[MDEV-24665] ASAN errors, assertion failures, corrupt values after failed LOAD DATA into table with virtual/stored column - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Major
Resolution: Duplicate
Affects Version/s: 10.2(EOL), 10.3(EOL), 10.4(EOL), 10.5, 10.6
Fix Version/s: 10.2.38, 10.3.29, 10.4.19, 10.5.10
Component/s: Virtual Columns
Labels:
None

Description

There are a lot of similarity in the test case with ~~MDEV-24656~~. However, the big difference there, apart from the completely differently-looking failure, is that this variant affects not only virtual (generated) columns, but also persistent (stored) columns, which are considered much more stable – so much so new functionality is planned to be based upon them.

CREATE TABLE t1 (id INT PRIMARY KEY, ts TIMESTAMP DEFAULT '1971-01-01 00:00:00', c VARBINARY(8) DEFAULT '', vc VARCHAR(3) AS (c) STORED);

INSERT IGNORE INTO t1 (id,c) VALUES (1,'foobar');

SELECT id, ts, vc INTO OUTFILE 'load_t1' FROM t1;

--error 0,ER_DATA_TOO_LONG

LOAD DATA INFILE 'load_t1' REPLACE INTO TABLE t1 (id, ts, vc);

INSERT IGNORE INTO t1 (id) VALUES (2);

# Cleanup

DROP TABLE t1;

--let $datadir= `select @@datadir`

--remove_file $datadir/test/load_t1

10.2 59e6d14c
==2965509==ERROR: AddressSanitizer: use-after-poison on address 0x619000087c47 at pc 0x55be8e22e411 bp 0x7fb01c9ccae0 sp 0x7fb01c9ccad0
READ of size 1 at 0x619000087c47 thread T5
#0 0x55be8e22e410 in my_timestamp_from_binary(timeval, unsigned char const, unsigned int) /data/src/10.2/sql/compat56.cc:392
#1 0x55be8e265f44 in Field_timestampf::get_timestamp(unsigned char const, unsigned long) const /data/src/10.2/sql/field.cc:5683
#2 0x55be8e2621d1 in Field_timestamp::validate_value_in_record(THD, unsigned char const) const /data/src/10.2/sql/field.cc:5392
#3 0x55be8e29b108 in Field::validate_value_in_record_with_warn(THD, unsigned char const) /data/src/10.2/sql/field.cc:11171
#4 0x55be8df6e8ad in TABLE::validate_default_values_of_unset_fields(THD*) const /data/src/10.2/sql/table.cc:7984
#5 0x55be8dc263e0 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.2/sql/sql_insert.cc:940
#6 0x55be8dc8db91 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4194
#7 0x55be8dca67eb in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763
#8 0x55be8dc7f830 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
#9 0x55be8dc7c5ef in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
#10 0x55be8e004b1e in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
#11 0x55be8e0043e1 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
#12 0x55be8f3a05d9 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
#13 0x7fb02771e608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
#14 0x7fb0272f8292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x619000087c47 is located 455 bytes inside of 1100-byte region [0x619000087a80,0x619000087ecc)
allocated by thread T5 here:
#0 0x7fb027c85bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
#1 0x55be8f4bd12c in sf_malloc /data/src/10.2/mysys/safemalloc.c:118
#2 0x55be8f489091 in my_malloc /data/src/10.2/mysys/my_malloc.c:101
#3 0x55be8f466703 in alloc_root /data/src/10.2/mysys/my_alloc.c:243
#4 0x55be8f468139 in memdup_root /data/src/10.2/mysys/my_alloc.c:464
#5 0x55be8df3b777 in TABLE_SHARE::init_from_binary_frm_image(THD, bool, unsigned char const, unsigned long) /data/src/10.2/sql/table.cc:1288
#6 0x55be8df37143 in open_table_def(THD, TABLE_SHARE, unsigned int) /data/src/10.2/sql/table.cc:684
#7 0x55be8e189065 in tdc_acquire_share(THD, TABLE_LIST, unsigned int, TABLE**) /data/src/10.2/sql/table_cache.cc:826
#8 0x55be8db607f0 in open_table(THD, TABLE_LIST, Open_table_context*) /data/src/10.2/sql/sql_base.cc:1797
#9 0x55be8db69344 in open_and_process_table /data/src/10.2/sql/sql_base.cc:3614
#10 0x55be8db6b71e in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /data/src/10.2/sql/sql_base.cc:4081
#11 0x55be8db6f2a4 in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*) /data/src/10.2/sql/sql_base.cc:4880
#12 0x55be8dae646d in open_and_lock_tables(THD, TABLE_LIST, bool, unsigned int) /data/src/10.2/sql/sql_base.h:507
#13 0x55be8dc2515d in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.2/sql/sql_insert.cc:758
#14 0x55be8dc8db91 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4194
#15 0x55be8dca67eb in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7763
#16 0x55be8dc7f830 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1827
#17 0x55be8dc7c5ef in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1381
#18 0x55be8e004b1e in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1336
#19 0x55be8e0043e1 in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
#20 0x55be8f3a05d9 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1869
#21 0x7fb02771e608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477

Thread T5 created by T0 here:
#0 0x7fb027bb2805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
#1 0x55be8f3a09ca in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1919
#2 0x55be8da21083 in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1246
#3 0x55be8da38c2b in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6567
#4 0x55be8da393c6 in create_new_thread /data/src/10.2/sql/mysqld.cc:6637
#5 0x55be8da3a558 in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6895
#6 0x55be8da37f7c in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6186
#7 0x55be8da1f93c in main /data/src/10.2/sql/main.cc:25
#8 0x7fb0271fd0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: use-after-poison /data/src/10.2/sql/compat56.cc:392 in my_timestamp_from_binary(timeval, unsigned char const, unsigned int)
Shadow bytes around the buggy address:
0x0c3280008f30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
0x0c3280008f40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3280008f50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3280008f60: 00 f7 00 00 f7 01 f7 00 00 00 00 00 00 00 00 00
0x0c3280008f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3280008f80: 00 02 f7 00 f7 00 00 06[f7]01 f7 00 00 00 00 00
0x0c3280008f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3280008fa0: 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00
0x0c3280008fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7
0x0c3280008fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3280008fd0: 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==2965509==ABORTING

Reproducible on 10.2+, both with stored and virtual columns, with at least MyISAM and InnoDB.
Non-debug ASAN builds of all (10.2-10.6) versions return the failure above, as well as debug ASAN builds of 10.2-10.4.
Debug builds of 10.5-10.6 produce an assertion failure before they have a chance to fail with the ASAN error:

10.5 bf1f9b59
mariadbd: /data/src/10.5/sql/field.h:1155: const uchar* Field::ptr_in_record(const uchar*) const: Assertion `l_offset >= 0 && table->s->rec_buff_length - l_offset > 0' failed.
210124 2:19:33 [ERROR] mysqld got signal 6 ;

#7 0x00007fbc3ae04f36 in __GI___assert_fail (assertion=0x563a23cde1c8 "l_offset >= 0 && table->s->rec_buff_length - l_offset > 0", file=0x563a23cde0b6 "/data/src/10.5/sql/field.h", line=1155, function=0x563a23cde208 "const uchar* Field::ptr_in_record(const uchar*) const") at assert.c:101
#8 0x0000563a2303605b in Field::ptr_in_record (this=0x7fbc242201d0, record=0x7fbc240f9e90 "\376") at /data/src/10.5/sql/field.h:1155
#9 0x0000563a232144cc in Field_timestamp::validate_value_in_record (this=0x7fbc242201d0, thd=0x7fbc24000db8, record=0x7fbc240f9e90 "\376") at /data/src/10.5/sql/field.cc:5433
#10 0x0000563a2322a36a in Field::validate_value_in_record_with_warn (this=0x7fbc242201d0, thd=0x7fbc24000db8, record=0x7fbc240f9e90 "\376") at /data/src/10.5/sql/field.cc:11164
#11 0x0000563a230319d4 in TABLE::validate_default_values_of_unset_fields (this=0x7fbc2421fbe8, thd=0x7fbc24000db8) at /data/src/10.5/sql/table.cc:8989
#12 0x0000563a22e897bd in mysql_insert (thd=0x7fbc24000db8, table_list=0x7fbc24014020, fields=..., values_list=..., update_fields=..., update_values=..., duplic=DUP_ERROR, ignore=true, result=0x0) at /data/src/10.5/sql/sql_insert.cc:957
#13 0x0000563a22edd596 in mysql_execute_command (thd=0x7fbc24000db8) at /data/src/10.5/sql/sql_parse.cc:4596
#14 0x0000563a22ee92b0 in mysql_parse (thd=0x7fbc24000db8, rawbuf=0x7fbc24013f30 "INSERT IGNORE INTO t1 (id) VALUES (2)", length=37, parser_state=0x7fbc357bf510, is_com_multi=false, is_next_command=false) at /data/src/10.5/sql/sql_parse.cc:8062
#15 0x0000563a22ed5237 in dispatch_command (command=COM_QUERY, thd=0x7fbc24000db8, packet=0x7fbc240090a9 "INSERT IGNORE INTO t1 (id) VALUES (2)", packet_length=37, is_com_multi=false, is_next_command=false) at /data/src/10.5/sql/sql_parse.cc:1889
#16 0x0000563a22ed3a2b in do_command (thd=0x7fbc24000db8) at /data/src/10.5/sql/sql_parse.cc:1370
#17 0x0000563a2308172b in do_handle_one_connection (connect=0x563a26852848, put_in_cache=true) at /data/src/10.5/sql/sql_connect.cc:1410
#18 0x0000563a2308148e in handle_one_connection (arg=0x563a268bf208) at /data/src/10.5/sql/sql_connect.cc:1312
#19 0x0000563a235e0449 in pfs_spawn_thread (arg=0x563a26852488) at /data/src/10.5/storage/perfschema/pfs.cc:2201
#20 0x00007fbc3b31c609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#21 0x00007fbc3aef0293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Here is another ASAN failure which I get in very similar circumstances. I won't clean up a test case for it, but I want the failure to be searchable and associatable with this class of problem, so I'll add it here.

10.3 4e503aec
==2966966==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61e00001a3e5 at pc 0x56285e991fae bp 0x7f1cc9766f60 sp 0x7f1cc9766f50
READ of size 1 at 0x61e00001a3e5 thread T5
#0 0x56285e991fad in Field_newdate::get_TIME(st_mysql_time, unsigned char const, unsigned long long) const /data/src/10.3/sql/field.cc:6590
#1 0x56285e984a28 in Field_temporal_with_date::validate_value_in_record(THD, unsigned char const) const /data/src/10.3/sql/field.cc:5743
#2 0x56285e9c7f28 in Field::validate_value_in_record_with_warn(THD, unsigned char const) /data/src/10.3/sql/field.cc:11501
#3 0x56285e5a143b in TABLE::validate_default_values_of_unset_fields(THD*) const /data/src/10.3/sql/table.cc:8231
#4 0x56285e1e8f1c in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.3/sql/sql_insert.cc:940
#5 0x56285e290473 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4481
#6 0x56285e2a8a81 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7840
#7 0x56285e27f8c5 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
#8 0x56285e27c3fc in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
#9 0x56285e646e4d in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
#10 0x56285e646707 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
#11 0x56285fc602fa in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
#12 0x7f1cd461e608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
#13 0x7f1cd41f8292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x61e00001a3e5 is located 1 bytes to the right of 2916-byte region [0x61e000019880,0x61e00001a3e4)
allocated by thread T5 here:
#0 0x7f1cd4b85bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
#1 0x56285fdaaa9b in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
#2 0x56285fd78903 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
#3 0x56285fd54970 in alloc_root /data/src/10.3/mysys/my_alloc.c:251
#4 0x56285e56b2aa in TABLE_SHARE::init_from_binary_frm_image(THD, bool, unsigned char const, unsigned long) /data/src/10.3/sql/table.cc:1657
#5 0x56285e563f2d in open_table_def(THD, TABLE_SHARE, unsigned int) /data/src/10.3/sql/table.cc:687
#6 0x56285e82e70e in tdc_acquire_share(THD, TABLE_LIST, unsigned int, TABLE**) /data/src/10.3/sql/table_cache.cc:840
#7 0x56285e11357d in open_table(THD, TABLE_LIST, Open_table_context*) /data/src/10.3/sql/sql_base.cc:1847
#8 0x56285e11d764 in open_and_process_table /data/src/10.3/sql/sql_base.cc:3730
#9 0x56285e11fd87 in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4199
#10 0x56285e124e7f in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5128
#11 0x56285e0892a7 in open_and_lock_tables(THD, TABLE_LIST, bool, unsigned int) /data/src/10.3/sql/sql_base.h:503
#12 0x56285e1e7b1b in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.3/sql/sql_insert.cc:760
#13 0x56285e290473 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4481
#14 0x56285e2a8a81 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7840
#15 0x56285e27f8c5 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
#16 0x56285e27c3fc in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
#17 0x56285e646e4d in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
#18 0x56285e646707 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
#19 0x56285fc602fa in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
#20 0x7f1cd461e608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477

Thread T5 created by T0 here:
#0 0x7f1cd4ab2805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
#1 0x56285fc606eb in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919
#2 0x56285dfa715e in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275
#3 0x56285dfbfb2d in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6658
#4 0x56285dfc02c8 in create_new_thread /data/src/10.3/sql/mysqld.cc:6728
#5 0x56285dfc145a in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6986
#6 0x56285dfbee1e in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6280
#7 0x56285dfa595c in main /data/src/10.3/sql/main.cc:25
#8 0x7f1cd40fd0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-buffer-overflow /data/src/10.3/sql/field.cc:6590 in Field_newdate::get_TIME(st_mysql_time, unsigned char const, unsigned long long) const
Shadow bytes around the buggy address:
0x0c3c7fffb420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3c7fffb430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3c7fffb440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3c7fffb450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3c7fffb460: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3c7fffb470: 00 00 00 00 00 00 00 00 00 00 00 01[04]fa fa fa
0x0c3c7fffb480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3c7fffb490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3c7fffb4a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3c7fffb4b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3c7fffb4c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==2966966==ABORTING

Attachments

Issue Links

duplicates

MDEV-24583 ASAN use-after-poison in create_tmp_table or assertion failures after failed REPLACE into table with virtual/stored column

Closed

relates to

MDEV-24782 ASAN use-after-poison in Field::pack_int / THD::binlog_update_row

Closed

MDEV-24656 [FATAL] InnoDB: Data field type 0, len 0, ASAN heap-buffer-overflow upon LOAD DATA with virtual columns

Closed

Activity

Ascending order - Click to sort in descending order

Elena Stepanova added a comment - 2021-02-02 15:24

Likely the same issue:

10.3 59eda73e
==20251==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000279b85 at pc 0x00000104598f bp 0x7fa659007ce0 sp 0x7fa659007cd0
READ of size 4 at 0x621000279b85 thread T32
#0 0x104598e in mi_uint5korr /home/vsts/src/include/byte_order_generic_x86_64.h:92
#1 0x1047cfe in my_datetime_packed_from_binary(unsigned char const*, unsigned int) /home/vsts/src/sql/compat56.cc:310
#2 0x10a7f82 in Field_datetimef::get_TIME(st_mysql_time, unsigned char const, unsigned long long) const /home/vsts/src/sql/field.cc:6929
#3 0x10958a0 in Field_temporal_with_date::validate_value_in_record(THD, unsigned char const) const /home/vsts/src/sql/field.cc:5743
#4 0x10db738 in Field::validate_value_in_record_with_warn(THD, unsigned char const) /home/vsts/src/sql/field.cc:11500
#5 0xca5781 in TABLE::validate_default_values_of_unset_fields(THD*) const /home/vsts/src/sql/table.cc:8231
#6 0x8c80bb in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /home/vsts/src/sql/sql_insert.cc:940
#7 0x974737 in mysql_execute_command(THD*) /home/vsts/src/sql/sql_parse.cc:4481
#8 0x98d290 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /home/vsts/src/sql/sql_parse.cc:7840
#9 0x9637e1 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /home/vsts/src/sql/sql_parse.cc:1852
#10 0x95ff42 in do_command(THD*) /home/vsts/src/sql/sql_parse.cc:1398
#11 0xd53df4 in do_handle_one_connection(CONNECT*) /home/vsts/src/sql/sql_connect.cc:1403
#12 0xd536a8 in handle_one_connection /home/vsts/src/sql/sql_connect.cc:1308
#13 0x7fa687a5f6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
#14 0x7fa686e914dc in clone (/lib/x86_64-linux-gnu/libc.so.6+0x1074dc)
0x621000279b85 is located 17 bytes to the right of 4724-byte region [0x621000278900,0x621000279b74)
#0 0x7fa689551b80 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb80)
#1 0x25d9338 in sf_malloc /home/vsts/src/mysys/safemalloc.c:118
#2 0x25a7c52 in my_malloc /home/vsts/src/mysys/my_malloc.c:101
#3 0x258412c in alloc_root /home/vsts/src/mysys/my_alloc.c:251
#4 0xc6ce39 in TABLE_SHARE::init_from_binary_frm_image(THD, bool, unsigned char const, unsigned long) /home/vsts/src/sql/table.cc:1657
#5 0xc6492d in open_table_def(THD, TABLE_SHARE, unsigned int) /home/vsts/src/sql/table.cc:687
#6 0xf3f3e6 in tdc_acquire_share(THD, TABLE_LIST, unsigned int, TABLE**) /home/vsts/src/sql/table_cache.cc:840
#7 0x7ecd75 in open_table(THD, TABLE_LIST, Open_table_context*) /home/vsts/src/sql/sql_base.cc:1847
#8 0xbd6b01 in mysql_inplace_alter_table /home/vsts/src/sql/sql_table.cc:7773
#9 0xbe70cd in mysql_alter_table(THD, st_mysql_const_lex_string const, st_mysql_const_lex_string const, HA_CREATE_INFO, TABLE_LIST, Alter_info, unsigned int, st_order*, bool) /home/vsts/src/sql/sql_table.cc:9980
#10 0xd64ff1 in Sql_cmd_alter_table::execute(THD*) /home/vsts/src/sql/sql_alter.cc:512
#11 0x980887 in mysql_execute_command(THD*) /home/vsts/src/sql/sql_parse.cc:6052
#12 0x98d290 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /home/vsts/src/sql/sql_parse.cc:7840
#13 0x9637e1 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /home/vsts/src/sql/sql_parse.cc:1852
#14 0x95ff42 in do_command(THD*) /home/vsts/src/sql/sql_parse.cc:1398
#15 0xd53df4 in do_handle_one_connection(CONNECT*) /home/vsts/src/sql/sql_connect.cc:1403
#16 0xd536a8 in handle_one_connection /home/vsts/src/sql/sql_connect.cc:1308
#17 0x7fa687a5f6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
#0 0x7fa6894aad6f in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d6f)
#1 0x2609526 in spawn_thread_noop /home/vsts/src/mysys/psi_noop.c:187
#2 0x6745ec in inline_mysql_thread_create /home/vsts/src/include/mysql/psi/mysql_thread.h:1275
#3 0x68d7c6 in create_thread_to_handle_connection(CONNECT*) /home/vsts/src/sql/mysqld.cc:6660
#4 0x68df97 in create_new_thread /home/vsts/src/sql/mysqld.cc:6728
#5 0x68f149 in handle_connections_sockets() /home/vsts/src/sql/mysqld.cc:6986
#6 0x68cafe in mysqld_main(int, char**) /home/vsts/src/sql/mysqld.cc:6280
#7 0x672cc6 in main /home/vsts/src/sql/main.cc:25
#8 0x7fa686daa83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
#0 0x7fa6894aad6f in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d6f)
#1 0x2609526 in spawn_thread_noop /home/vsts/src/mysys/psi_noop.c:187
#2 0x6745ec in inline_mysql_thread_create /home/vsts/src/include/mysql/psi/mysql_thread.h:1275
#3 0x68d7c6 in create_thread_to_handle_connection(CONNECT*) /home/vsts/src/sql/mysqld.cc:6660
#4 0x68df97 in create_new_thread /home/vsts/src/sql/mysqld.cc:6728
#5 0x68f149 in handle_connections_sockets() /home/vsts/src/sql/mysqld.cc:6986
#6 0x68cafe in mysqld_main(int, char**) /home/vsts/src/sql/mysqld.cc:6280
#7 0x672cc6 in main /home/vsts/src/sql/main.cc:25
#8 0x7fa686daa83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/vsts/src/include/byte_order_generic_x86_64.h:92 in mi_uint5korr
0x0c4280047320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c4280047330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c4280047340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c4280047350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c4280047360: 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 04 fa
=>0x0c4280047370:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c4280047380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c4280047390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c42800473a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c42800473b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c42800473c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Container overflow: fc
210202 0:20:01 [ERROR] mysqld got signal 6 ;
or misconfigured. This error can also be caused by malfunctioning hardware.
Thread pointer: 0x62a0000ae270
stack_bottom = 0x7fa65900ba40 thread_stack 0x5fc00
/usr/lib/x86_64-linux-gnu/libasan.so.4(+0x55900)[0x7fa6894c8900]
maria/ma_blockrec.c:2240(store_page_range)[0x25b7760]
sql/rpl_utility.cc:336(table_def::calc_field_size(unsigned int, unsigned char*) const)[0x110d4f4]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x11390)[0x7fa687a69390]
linux/raise.c:54(__GI_raise)[0x7fa686dbf438]
stdlib/abort.c:91(__GI_abort)[0x7fa686dc103a]
/usr/lib/x86_64-linux-gnu/libasan.so.4(+0x10076e)[0x7fa68957376e]
/usr/lib/x86_64-linux-gnu/libasan.so.4(+0x108558)[0x7fa68957b558]
/usr/lib/x86_64-linux-gnu/libasan.so.4(+0xe9555)[0x7fa68955c555]
/usr/lib/x86_64-linux-gnu/libasan.so.4(__asan_report_load4+0x37)[0x7fa68955d227]
sql/sql_update.cc:2466(multi_update::send_data(List<Item>&))[0x104598f]
sql/sql_update.cc:2637(multi_update::do_updates())[0x1047cff]
sql/table.cc:8628(TABLE_LIST::change_refs_to_fields())[0x10a7f83]
sql/table.cc:6148(Field_iterator_table_ref::set_field_iterator())[0x10958a1]
sql/uniques.cc:697(Unique::merge(TABLE, unsigned char, bool))[0x10db739]
sql/sql_array.h:136(Dynamic_array<st_mysql_const_lex_string*>::at(unsigned long))[0xca5782]
/home/vsts/server/bin/mysqld(_Z12mysql_insertP3THDP10TABLE_LISTR4ListI4ItemERS3_IS5_ES6_S6_15enum_duplicatesb+0x1fab)[0x8c80bc]
/home/vsts/server/bin/mysqld(_Z21mysql_execute_commandP3THD+0x82a0)[0x974738]
/home/vsts/server/bin/mysqld(_Z11mysql_parseP3THDPcjP12Parser_statebb+0x701)[0x98d291]
/home/vsts/server/bin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcjbb+0x221b)[0x9637e2]
/home/vsts/server/bin/mysqld(_Z10do_commandP3THD+0x1515)[0x95ff43]
sql/sql_load.cc:2045(READ_INFO::read_xml(THD*))[0xd53df5]
sql/sql_load.cc:2005(READ_INFO::read_xml(THD*))[0xd536a9]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x76ba)[0x7fa687a5f6ba]
x86_64/clone.S:111(clone)[0x7fa686e914dd]
Query (0x62b00000e290): INSERT /* QNO 15365 CON_ID 15 */ IGNORE INTO `t7_InnoDB` ( `id`, `vcol_varchar` ) VALUES ( NULL, 'o' )
Status: NOT_KILLED

Elena Stepanova added a comment - 2021-02-02 15:24 Likely the same issue: 10.3 59eda73e ==20251==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000279b85 at pc 0x00000104598f bp 0x7fa659007ce0 sp 0x7fa659007cd0 READ of size 4 at 0x621000279b85 thread T32 #0 0x104598e in mi_uint5korr /home/vsts/src/include/byte_order_generic_x86_64.h:92 #1 0x1047cfe in my_datetime_packed_from_binary(unsigned char const*, unsigned int) /home/vsts/src/sql/compat56.cc:310 #2 0x10a7f82 in Field_datetimef::get_TIME(st_mysql_time*, unsigned char const*, unsigned long long) const /home/vsts/src/sql/field.cc:6929 #3 0x10958a0 in Field_temporal_with_date::validate_value_in_record(THD*, unsigned char const*) const /home/vsts/src/sql/field.cc:5743 #4 0x10db738 in Field::validate_value_in_record_with_warn(THD*, unsigned char const*) /home/vsts/src/sql/field.cc:11500 #5 0xca5781 in TABLE::validate_default_values_of_unset_fields(THD*) const /home/vsts/src/sql/table.cc:8231 #6 0x8c80bb in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /home/vsts/src/sql/sql_insert.cc:940 #7 0x974737 in mysql_execute_command(THD*) /home/vsts/src/sql/sql_parse.cc:4481 #8 0x98d290 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/vsts/src/sql/sql_parse.cc:7840 #9 0x9637e1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/vsts/src/sql/sql_parse.cc:1852 #10 0x95ff42 in do_command(THD*) /home/vsts/src/sql/sql_parse.cc:1398 #11 0xd53df4 in do_handle_one_connection(CONNECT*) /home/vsts/src/sql/sql_connect.cc:1403 #12 0xd536a8 in handle_one_connection /home/vsts/src/sql/sql_connect.cc:1308 #13 0x7fa687a5f6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9) #14 0x7fa686e914dc in clone (/lib/x86_64-linux-gnu/libc.so.6+0x1074dc) 0x621000279b85 is located 17 bytes to the right of 4724-byte region [0x621000278900,0x621000279b74) #0 0x7fa689551b80 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb80) #1 0x25d9338 in sf_malloc /home/vsts/src/mysys/safemalloc.c:118 #2 0x25a7c52 in my_malloc /home/vsts/src/mysys/my_malloc.c:101 #3 0x258412c in alloc_root /home/vsts/src/mysys/my_alloc.c:251 #4 0xc6ce39 in TABLE_SHARE::init_from_binary_frm_image(THD*, bool, unsigned char const*, unsigned long) /home/vsts/src/sql/table.cc:1657 #5 0xc6492d in open_table_def(THD*, TABLE_SHARE*, unsigned int) /home/vsts/src/sql/table.cc:687 #6 0xf3f3e6 in tdc_acquire_share(THD*, TABLE_LIST*, unsigned int, TABLE**) /home/vsts/src/sql/table_cache.cc:840 #7 0x7ecd75 in open_table(THD*, TABLE_LIST*, Open_table_context*) /home/vsts/src/sql/sql_base.cc:1847 #8 0xbd6b01 in mysql_inplace_alter_table /home/vsts/src/sql/sql_table.cc:7773 #9 0xbe70cd in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /home/vsts/src/sql/sql_table.cc:9980 #10 0xd64ff1 in Sql_cmd_alter_table::execute(THD*) /home/vsts/src/sql/sql_alter.cc:512 #11 0x980887 in mysql_execute_command(THD*) /home/vsts/src/sql/sql_parse.cc:6052 #12 0x98d290 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/vsts/src/sql/sql_parse.cc:7840 #13 0x9637e1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/vsts/src/sql/sql_parse.cc:1852 #14 0x95ff42 in do_command(THD*) /home/vsts/src/sql/sql_parse.cc:1398 #15 0xd53df4 in do_handle_one_connection(CONNECT*) /home/vsts/src/sql/sql_connect.cc:1403 #16 0xd536a8 in handle_one_connection /home/vsts/src/sql/sql_connect.cc:1308 #17 0x7fa687a5f6b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9) #0 0x7fa6894aad6f in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d6f) #1 0x2609526 in spawn_thread_noop /home/vsts/src/mysys/psi_noop.c:187 #2 0x6745ec in inline_mysql_thread_create /home/vsts/src/include/mysql/psi/mysql_thread.h:1275 #3 0x68d7c6 in create_thread_to_handle_connection(CONNECT*) /home/vsts/src/sql/mysqld.cc:6660 #4 0x68df97 in create_new_thread /home/vsts/src/sql/mysqld.cc:6728 #5 0x68f149 in handle_connections_sockets() /home/vsts/src/sql/mysqld.cc:6986 #6 0x68cafe in mysqld_main(int, char**) /home/vsts/src/sql/mysqld.cc:6280 #7 0x672cc6 in main /home/vsts/src/sql/main.cc:25 #8 0x7fa686daa83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) #0 0x7fa6894aad6f in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d6f) #1 0x2609526 in spawn_thread_noop /home/vsts/src/mysys/psi_noop.c:187 #2 0x6745ec in inline_mysql_thread_create /home/vsts/src/include/mysql/psi/mysql_thread.h:1275 #3 0x68d7c6 in create_thread_to_handle_connection(CONNECT*) /home/vsts/src/sql/mysqld.cc:6660 #4 0x68df97 in create_new_thread /home/vsts/src/sql/mysqld.cc:6728 #5 0x68f149 in handle_connections_sockets() /home/vsts/src/sql/mysqld.cc:6986 #6 0x68cafe in mysqld_main(int, char**) /home/vsts/src/sql/mysqld.cc:6280 #7 0x672cc6 in main /home/vsts/src/sql/main.cc:25 #8 0x7fa686daa83f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f) SUMMARY: AddressSanitizer: heap-buffer-overflow /home/vsts/src/include/byte_order_generic_x86_64.h:92 in mi_uint5korr 0x0c4280047320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4280047330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4280047340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4280047350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4280047360: 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 04 fa =>0x0c4280047370:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4280047380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4280047390: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c42800473a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c42800473b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c42800473c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Container overflow: fc 210202 0:20:01 [ERROR] mysqld got signal 6 ; or misconfigured. This error can also be caused by malfunctioning hardware. Thread pointer: 0x62a0000ae270 stack_bottom = 0x7fa65900ba40 thread_stack 0x5fc00 /usr/lib/x86_64-linux-gnu/libasan.so.4(+0x55900)[0x7fa6894c8900] maria/ma_blockrec.c:2240(store_page_range)[0x25b7760] sql/rpl_utility.cc:336(table_def::calc_field_size(unsigned int, unsigned char*) const)[0x110d4f4] /lib/x86_64-linux-gnu/libpthread.so.0(+0x11390)[0x7fa687a69390] linux/raise.c:54(__GI_raise)[0x7fa686dbf438] stdlib/abort.c:91(__GI_abort)[0x7fa686dc103a] /usr/lib/x86_64-linux-gnu/libasan.so.4(+0x10076e)[0x7fa68957376e] /usr/lib/x86_64-linux-gnu/libasan.so.4(+0x108558)[0x7fa68957b558] /usr/lib/x86_64-linux-gnu/libasan.so.4(+0xe9555)[0x7fa68955c555] /usr/lib/x86_64-linux-gnu/libasan.so.4(__asan_report_load4+0x37)[0x7fa68955d227] sql/sql_update.cc:2466(multi_update::send_data(List<Item>&))[0x104598f] sql/sql_update.cc:2637(multi_update::do_updates())[0x1047cff] sql/table.cc:8628(TABLE_LIST::change_refs_to_fields())[0x10a7f83] sql/table.cc:6148(Field_iterator_table_ref::set_field_iterator())[0x10958a1] sql/uniques.cc:697(Unique::merge(TABLE*, unsigned char*, bool))[0x10db739] sql/sql_array.h:136(Dynamic_array<st_mysql_const_lex_string*>::at(unsigned long))[0xca5782] /home/vsts/server/bin/mysqld(_Z12mysql_insertP3THDP10TABLE_LISTR4ListI4ItemERS3_IS5_ES6_S6_15enum_duplicatesb+0x1fab)[0x8c80bc] /home/vsts/server/bin/mysqld(_Z21mysql_execute_commandP3THD+0x82a0)[0x974738] /home/vsts/server/bin/mysqld(_Z11mysql_parseP3THDPcjP12Parser_statebb+0x701)[0x98d291] /home/vsts/server/bin/mysqld(_Z16dispatch_command19enum_server_commandP3THDPcjbb+0x221b)[0x9637e2] /home/vsts/server/bin/mysqld(_Z10do_commandP3THD+0x1515)[0x95ff43] sql/sql_load.cc:2045(READ_INFO::read_xml(THD*))[0xd53df5] sql/sql_load.cc:2005(READ_INFO::read_xml(THD*))[0xd536a9] /lib/x86_64-linux-gnu/libpthread.so.0(+0x76ba)[0x7fa687a5f6ba] x86_64/clone.S:111(clone)[0x7fa686e914dd] Query (0x62b00000e290): INSERT /* QNO 15365 CON_ID 15 */ IGNORE INTO `t7_InnoDB` ( `id`, `vcol_varchar` ) VALUES ( NULL, 'o' ) Status: NOT_KILLED

Elena Stepanova added a comment - 2021-02-18 13:31

More failures of the same variety, or at least I am going to consider them such until this issue is fixed.

These happen with a different test case, but also after a failed LOAD similar to the one in the test from the description, also ER_DATA_TOO_LONG and the target table has virtual columns; only this time the next command is ALTER.

10.3 da88e1ec ASAN
==219062==ERROR: AddressSanitizer: use-after-poison on address 0x61900008a562 at pc 0x55f0cf56800f bp 0x7f568de31620 sp 0x7f568de31610
READ of size 4 at 0x61900008a562 thread T5
#0 0x55f0cf56800e in Field_long::val_str(String, String) /data/src/10.3/sql/field.cc:4306
#1 0x55f0cebf452f in Field::val_str(String*) /data/src/10.3/sql/field.h:854
#2 0x55f0cf5c5861 in Field::val_str(String, unsigned char const) /data/src/10.3/sql/field.h:1353
#3 0x55f0cf5bed04 in Column_definition::Column_definition(THD, Field, Field*) /data/src/10.3/sql/field.cc:11184
#4 0x55f0cee0682d in Create_field::Create_field(THD, Field, Field*) /data/src/10.3/sql/field.h:4776
#5 0x55f0cf0d78c0 in mysql_prepare_alter_table(THD, TABLE, HA_CREATE_INFO, Alter_info, Alter_table_ctx*) /data/src/10.3/sql/sql_table.cc:8168
#6 0x55f0cf0e2831 in mysql_alter_table(THD, st_mysql_const_lex_string const, st_mysql_const_lex_string const, HA_CREATE_INFO, TABLE_LIST, Alter_info, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:9662
#7 0x55f0cf25062c in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:512
#8 0x55f0cee95361 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6052
#9 0x55f0ceea1991 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7840
#10 0x55f0cee787d5 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
#11 0x55f0cee7530c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
#12 0x55f0cf23fa9f in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
#13 0x55f0cf23f359 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
#14 0x55f0d0858a44 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
#15 0x7f5698ce6608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
#16 0x7f56988c0292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x61900008a562 is located 738 bytes inside of 1100-byte region [0x61900008a280,0x61900008a6cc)
allocated by thread T5 here:
#0 0x7f569924dbc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
#1 0x55f0d09a3077 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
#2 0x55f0d0970edf in my_malloc /data/src/10.3/mysys/my_malloc.c:101
#3 0x55f0d094cf4c in alloc_root /data/src/10.3/mysys/my_alloc.c:251
#4 0x55f0d094e7ab in memdup_root /data/src/10.3/mysys/my_alloc.c:494
#5 0x55f0cf161499 in TABLE_SHARE::init_from_binary_frm_image(THD, bool, unsigned char const, unsigned long) /data/src/10.3/sql/table.cc:1304
#6 0x55f0cf15cbf7 in open_table_def(THD, TABLE_SHARE, unsigned int) /data/src/10.3/sql/table.cc:687
#7 0x55f0cf427256 in tdc_acquire_share(THD, TABLE_LIST, unsigned int, TABLE**) /data/src/10.3/sql/table_cache.cc:840
#8 0x55f0ced0c505 in open_table(THD, TABLE_LIST, Open_table_context*) /data/src/10.3/sql/sql_base.cc:1847
#9 0x55f0ced166ec in open_and_process_table /data/src/10.3/sql/sql_base.cc:3730
#10 0x55f0ced18d0f in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4199
#11 0x55f0ced1de07 in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5128
#12 0x55f0cec8222f in open_and_lock_tables(THD, TABLE_LIST, bool, unsigned int) /data/src/10.3/sql/sql_base.h:503
#13 0x55f0cede0a2b in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.3/sql/sql_insert.cc:760
#14 0x55f0cee89383 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4481
#15 0x55f0ceea1991 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7840
#16 0x55f0cee787d5 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
#17 0x55f0cee7530c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
#18 0x55f0cf23fa9f in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
#19 0x55f0cf23f359 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
#20 0x55f0d0858a44 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
#21 0x7f5698ce6608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477

Thread T5 created by T0 here:
#0 0x7f569917a805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
#1 0x55f0d0858e35 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919
#2 0x55f0ceba015e in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275
#3 0x55f0cebb8b2d in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6658
#4 0x55f0cebb92c8 in create_new_thread /data/src/10.3/sql/mysqld.cc:6728
#5 0x55f0cebba45a in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6986
#6 0x55f0cebb7e1e in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6280
#7 0x55f0ceb9e95c in main /data/src/10.3/sql/main.cc:25
#8 0x7f56987c50b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: use-after-poison /data/src/10.3/sql/field.cc:4306 in Field_long::val_str(String, String)
Shadow bytes around the buggy address:
0x0c3280009450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3280009460: 00 f7 00 00 f7 01 f7 00 00 00 00 00 00 00 00 00
0x0c3280009470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3280009480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3280009490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c32800094a0: 02 f7 00 00 00 f7 00 00 00 00 00 f7[f7]01 f7 00
0x0c32800094b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c32800094c0: 00 00 00 00 00 00 00 00 00 00 f7 00 00 f7 00 00
0x0c32800094d0: 00 f7 00 00 00 00 00 00 f7 04 fa fa fa fa fa fa
0x0c32800094e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c32800094f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==219062==ABORTING

10.3 da88e1ec debug
mysqld: /data/src/10.3/sql/compat56.cc:258: void TIME_from_longlong_datetime_packed(MYSQL_TIME*, longlong): Assertion `tmp != ((long long) 0x8000000000000000LL)' failed.
210218 15:27:49 [ERROR] mysqld got signal 6 ;

#7 0x00007fcd9b0c3f36 in __GI___assert_fail (assertion=0x564e8594fbb0 "tmp != ((long long) 0x8", '0' <repeats 15 times>, "LL)", file=0x564e8594f930 "/data/src/10.3/sql/compat56.cc", line=258, function=0x564e8594fb70 "void TIME_from_longlong_datetime_packed(MYSQL_TIME*, longlong)") at assert.c:101
#8 0x0000564e84e76a9f in TIME_from_longlong_datetime_packed (ltime=0x7fcd950e55c0, tmp=-9223372036854775808) at /data/src/10.3/sql/compat56.cc:258
#9 0x0000564e84e982a8 in Field_datetimef::get_TIME (this=0x7fcd840aadc8, ltime=0x7fcd950e55c0, pos=0x7fcd84006fd9 "", fuzzydate=0) at /data/src/10.3/sql/field.cc:6930
#10 0x0000564e84eb0364 in Field_datetimef::get_date (this=0x7fcd840aadc8, ltime=0x7fcd950e55c0, fuzzydate=0) at /data/src/10.3/sql/field.h:3270
#11 0x0000564e84e97cae in Field_datetime_with_dec::val_str (this=0x7fcd840aadc8, str=0x7fcd950e56b0, unused=0x7fcd950e56b0) at /data/src/10.3/sql/field.cc:6875
#12 0x0000564e84a7fa45 in Field::val_str (this=0x7fcd840aadc8, str=0x7fcd950e56b0) at /data/src/10.3/sql/field.h:854
#13 0x0000564e84eac9f5 in Field::val_str (this=0x7fcd840aadc8, str=0x7fcd950e56b0, new_ptr=0x7fcd84006fd9 "") at /data/src/10.3/sql/field.h:1353
#14 0x0000564e84ea9df0 in Column_definition::Column_definition (this=0x7fcd84014280, thd=0x7fcd84000d90, old_field=0x7fcd840aadc8, orig_field=0x7fcd840aadc8) at /data/src/10.3/sql/field.cc:11184
#15 0x0000564e84b616b6 in Create_field::Create_field (this=0x7fcd84014280, thd=0x7fcd84000d90, old_field=0x7fcd840aadc8, orig_field=0x7fcd840aadc8) at /data/src/10.3/sql/field.h:4776
#16 0x0000564e84c7f6d4 in mysql_prepare_alter_table (thd=0x7fcd84000d90, table=0x7fcd840373c0, create_info=0x7fcd950e74d0, alter_info=0x7fcd950e7410, alter_ctx=0x7fcd950e68e0) at /data/src/10.3/sql/sql_table.cc:8168
#17 0x0000564e84c83f1f in mysql_alter_table (thd=0x7fcd84000d90, new_db=0x7fcd84005478, new_name=0x7fcd84005840, create_info=0x7fcd950e74d0, table_list=0x7fcd84012bf8, alter_info=0x7fcd950e7410, order_num=0, order=0x0, ignore=false) at /data/src/10.3/sql/sql_table.cc:9662
#18 0x0000564e84d153fe in Sql_cmd_alter_table::execute (this=0x7fcd84013280, thd=0x7fcd84000d90) at /data/src/10.3/sql/sql_alter.cc:512
#19 0x0000564e84ba0321 in mysql_execute_command (thd=0x7fcd84000d90) at /data/src/10.3/sql/sql_parse.cc:6052
#20 0x0000564e84ba5b88 in mysql_parse (thd=0x7fcd84000d90, rawbuf=0x7fcd84012ab8 "ALTER TABLE /* 100502 IF EXISTS / CC /!100301 */ DROP PRIMARY KEY, LOCK=NONE", length=78, parser_state=0x7fcd950e85c0, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:7840
#21 0x0000564e84b922ec in dispatch_command (command=COM_QUERY, thd=0x7fcd84000d90, packet=0x7fcd84008f11 "ALTER TABLE /!100502 IF EXISTS / CC /!100301 / DROP PRIMARY KEY, LOCK=NONE", packet_length=78, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1852
#22 0x0000564e84b90c8c in do_command (thd=0x7fcd84000d90) at /data/src/10.3/sql/sql_parse.cc:1398
#23 0x0000564e84d0f295 in do_handle_one_connection (connect=0x564e87f92070) at /data/src/10.3/sql/sql_connect.cc:1403
#24 0x0000564e84d0eff1 in handle_one_connection (arg=0x564e87f92070) at /data/src/10.3/sql/sql_connect.cc:1308
#25 0x0000564e856db061 in pfs_spawn_thread (arg=0x564e87f75440) at /data/src/10.3/storage/perfschema/pfs.cc:1869
#26 0x00007fcd9b5d3609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#27 0x00007fcd9b1af293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

And these are variations with the exact test case from the description, only INSERT is replaced with ALTER:

CREATE TABLE t1 (id INT PRIMARY KEY, ts TIMESTAMP DEFAULT '1971-01-01 00:00:00', c VARBINARY(8) DEFAULT '', vc VARCHAR(3) AS (c) STORED);

INSERT IGNORE INTO t1 (id,c) VALUES (1,'foobar');

SELECT id, ts, vc INTO OUTFILE 'load_t1' FROM t1;

--error 0,ER_DATA_TOO_LONG

LOAD DATA INFILE 'load_t1' REPLACE INTO TABLE t1 (id, ts, vc);

ALTER TABLE t1 DROP PRIMARY KEY;

# Cleanup

DROP TABLE t1;

--let $datadir= `select @@datadir`

--remove_file $datadir/test/load_t1

10.3 da88e1ec debug
mysqltest: At line 6: query 'ALTER TABLE t1 DROP PRIMARY KEY' failed: 1292: Incorrect datetime value: '2046-04-28 20:42:24' for column ``.``.`ts` at row 1

10.3 da88e1ec ASAN
==221218==ERROR: AddressSanitizer: use-after-poison on address 0x61900008a447 at pc 0x564afac31fe5 bp 0x7ff1d92b4380 sp 0x7ff1d92b4370
READ of size 1 at 0x61900008a447 thread T5
#0 0x564afac31fe4 in my_timestamp_from_binary(timeval, unsigned char const, unsigned int) /data/src/10.3/sql/compat56.cc:394
#1 0x564afac79a0e in Field_timestampf::get_timestamp(unsigned char const, unsigned long) const /data/src/10.3/sql/field.cc:5582
#2 0x564afacc9188 in Field_timestamp::get_timestamp(unsigned long*) const /data/src/10.3/sql/field.h:2703
#3 0x564afac757b3 in Field_timestamp::get_date(st_mysql_time*, unsigned long long) /data/src/10.3/sql/field.cc:5315
#4 0x564afac74778 in Field_timestamp::val_str(String, String) /data/src/10.3/sql/field.cc:5240
#5 0x564afa2f252f in Field::val_str(String*) /data/src/10.3/sql/field.h:854
#6 0x564afacc3861 in Field::val_str(String, unsigned char const) /data/src/10.3/sql/field.h:1353
#7 0x564afacbcd04 in Column_definition::Column_definition(THD, Field, Field*) /data/src/10.3/sql/field.cc:11184
#8 0x564afa50482d in Create_field::Create_field(THD, Field, Field*) /data/src/10.3/sql/field.h:4776
#9 0x564afa7d58c0 in mysql_prepare_alter_table(THD, TABLE, HA_CREATE_INFO, Alter_info, Alter_table_ctx*) /data/src/10.3/sql/sql_table.cc:8168
#10 0x564afa7e0831 in mysql_alter_table(THD, st_mysql_const_lex_string const, st_mysql_const_lex_string const, HA_CREATE_INFO, TABLE_LIST, Alter_info, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:9662
#11 0x564afa94e62c in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:512
#12 0x564afa593361 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6052
#13 0x564afa59f991 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7840
#14 0x564afa5767d5 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
#15 0x564afa57330c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
#16 0x564afa93da9f in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
#17 0x564afa93d359 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
#18 0x564afbf56a44 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
#19 0x7ff1e416b608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
#20 0x7ff1e3d45292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x61900008a447 is located 455 bytes inside of 1100-byte region [0x61900008a280,0x61900008a6cc)
allocated by thread T5 here:
#0 0x7ff1e46d2bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
#1 0x564afc0a1077 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
#2 0x564afc06eedf in my_malloc /data/src/10.3/mysys/my_malloc.c:101
#3 0x564afc04af4c in alloc_root /data/src/10.3/mysys/my_alloc.c:251
#4 0x564afc04c7ab in memdup_root /data/src/10.3/mysys/my_alloc.c:494
#5 0x564afa85f499 in TABLE_SHARE::init_from_binary_frm_image(THD, bool, unsigned char const, unsigned long) /data/src/10.3/sql/table.cc:1304
#6 0x564afa85abf7 in open_table_def(THD, TABLE_SHARE, unsigned int) /data/src/10.3/sql/table.cc:687
#7 0x564afab25256 in tdc_acquire_share(THD, TABLE_LIST, unsigned int, TABLE**) /data/src/10.3/sql/table_cache.cc:840
#8 0x564afa40a505 in open_table(THD, TABLE_LIST, Open_table_context*) /data/src/10.3/sql/sql_base.cc:1847
#9 0x564afa4146ec in open_and_process_table /data/src/10.3/sql/sql_base.cc:3730
#10 0x564afa416d0f in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4199
#11 0x564afa41be07 in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5128
#12 0x564afa38022f in open_and_lock_tables(THD, TABLE_LIST, bool, unsigned int) /data/src/10.3/sql/sql_base.h:503
#13 0x564afa4dea2b in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.3/sql/sql_insert.cc:760
#14 0x564afa587383 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4481
#15 0x564afa59f991 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7840
#16 0x564afa5767d5 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
#17 0x564afa57330c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
#18 0x564afa93da9f in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
#19 0x564afa93d359 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
#20 0x564afbf56a44 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
#21 0x7ff1e416b608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477

Thread T5 created by T0 here:
#0 0x7ff1e45ff805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
#1 0x564afbf56e35 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919
#2 0x564afa29e15e in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275
#3 0x564afa2b6b2d in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6658
#4 0x564afa2b72c8 in create_new_thread /data/src/10.3/sql/mysqld.cc:6728
#5 0x564afa2b845a in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6986
#6 0x564afa2b5e1e in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6280
#7 0x564afa29c95c in main /data/src/10.3/sql/main.cc:25
#8 0x7ff1e3c4a0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: use-after-poison /data/src/10.3/sql/compat56.cc:394 in my_timestamp_from_binary(timeval, unsigned char const, unsigned int)
Shadow bytes around the buggy address:
0x0c3280009430: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3280009440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3280009450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3280009460: 00 f7 00 00 f7 01 f7 00 00 00 00 00 00 00 00 00
0x0c3280009470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3280009480: 00 02 f7 00 f7 00 00 06[f7]01 f7 00 00 00 00 00
0x0c3280009490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c32800094a0: 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00
0x0c32800094b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c32800094c0: 00 f7 00 00 f7 00 00 00 00 00 00 f7 03 f7 04 f7
0x0c32800094d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 04 fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==221218==ABORTING

Elena Stepanova added a comment - 2021-02-18 13:31 More failures of the same variety, or at least I am going to consider them such until this issue is fixed. These happen with a different test case, but also after a failed LOAD similar to the one in the test from the description, also ER_DATA_TOO_LONG and the target table has virtual columns; only this time the next command is ALTER. 10.3 da88e1ec ASAN ==219062==ERROR: AddressSanitizer: use-after-poison on address 0x61900008a562 at pc 0x55f0cf56800f bp 0x7f568de31620 sp 0x7f568de31610 READ of size 4 at 0x61900008a562 thread T5 #0 0x55f0cf56800e in Field_long::val_str(String*, String*) /data/src/10.3/sql/field.cc:4306 #1 0x55f0cebf452f in Field::val_str(String*) /data/src/10.3/sql/field.h:854 #2 0x55f0cf5c5861 in Field::val_str(String*, unsigned char const*) /data/src/10.3/sql/field.h:1353 #3 0x55f0cf5bed04 in Column_definition::Column_definition(THD*, Field*, Field*) /data/src/10.3/sql/field.cc:11184 #4 0x55f0cee0682d in Create_field::Create_field(THD*, Field*, Field*) /data/src/10.3/sql/field.h:4776 #5 0x55f0cf0d78c0 in mysql_prepare_alter_table(THD*, TABLE*, HA_CREATE_INFO*, Alter_info*, Alter_table_ctx*) /data/src/10.3/sql/sql_table.cc:8168 #6 0x55f0cf0e2831 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:9662 #7 0x55f0cf25062c in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:512 #8 0x55f0cee95361 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6052 #9 0x55f0ceea1991 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7840 #10 0x55f0cee787d5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852 #11 0x55f0cee7530c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398 #12 0x55f0cf23fa9f in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403 #13 0x55f0cf23f359 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308 #14 0x55f0d0858a44 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869 #15 0x7f5698ce6608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477 #16 0x7f56988c0292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292) 0x61900008a562 is located 738 bytes inside of 1100-byte region [0x61900008a280,0x61900008a6cc) allocated by thread T5 here: #0 0x7f569924dbc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8) #1 0x55f0d09a3077 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118 #2 0x55f0d0970edf in my_malloc /data/src/10.3/mysys/my_malloc.c:101 #3 0x55f0d094cf4c in alloc_root /data/src/10.3/mysys/my_alloc.c:251 #4 0x55f0d094e7ab in memdup_root /data/src/10.3/mysys/my_alloc.c:494 #5 0x55f0cf161499 in TABLE_SHARE::init_from_binary_frm_image(THD*, bool, unsigned char const*, unsigned long) /data/src/10.3/sql/table.cc:1304 #6 0x55f0cf15cbf7 in open_table_def(THD*, TABLE_SHARE*, unsigned int) /data/src/10.3/sql/table.cc:687 #7 0x55f0cf427256 in tdc_acquire_share(THD*, TABLE_LIST*, unsigned int, TABLE**) /data/src/10.3/sql/table_cache.cc:840 #8 0x55f0ced0c505 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.3/sql/sql_base.cc:1847 #9 0x55f0ced166ec in open_and_process_table /data/src/10.3/sql/sql_base.cc:3730 #10 0x55f0ced18d0f in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4199 #11 0x55f0ced1de07 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5128 #12 0x55f0cec8222f in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:503 #13 0x55f0cede0a2b in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.3/sql/sql_insert.cc:760 #14 0x55f0cee89383 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4481 #15 0x55f0ceea1991 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7840 #16 0x55f0cee787d5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852 #17 0x55f0cee7530c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398 #18 0x55f0cf23fa9f in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403 #19 0x55f0cf23f359 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308 #20 0x55f0d0858a44 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869 #21 0x7f5698ce6608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477 Thread T5 created by T0 here: #0 0x7f569917a805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805) #1 0x55f0d0858e35 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919 #2 0x55f0ceba015e in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275 #3 0x55f0cebb8b2d in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6658 #4 0x55f0cebb92c8 in create_new_thread /data/src/10.3/sql/mysqld.cc:6728 #5 0x55f0cebba45a in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6986 #6 0x55f0cebb7e1e in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6280 #7 0x55f0ceb9e95c in main /data/src/10.3/sql/main.cc:25 #8 0x7f56987c50b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) SUMMARY: AddressSanitizer: use-after-poison /data/src/10.3/sql/field.cc:4306 in Field_long::val_str(String*, String*) Shadow bytes around the buggy address: 0x0c3280009450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3280009460: 00 f7 00 00 f7 01 f7 00 00 00 00 00 00 00 00 00 0x0c3280009470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3280009480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3280009490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c32800094a0: 02 f7 00 00 00 f7 00 00 00 00 00 f7[f7]01 f7 00 0x0c32800094b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c32800094c0: 00 00 00 00 00 00 00 00 00 00 f7 00 00 f7 00 00 0x0c32800094d0: 00 f7 00 00 00 00 00 00 f7 04 fa fa fa fa fa fa 0x0c32800094e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c32800094f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==219062==ABORTING 10.3 da88e1ec debug mysqld: /data/src/10.3/sql/compat56.cc:258: void TIME_from_longlong_datetime_packed(MYSQL_TIME*, longlong): Assertion `tmp != ((long long) 0x8000000000000000LL)' failed. 210218 15:27:49 [ERROR] mysqld got signal 6 ; #7 0x00007fcd9b0c3f36 in __GI___assert_fail (assertion=0x564e8594fbb0 "tmp != ((long long) 0x8", '0' <repeats 15 times>, "LL)", file=0x564e8594f930 "/data/src/10.3/sql/compat56.cc", line=258, function=0x564e8594fb70 "void TIME_from_longlong_datetime_packed(MYSQL_TIME*, longlong)") at assert.c:101 #8 0x0000564e84e76a9f in TIME_from_longlong_datetime_packed (ltime=0x7fcd950e55c0, tmp=-9223372036854775808) at /data/src/10.3/sql/compat56.cc:258 #9 0x0000564e84e982a8 in Field_datetimef::get_TIME (this=0x7fcd840aadc8, ltime=0x7fcd950e55c0, pos=0x7fcd84006fd9 "", fuzzydate=0) at /data/src/10.3/sql/field.cc:6930 #10 0x0000564e84eb0364 in Field_datetimef::get_date (this=0x7fcd840aadc8, ltime=0x7fcd950e55c0, fuzzydate=0) at /data/src/10.3/sql/field.h:3270 #11 0x0000564e84e97cae in Field_datetime_with_dec::val_str (this=0x7fcd840aadc8, str=0x7fcd950e56b0, unused=0x7fcd950e56b0) at /data/src/10.3/sql/field.cc:6875 #12 0x0000564e84a7fa45 in Field::val_str (this=0x7fcd840aadc8, str=0x7fcd950e56b0) at /data/src/10.3/sql/field.h:854 #13 0x0000564e84eac9f5 in Field::val_str (this=0x7fcd840aadc8, str=0x7fcd950e56b0, new_ptr=0x7fcd84006fd9 "") at /data/src/10.3/sql/field.h:1353 #14 0x0000564e84ea9df0 in Column_definition::Column_definition (this=0x7fcd84014280, thd=0x7fcd84000d90, old_field=0x7fcd840aadc8, orig_field=0x7fcd840aadc8) at /data/src/10.3/sql/field.cc:11184 #15 0x0000564e84b616b6 in Create_field::Create_field (this=0x7fcd84014280, thd=0x7fcd84000d90, old_field=0x7fcd840aadc8, orig_field=0x7fcd840aadc8) at /data/src/10.3/sql/field.h:4776 #16 0x0000564e84c7f6d4 in mysql_prepare_alter_table (thd=0x7fcd84000d90, table=0x7fcd840373c0, create_info=0x7fcd950e74d0, alter_info=0x7fcd950e7410, alter_ctx=0x7fcd950e68e0) at /data/src/10.3/sql/sql_table.cc:8168 #17 0x0000564e84c83f1f in mysql_alter_table (thd=0x7fcd84000d90, new_db=0x7fcd84005478, new_name=0x7fcd84005840, create_info=0x7fcd950e74d0, table_list=0x7fcd84012bf8, alter_info=0x7fcd950e7410, order_num=0, order=0x0, ignore=false) at /data/src/10.3/sql/sql_table.cc:9662 #18 0x0000564e84d153fe in Sql_cmd_alter_table::execute (this=0x7fcd84013280, thd=0x7fcd84000d90) at /data/src/10.3/sql/sql_alter.cc:512 #19 0x0000564e84ba0321 in mysql_execute_command (thd=0x7fcd84000d90) at /data/src/10.3/sql/sql_parse.cc:6052 #20 0x0000564e84ba5b88 in mysql_parse (thd=0x7fcd84000d90, rawbuf=0x7fcd84012ab8 "ALTER TABLE /* 100502 IF EXISTS */ CC /*!100301 */ DROP PRIMARY KEY, LOCK=NONE", length=78, parser_state=0x7fcd950e85c0, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:7840 #21 0x0000564e84b922ec in dispatch_command (command=COM_QUERY, thd=0x7fcd84000d90, packet=0x7fcd84008f11 "ALTER TABLE /*!100502 IF EXISTS */ CC /*!100301 */ DROP PRIMARY KEY, LOCK=NONE", packet_length=78, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1852 #22 0x0000564e84b90c8c in do_command (thd=0x7fcd84000d90) at /data/src/10.3/sql/sql_parse.cc:1398 #23 0x0000564e84d0f295 in do_handle_one_connection (connect=0x564e87f92070) at /data/src/10.3/sql/sql_connect.cc:1403 #24 0x0000564e84d0eff1 in handle_one_connection (arg=0x564e87f92070) at /data/src/10.3/sql/sql_connect.cc:1308 #25 0x0000564e856db061 in pfs_spawn_thread (arg=0x564e87f75440) at /data/src/10.3/storage/perfschema/pfs.cc:1869 #26 0x00007fcd9b5d3609 in start_thread (arg=<optimized out>) at pthread_create.c:477 #27 0x00007fcd9b1af293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 And these are variations with the exact test case from the description, only INSERT is replaced with ALTER: CREATE TABLE t1 (id INT PRIMARY KEY , ts TIMESTAMP DEFAULT '1971-01-01 00:00:00' , c VARBINARY(8) DEFAULT '' , vc VARCHAR (3) AS (c) STORED); INSERT IGNORE INTO t1 (id,c) VALUES (1, 'foobar' ); SELECT id, ts, vc INTO OUTFILE 'load_t1' FROM t1; --error 0,ER_DATA_TOO_LONG LOAD DATA INFILE 'load_t1' REPLACE INTO TABLE t1 (id, ts, vc); ALTER TABLE t1 DROP PRIMARY KEY ; # Cleanup DROP TABLE t1; --let $datadir= `select @@datadir` --remove_file $datadir/test/load_t1 10.3 da88e1ec debug mysqltest: At line 6: query 'ALTER TABLE t1 DROP PRIMARY KEY' failed: 1292: Incorrect datetime value: '2046-04-28 20:42:24' for column ``.``.`ts` at row 1 10.3 da88e1ec ASAN ==221218==ERROR: AddressSanitizer: use-after-poison on address 0x61900008a447 at pc 0x564afac31fe5 bp 0x7ff1d92b4380 sp 0x7ff1d92b4370 READ of size 1 at 0x61900008a447 thread T5 #0 0x564afac31fe4 in my_timestamp_from_binary(timeval*, unsigned char const*, unsigned int) /data/src/10.3/sql/compat56.cc:394 #1 0x564afac79a0e in Field_timestampf::get_timestamp(unsigned char const*, unsigned long*) const /data/src/10.3/sql/field.cc:5582 #2 0x564afacc9188 in Field_timestamp::get_timestamp(unsigned long*) const /data/src/10.3/sql/field.h:2703 #3 0x564afac757b3 in Field_timestamp::get_date(st_mysql_time*, unsigned long long) /data/src/10.3/sql/field.cc:5315 #4 0x564afac74778 in Field_timestamp::val_str(String*, String*) /data/src/10.3/sql/field.cc:5240 #5 0x564afa2f252f in Field::val_str(String*) /data/src/10.3/sql/field.h:854 #6 0x564afacc3861 in Field::val_str(String*, unsigned char const*) /data/src/10.3/sql/field.h:1353 #7 0x564afacbcd04 in Column_definition::Column_definition(THD*, Field*, Field*) /data/src/10.3/sql/field.cc:11184 #8 0x564afa50482d in Create_field::Create_field(THD*, Field*, Field*) /data/src/10.3/sql/field.h:4776 #9 0x564afa7d58c0 in mysql_prepare_alter_table(THD*, TABLE*, HA_CREATE_INFO*, Alter_info*, Alter_table_ctx*) /data/src/10.3/sql/sql_table.cc:8168 #10 0x564afa7e0831 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:9662 #11 0x564afa94e62c in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:512 #12 0x564afa593361 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6052 #13 0x564afa59f991 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7840 #14 0x564afa5767d5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852 #15 0x564afa57330c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398 #16 0x564afa93da9f in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403 #17 0x564afa93d359 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308 #18 0x564afbf56a44 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869 #19 0x7ff1e416b608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477 #20 0x7ff1e3d45292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292) 0x61900008a447 is located 455 bytes inside of 1100-byte region [0x61900008a280,0x61900008a6cc) allocated by thread T5 here: #0 0x7ff1e46d2bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8) #1 0x564afc0a1077 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118 #2 0x564afc06eedf in my_malloc /data/src/10.3/mysys/my_malloc.c:101 #3 0x564afc04af4c in alloc_root /data/src/10.3/mysys/my_alloc.c:251 #4 0x564afc04c7ab in memdup_root /data/src/10.3/mysys/my_alloc.c:494 #5 0x564afa85f499 in TABLE_SHARE::init_from_binary_frm_image(THD*, bool, unsigned char const*, unsigned long) /data/src/10.3/sql/table.cc:1304 #6 0x564afa85abf7 in open_table_def(THD*, TABLE_SHARE*, unsigned int) /data/src/10.3/sql/table.cc:687 #7 0x564afab25256 in tdc_acquire_share(THD*, TABLE_LIST*, unsigned int, TABLE**) /data/src/10.3/sql/table_cache.cc:840 #8 0x564afa40a505 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.3/sql/sql_base.cc:1847 #9 0x564afa4146ec in open_and_process_table /data/src/10.3/sql/sql_base.cc:3730 #10 0x564afa416d0f in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4199 #11 0x564afa41be07 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5128 #12 0x564afa38022f in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:503 #13 0x564afa4dea2b in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool) /data/src/10.3/sql/sql_insert.cc:760 #14 0x564afa587383 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:4481 #15 0x564afa59f991 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7840 #16 0x564afa5767d5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852 #17 0x564afa57330c in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398 #18 0x564afa93da9f in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403 #19 0x564afa93d359 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308 #20 0x564afbf56a44 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869 #21 0x7ff1e416b608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477 Thread T5 created by T0 here: #0 0x7ff1e45ff805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805) #1 0x564afbf56e35 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919 #2 0x564afa29e15e in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275 #3 0x564afa2b6b2d in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6658 #4 0x564afa2b72c8 in create_new_thread /data/src/10.3/sql/mysqld.cc:6728 #5 0x564afa2b845a in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6986 #6 0x564afa2b5e1e in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6280 #7 0x564afa29c95c in main /data/src/10.3/sql/main.cc:25 #8 0x7ff1e3c4a0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) SUMMARY: AddressSanitizer: use-after-poison /data/src/10.3/sql/compat56.cc:394 in my_timestamp_from_binary(timeval*, unsigned char const*, unsigned int) Shadow bytes around the buggy address: 0x0c3280009430: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3280009440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3280009450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3280009460: 00 f7 00 00 f7 01 f7 00 00 00 00 00 00 00 00 00 0x0c3280009470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c3280009480: 00 02 f7 00 f7 00 00 06[f7]01 f7 00 00 00 00 00 0x0c3280009490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c32800094a0: 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00 0x0c32800094b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c32800094c0: 00 f7 00 00 f7 00 00 00 00 00 00 f7 03 f7 04 f7 0x0c32800094d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 04 fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==221218==ABORTING

People

Assignee:: Nikita Malyavin

Reporter:: Elena Stepanova

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2021-01-24 00:28

Updated:: 2021-04-26 13:43

Resolved:: 2021-04-26 13:43

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server