Type:
Bug
Priority:
Major
Resolution:
Fixed
Affects Version/s:
10.1(EOL) , 10.2(EOL) , 10.3(EOL) , 10.4(EOL) , 10.5
To reproduce, build MariaDB server with ASAN enabled -DWITH_ASAN:BOOL=ON , enable Galera/wsrep and run sysbench load against one node:
sysbench --mysql-user=root --mysql-socket=/tmp/mysqld.1.sock --mysql-db=test --threads=32 --time=3600 --report-interval=1 oltp_read_write run
From different terminal, run "show processlist" against the same node repeatedly:
while mysql --user=root -S/tmp/mysqld.1.sock -e "show processlist"; do sleep 1; done
The server process will eventually crash with error:
==22561==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7f370f7b670
0 at pc 0x7f37328ec66e bp 0x7f370ff88050 sp 0x7f370ff877f8
READ of size 49 at 0x7f370f7b6700 thread T41
#0 0x7f37328ec66d (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x5166d)
#1 0x564d516a750e in Protocol::store(char const*, charset_info_st const*) /h
ome/teemu/work/git/mariadb-server/sql/protocol.cc:1029
#2 0x564d51a793dc in mysqld_list_processes(THD*, char const*, bool) /home/te
emu/work/git/mariadb-server/sql/sql_show.cc:2736
#3 0x564d518e060a in mysql_execute_command(THD*) /home/teemu/work/git/mariad
b-server/sql/sql_parse.cc:4512
#4 0x564d518f7ae2 in mysql_parse(THD*, char*, unsigned int, Parser_state*, b
ool, bool) /home/teemu/work/git/mariadb-server/sql/sql_parse.cc:7733
#5 0x564d518f6597 in wsrep_mysql_parse /home/teemu/work/git/mariadb-server/s
ql/sql_parse.cc:7525
#6 0x564d518ce72f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/teemu/work/git/mariadb-server/sql/sql_parse.cc:1820
#7 0x564d518cb1b4 in do_command(THD*) /home/teemu/work/git/mariadb-server/sql/sql_parse.cc:1377
#8 0x564d51c7410b in do_handle_one_connection(CONNECT*) /home/teemu/work/git/mariadb-server/sql/sql_connect.cc:1336
#9 0x564d51c739c8 in handle_one_connection /home/teemu/work/git/mariadb-server/sql/sql_connect.cc:1241
#10 0x564d530fdecf in pfs_spawn_thread /home/teemu/work/git/mariadb-server/storage/perfschema/pfs.cc:1869
#11 0x7f37309916da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
#12 0x7f372fd7ba3e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x121a3e)
Address 0x7f370f7b6700 is located in stack of thread T60 at offset 32 in frame
#0 0x564d5247f2b0 in innobase_commit_low(trx_t*) /home/teemu/work/git/mariadb-server/storage/innobase/handler/ha_innodb.cc:4439
This frame has 1 object(s):
[32, 96) 'info' <== Memory access at offset 32 is inside this variable
The reason for the crash seems to be assignment of THD proc info from info buffer which goes immediately out of scope after assignment, in innobase_commit_low() :
#ifdef WITH_WSREP
const char* tmp = 0;
const bool is_wsrep = trx->is_wsrep();
THD* thd = trx->mysql_thd;
if (is_wsrep) {
#ifdef WSREP_PROC_INFO
char info[64];
info[sizeof(info) - 1] = '\0';
snprintf(info, sizeof(info) - 1,
"innobase_commit_low():trx_commit_for_mysql(%lld)",
(long long) wsrep_thd_trx_seqno(thd));
tmp = thd_proc_info(thd, info);
#else
tmp = thd_proc_info(thd, "innobase_commit_low()");
#endif /* WSREP_PROC_INFO */
}
#endif /* WITH_WSREP */
Transition
Time In Source Status
Execution Times
Open
Closed
18h 50m
1
{"report":{"fcp":1228.7000002861023,"ttfb":305.40000009536743,"pageVisibility":"visible","entityId":89913,"key":"jira.project.issue.view-issue","isInitial":true,"threshold":1000,"elementTimings":{},"userDeviceMemory":8,"userDeviceProcessors":64,"apdex":0.5,"journeyId":"cac2363e-dd1f-4a29-a0b3-6ab61664dc94","navigationType":0,"readyForUser":1310.4000000953674,"redirectCount":0,"resourceLoadedEnd":1549.1000003814697,"resourceLoadedStart":324.1000003814697,"resourceTiming":[{"duration":386.5,"initiatorType":"link","name":"https://jira.mariadb.org/s/2c21342762a6a02add1c328bed317ffd-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/css/_super/batch.css","startTime":324.1000003814697,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":324.1000003814697,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":710.6000003814697,"responseStart":0,"secureConnectionStart":0},{"duration":386.59999990463257,"initiatorType":"link","name":"https://jira.mariadb.org/s/7ebd35e77e471bc30ff0eba799ebc151-CDN/lu2cib/820016/12ta74/2bf333562ca6724060a9d5f1535471f6/_/download/contextbatch/css/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":324.40000009536743,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":324.40000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":711,"responseStart":0,"secureConnectionStart":0},{"duration":405.59999990463257,"initiatorType":"script","name":"https://jira.mariadb.org/s/0917945aaa57108d00c5076fea35e069-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/js/_super/batch.js?locale=en","startTime":324.7000002861023,"connectEnd":324.7000002861023,"connectStart":324.7000002861023,"domainLookupEnd":324.7000002861023,"domainLookupStart":324.7000002861023,"fetchStart":324.7000002861023,"redirectEnd":0,"redirectStart":0,"requestStart":324.7000002861023,"responseEnd":730.3000001907349,"responseStart":730.3000001907349,"secureConnectionStart":324.7000002861023},{"duration":473.5,"initiatorType":"script","name":"https://jira.mariadb.org/s/2d8175ec2fa4c816e8023260bd8c1786-CDN/lu2cib/820016/12ta74/2bf333562ca6724060a9d5f1535471f6/_/download/contextbatch/js/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true","startTime":325.40000009536743,"connectEnd":325.40000009536743,"connectStart":325.40000009536743,"domainLookupEnd":325.40000009536743,"domainLookupStart":325.40000009536743,"fetchStart":325.40000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":325.40000009536743,"responseEnd":798.9000000953674,"responseStart":798.9000000953674,"secureConnectionStart":325.40000009536743},{"duration":477.3999996185303,"initiatorType":"script","name":"https://jira.mariadb.org/s/a9324d6758d385eb45c462685ad88f1d-CDN/lu2cib/820016/12ta74/c92c0caa9a024ae85b0ebdbed7fb4bd7/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en","startTime":325.6000003814697,"connectEnd":325.6000003814697,"connectStart":325.6000003814697,"domainLookupEnd":325.6000003814697,"domainLookupStart":325.6000003814697,"fetchStart":325.6000003814697,"redirectEnd":0,"redirectStart":0,"requestStart":325.6000003814697,"responseEnd":803,"responseStart":803,"secureConnectionStart":325.6000003814697},{"duration":477.69999980926514,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":325.80000019073486,"connectEnd":325.80000019073486,"connectStart":325.80000019073486,"domainLookupEnd":325.80000019073486,"domainLookupStart":325.80000019073486,"fetchStart":325.80000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":325.80000019073486,"responseEnd":803.5,"responseStart":803.4000000953674,"secureConnectionStart":325.80000019073486},{"duration":477.90000009536743,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":326,"connectEnd":326,"connectStart":326,"domainLookupEnd":326,"domainLookupStart":326,"fetchStart":326,"redirectEnd":0,"redirectStart":0,"requestStart":326,"responseEnd":803.9000000953674,"responseStart":803.9000000953674,"secureConnectionStart":326},{"duration":549.6999998092651,"initiatorType":"link","name":"https://jira.mariadb.org/s/b04b06a02d1959df322d9cded3aeecc1-CDN/lu2cib/820016/12ta74/a2ff6aa845ffc9a1d22fe23d9ee791fc/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":326.2000002861023,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":326.2000002861023,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":875.9000000953674,"responseStart":0,"secureConnectionStart":0},{"duration":478,"initiatorType":"script","name":"https://jira.mariadb.org/rest/api/1.0/shortcuts/820016/47140b6e0a9bc2e4913da06536125810/shortcuts.js?context=issuenavigation&context=issueaction","startTime":326.30000019073486,"connectEnd":326.30000019073486,"connectStart":326.30000019073486,"domainLookupEnd":326.30000019073486,"domainLookupStart":326.30000019073486,"fetchStart":326.30000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":326.30000019073486,"responseEnd":804.3000001907349,"responseStart":804.3000001907349,"secureConnectionStart":326.30000019073486},{"duration":549.5,"initiatorType":"link","name":"https://jira.mariadb.org/s/3ac36323ba5e4eb0af2aa7ac7211b4bb-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.css?jira.create.linked.issue=true","startTime":326.5,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":326.5,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":876,"responseStart":0,"secureConnectionStart":0},{"duration":478.3999996185303,"initiatorType":"script","name":"https://jira.mariadb.org/s/5d5e8fe91fbc506585e83ea3b62ccc4b-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.js?jira.create.linked.issue=true&locale=en","startTime":326.6000003814697,"connectEnd":326.6000003814697,"connectStart":326.6000003814697,"domainLookupEnd":326.6000003814697,"domainLookupStart":326.6000003814697,"fetchStart":326.6000003814697,"redirectEnd":0,"redirectStart":0,"requestStart":326.6000003814697,"responseEnd":805,"responseStart":805,"secureConnectionStart":326.6000003814697},{"duration":652,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":328.40000009536743,"connectEnd":328.40000009536743,"connectStart":328.40000009536743,"domainLookupEnd":328.40000009536743,"domainLookupStart":328.40000009536743,"fetchStart":328.40000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":328.40000009536743,"responseEnd":980.4000000953674,"responseStart":980.4000000953674,"secureConnectionStart":328.40000009536743},{"duration":1219.6000003814697,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":328.5,"connectEnd":328.5,"connectStart":328.5,"domainLookupEnd":328.5,"domainLookupStart":328.5,"fetchStart":328.5,"redirectEnd":0,"redirectStart":0,"requestStart":328.5,"responseEnd":1548.1000003814697,"responseStart":1548.1000003814697,"secureConnectionStart":328.5},{"duration":95.69999980926514,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":888.2000002861023,"connectEnd":888.2000002861023,"connectStart":888.2000002861023,"domainLookupEnd":888.2000002861023,"domainLookupStart":888.2000002861023,"fetchStart":888.2000002861023,"redirectEnd":0,"redirectStart":0,"requestStart":888.2000002861023,"responseEnd":983.9000000953674,"responseStart":983.9000000953674,"secureConnectionStart":888.2000002861023},{"duration":389.30000019073486,"initiatorType":"link","name":"https://jira.mariadb.org/s/d5715adaadd168a9002b108b2b039b50-CDN/lu2cib/820016/12ta74/be4b45e9cec53099498fa61c8b7acba4/_/download/contextbatch/css/jira.project.sidebar,-_super,-project.issue.navigator,-jira.general,-jira.browse.project,-jira.view.issue,-jira.global,-atl.general,-com.atlassian.jira.projects.sidebar.init/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":1159.8000001907349,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":1159.8000001907349,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":1549.1000003814697,"responseStart":0,"secureConnectionStart":0},{"duration":459.90000009536743,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/e65b778d185daf5aee24936755b43da6/_/download/contextbatch/js/browser-metrics-plugin.contrib,-_super,-project.issue.navigator,-jira.view.issue,-atl.general/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":1160.8000001907349,"connectEnd":1160.8000001907349,"connectStart":1160.8000001907349,"domainLookupEnd":1160.8000001907349,"domainLookupStart":1160.8000001907349,"fetchStart":1160.8000001907349,"redirectEnd":0,"redirectStart":0,"requestStart":1160.8000001907349,"responseEnd":1620.7000002861023,"responseStart":1620.7000002861023,"secureConnectionStart":1160.8000001907349}],"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":84,"responseStart":306,"responseEnd":327,"domLoading":319,"domInteractive":1570,"domContentLoadedEventStart":1570,"domContentLoadedEventEnd":1611,"domComplete":2164,"loadEventStart":2164,"loadEventEnd":2164,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[{"name":"bigPipe.sidebar-id.start","time":1550.1000003814697},{"name":"bigPipe.sidebar-id.end","time":1551},{"name":"bigPipe.activity-panel-pipe-id.start","time":1551.1000003814697},{"name":"bigPipe.activity-panel-pipe-id.end","time":1552.1000003814697},{"name":"activityTabFullyLoaded","time":1621.9000000953674}],"measures":[],"correlationId":"a7f5907501f3c","effectiveType":"4g","downlink":10,"rtt":0,"serverDuration":104,"dbReadsTimeInMs":16,"dbConnsTimeInMs":24,"applicationHash":"9d11dbea5f4be3d4cc21f03a88dd11d8c8687422","experiments":[]}}