3c70 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /10.5/sql/handler.cc:5536
          #15 0x5606fdf4c411 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /10.5/sql/sql_table.cc:10625
          #16 0x5606fe0e1181 in Sql_cmd_alter_table::execute(THD*) /10.5/sql/sql_alter.cc:532
          #17 0x5606fdcc0176 in mysql_execute_command(THD*) /10.5/sql/sql_parse.cc:5951
          #18 0x5606fdccd7a5 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/sql/sql_parse.cc:7993
          #19 0x5606fdca46be in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/sql/sql_parse.cc:1866
          #20 0x5606fdca0fd6 in do_command(THD*) /10.5/sql/sql_parse.cc:1347
          #21 0x5606fe0c575c in do_handle_one_connection(CONNECT*, bool) /10.5/sql/sql_connect.cc:1411
          #22 0x5606fe0c50b9 in handle_one_connection /10.5/sql/sql_connect.cc:1313
          #23 0x5606fed7bfe9 in pfs_spawn_thread /10.5/storage/perfschema/pfs.cc:2201
          #24 0x7f193a6f5fa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486
       
      Thread T24 created by T0 here:
          #0 0x7f193a75fdb0 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x50db0)
          #1 0x5606fed76ee0 in my_thread_create /10.5/storage/perfschema/my_thread.h:34
          #2 0x5606fed7c3d8 in pfs_spawn_thread_v1 /10.5/storage/perfschema/pfs.cc:2252
          #3 0x5606fd9acf94 in inline_mysql_thread_create /10.5/include/mysql/psi/mysql_thread.h:1321
          #4 0x5606fd9c25d8 in create_thread_to_handle_connection(CONNECT*) /10.5/sql/mysqld.cc:6018
          #5 0x5606fd9c2c46 in create_new_thread(CONNECT*) /10.5/sql/mysqld.cc:6077
          #6 0x5606fd9c2faa in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.5/sql/mysqld.cc:6142
          #7 0x5606fd9c3be9 in handle_connections_sockets() /10.5/sql/mysqld.cc:6269
          #8 0x5606fd9c1e3f in mysqld_main(int, char**) /10.5/sql/mysqld.cc:5664
          #9 0x5606fd9ab774 in main /10.5/sql/main.cc:25
          #10 0x7f1939c2709a in __libc_start_main ../csu/libc-start.c:308
       
      SUMMARY: AddressSanitizer: heap-use-after-free /10.5/storage/innobase/include/dict0priv.ic:87 in dict_table_check_if_in_cache_low
      Shadow bytes around the buggy address:
        0x0c328003b050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328003b060: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c328003b070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c328003b080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c328003b090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      =>0x0c328003b0a0: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
        0x0c328003b0b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328003b0c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328003b0d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328003b0e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328003b0f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
      ==30575==ABORTING
      

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              alice Alice Sherepa
              Reporter:
              alice Alice Sherepa
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.