Details
-
Bug
-
Status: Confirmed (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.1(EOL), 10.2(EOL), 10.3(EOL), 10.4(EOL)
Description
The provided test case only fails for me on 10.1-10.2, but a similar failure has been observed on 10.3-10.4 versions, see comments. I have no records so far of it happening on 10.5.
Run with --repeat=N. The failure is well reproducible for me on current 10.2 with ASAN builds, usually on the first attempt and always within 5-10 runs, but it can vary on different machines and builds.
--source include/have_innodb.inc
|
|
CREATE TABLE t1 ( |
pk INT, |
a INT NOT NULL, |
PRIMARY KEY (pk), |
FOREIGN KEY fk1 (a) REFERENCES t1 (pk) |
) ENGINE=InnoDB;
|
|
CREATE TABLE t2 ( |
pk INT PRIMARY KEY, |
FOREIGN KEY fk2 (pk) REFERENCES t1 (a) |
) ENGINE=InnoDB;
|
|
CREATE TABLE t3 (pk INT PRIMARY KEY) ENGINE=InnoDB; |
|
--connect (con1,localhost,root,,test)
|
--send
|
ALTER TABLE t2 ADD b INT; |
|
--connection default
|
SET FOREIGN_KEY_CHECKS= OFF; |
--error ER_FK_INCORRECT_OPTION
|
ALTER TABLE t1 ADD FOREIGN KEY fk3 (a) REFERENCES t3 (pk) ON DELETE SET NULL; |
LOCK TABLE t1 WRITE; |
|
# Cleanup
|
--disconnect con1
|
UNLOCK TABLES;
|
DROP TABLE t1, t2, t3; |
10.2 9dedba16 |
==1627217==ERROR: AddressSanitizer: heap-use-after-free on address 0x617000039298 at pc 0x556e295adae9 bp 0x7f508c580a20 sp 0x7f508c580a10
|
READ of size 8 at 0x617000039298 thread T27
|
#0 0x556e295adae8 in id_name_t::operator char const*() const /data/src/10.2/storage/innobase/include/dict0mem.h:541
|
#1 0x556e2958ce2d in get_foreign_key_info /data/src/10.2/storage/innobase/handler/ha_innodb.cc:15358
|
#2 0x556e2958d9fc in ha_innobase::get_parent_foreign_key_list(THD*, List<st_foreign_key_info>*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:15439
|
#3 0x556e288e7601 in DML_prelocking_strategy::handle_table(THD*, Query_tables_list*, TABLE_LIST*, bool*) /data/src/10.2/sql/sql_base.cc:4389
|
#4 0x556e288e7e69 in Lock_tables_prelocking_strategy::handle_table(THD*, Query_tables_list*, TABLE_LIST*, bool*) /data/src/10.2/sql/sql_base.cc:4493
|
#5 0x556e288e1fe4 in extend_table_list(THD*, TABLE_LIST*, Prelocking_strategy*, bool) /data/src/10.2/sql/sql_base.cc:3350
|
#6 0x556e288e3772 in open_and_process_table /data/src/10.2/sql/sql_base.cc:3663
|
#7 0x556e288e57cd in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.2/sql/sql_base.cc:4076
|
#8 0x556e289ef06b in open_tables /data/src/10.2/sql/sql_base.h:248
|
#9 0x556e289fdde3 in lock_tables_open_and_lock_tables /data/src/10.2/sql/sql_parse.cc:2816
|
#10 0x556e28a09cb4 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4649
|
#11 0x556e28a1ef47 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7733
|
#12 0x556e289f8242 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1823
|
#13 0x556e289f501e in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1377
|
#14 0x556e28d78735 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
|
#15 0x556e28d77ff8 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
|
#16 0x556e2a0fe0f5 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
|
#17 0x7f50a3128608 in start_thread /build/glibc-YYA7BZ/glibc-2.31/nptl/pthread_create.c:477
|
#18 0x7f50a2d02102 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122102)
|
|
0x617000039298 is located 152 bytes inside of 680-byte region [0x617000039200,0x6170000394a8)
|
freed by thread T27 here:
|
#0 0x7f50a32957cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
|
#1 0x556e296f8e72 in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /data/src/10.2/storage/innobase/mem/mem0mem.cc:428
|
#2 0x556e29b7f233 in mem_heap_free /data/src/10.2/storage/innobase/include/mem0mem.ic:416
|
#3 0x556e29b86219 in dict_mem_index_free(dict_index_t*) /data/src/10.2/storage/innobase/dict/dict0mem.cc:1081
|
#4 0x556e29b3d9a4 in dict_index_remove_from_cache_low /data/src/10.2/storage/innobase/dict/dict0dict.cc:2420
|
#5 0x556e29b3d9d2 in dict_index_remove_from_cache(dict_table_t*, dict_index_t*) /data/src/10.2/storage/innobase/dict/dict0dict.cc:2431
|
#6 0x556e29811664 in row_merge_drop_indexes(trx_t*, dict_table_t*, unsigned long) /data/src/10.2/storage/innobase/row/row0merge.cc:3870
|
#7 0x556e295fe875 in innobase_rollback_sec_index /data/src/10.2/storage/innobase/handler/handler0alter.cc:6471
|
#8 0x556e29608077 in ha_innobase::commit_inplace_alter_table(TABLE*, Alter_inplace_info*, bool) /data/src/10.2/storage/innobase/handler/handler0alter.cc:8577
|
#9 0x556e29052282 in handler::ha_commit_inplace_alter_table(TABLE*, Alter_inplace_info*, bool) /data/src/10.2/sql/handler.cc:4378
|
#10 0x556e28c3377a in mysql_inplace_alter_table /data/src/10.2/sql/sql_table.cc:7480
|
#11 0x556e28c42cbe in mysql_alter_table(THD*, char*, char*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.2/sql/sql_table.cc:9622
|
#12 0x556e28d8817d in Sql_cmd_alter_table::execute(THD*) /data/src/10.2/sql/sql_alter.cc:333
|
#13 0x556e28a1353b in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:5964
|
#14 0x556e28a1ef47 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7733
|
#15 0x556e289f8242 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1823
|
#16 0x556e289f501e in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1377
|
#17 0x556e28d78735 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
|
#18 0x556e28d77ff8 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
|
#19 0x556e2a0fe0f5 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
|
#20 0x7f50a3128608 in start_thread /build/glibc-YYA7BZ/glibc-2.31/nptl/pthread_create.c:477
|
|
previously allocated by thread T27 here:
|
#0 0x7f50a3295bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
|
#1 0x556e296f83c3 in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /data/src/10.2/storage/innobase/mem/mem0mem.cc:289
|
#2 0x556e296f8c46 in mem_heap_add_block(mem_block_info_t*, unsigned long) /data/src/10.2/storage/innobase/mem/mem0mem.cc:390
|
#3 0x556e29b7ef2f in mem_heap_alloc /data/src/10.2/storage/innobase/include/mem0mem.ic:191
|
#4 0x556e29b7edf6 in mem_heap_zalloc /data/src/10.2/storage/innobase/include/mem0mem.ic:160
|
#5 0x556e29b83e3c in dict_mem_index_create(char const*, char const*, unsigned long, unsigned long, unsigned long) /data/src/10.2/storage/innobase/dict/dict0mem.cc:743
|
#6 0x556e29b408a6 in dict_index_build_internal_non_clust /data/src/10.2/storage/innobase/dict/dict0dict.cc:2902
|
#7 0x556e29b3c79e in dict_index_add_to_cache(dict_table_t*, dict_index_t*&, unsigned long, dict_add_v_col_t const*) /data/src/10.2/storage/innobase/dict/dict0dict.cc:2270
|
#8 0x556e29b22266 in dict_create_index_step(que_thr_t*) /data/src/10.2/storage/innobase/dict/dict0crea.cc:1485
|
#9 0x556e29784043 in que_thr_step /data/src/10.2/storage/innobase/que/que0que.cc:1052
|
#10 0x556e2978436e in que_run_threads_low /data/src/10.2/storage/innobase/que/que0que.cc:1104
|
#11 0x556e29784734 in que_run_threads(que_thr_t*) /data/src/10.2/storage/innobase/que/que0que.cc:1144
|
#12 0x556e2981393e in row_merge_create_index_graph /data/src/10.2/storage/innobase/row/row0merge.cc:4335
|
#13 0x556e2981433c in row_merge_create_index(trx_t*, dict_table_t*, index_def_t const*, dict_add_v_col_t const*) /data/src/10.2/storage/innobase/row/row0merge.cc:4406
|
#14 0x556e295f1bf3 in prepare_inplace_alter_table_dict /data/src/10.2/storage/innobase/handler/handler0alter.cc:4841
|
#15 0x556e295fb61b in ha_innobase::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /data/src/10.2/storage/innobase/handler/handler0alter.cc:6048
|
#16 0x556e290520cd in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /data/src/10.2/sql/handler.cc:4358
|
#17 0x556e28c3322d in mysql_inplace_alter_table /data/src/10.2/sql/sql_table.cc:7420
|
#18 0x556e28c42cbe in mysql_alter_table(THD*, char*, char*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.2/sql/sql_table.cc:9622
|
#19 0x556e28d8817d in Sql_cmd_alter_table::execute(THD*) /data/src/10.2/sql/sql_alter.cc:333
|
#20 0x556e28a1353b in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:5964
|
#21 0x556e28a1ef47 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7733
|
#22 0x556e289f8242 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1823
|
#23 0x556e289f501e in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1377
|
#24 0x556e28d78735 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
|
#25 0x556e28d77ff8 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
|
#26 0x556e2a0fe0f5 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
|
#27 0x7f50a3128608 in start_thread /build/glibc-YYA7BZ/glibc-2.31/nptl/pthread_create.c:477
|
|
Thread T27 created by T0 here:
|
#0 0x7f50a31c2805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
|
#1 0x556e2a0fe4e6 in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
|
#2 0x556e2879cf67 in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
|
#3 0x556e287b48f7 in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6518
|
#4 0x556e287b5088 in create_new_thread /data/src/10.2/sql/mysqld.cc:6588
|
#5 0x556e287b6213 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6846
|
#6 0x556e287b3c69 in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6137
|
#7 0x556e2879b84c in main /data/src/10.2/sql/main.cc:25
|
#8 0x7f50a2c070b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
|
|
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.2/storage/innobase/include/dict0mem.h:541 in id_name_t::operator char const*() const
|
Shadow bytes around the buggy address:
|
0x0c2e7ffff200: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c2e7ffff210: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c2e7ffff220: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c2e7ffff230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c2e7ffff240: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
=>0x0c2e7ffff250: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c2e7ffff260: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c2e7ffff270: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c2e7ffff280: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c2e7ffff290: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa
|
0x0c2e7ffff2a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
Shadow gap: cc
|
==1627217==ABORTING
|
Reproducible on 10.1, 10.2.
Couldn't reproduce on 10.3-10.5.
Non-ASAN builds have been seen crashing a similar way with non-simplified versions of the test case.
rr profile is available.
Attachments
Issue Links
- relates to
-
MDEV-18259 ASAN heap-use-after-free or server crash in get_foreign_key_info
- Closed
-
MDEV-19194 Server crash or ASAN use-after-poison in fk_prepare_copy_alter_table upon dropping FK
- Confirmed