Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-27239

Spider: Assertion `thd->transaction->stmt.ha_list == __null || trans == &thd->transaction->stmt' failed in ha_commit_trans on BEGIN WORK after FTWRL

Details

    Description

      Possibly connected with MDEV-27240 but versions are different, and issue does not reproduce with InnoDB.

      INSTALL PLUGIN spider SONAME 'ha_spider.so';
      CREATE TABLE t0 (s0 INT) ENGINE=SPIDER;
      FLUSH TABLE t0 WITH READ LOCK;
      BEGIN WORK;
      

      Leads to:

      10.7.2 979b23d5bfb11bb698ea65c9468b374978737ec0 (Debug)

      mysqld: /test/10.7_dbg/sql/handler.cc:1635: int ha_commit_trans(THD*, bool): Assertion `thd->transaction->stmt.ha_list == __null || trans == &thd->transaction->stmt' failed.
      

      10.7.2 979b23d5bfb11bb698ea65c9468b374978737ec0 (Debug)

      Core was generated by `/test/MD121221-mariadb-10.7.2-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      [Current thread is 1 (Thread 0x14a93adc8700 (LWP 482208))]
      (gdb) bt
      #0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      #1  0x000014a958a4f859 in __GI_abort () at abort.c:79
      #2  0x000014a958a4f729 in __assert_fail_base (fmt=0x14a958be5588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x558d98e9f7c0 "thd->transaction->stmt.ha_list == __null || trans == &thd->transaction->stmt", file=0x558d98e9df93 "/test/10.7_dbg/sql/handler.cc", line=1635, function=<optimized out>) at assert.c:92
      #3  0x000014a958a60f36 in __GI___assert_fail (assertion=assertion@entry=0x558d98e9f7c0 "thd->transaction->stmt.ha_list == __null || trans == &thd->transaction->stmt", file=file@entry=0x558d98e9df93 "/test/10.7_dbg/sql/handler.cc", line=line@entry=1635, function=function@entry=0x558d98ea1d30 "int ha_commit_trans(THD*, bool)") at assert.c:101
      #4  0x0000558d98356652 in ha_commit_trans (thd=thd@entry=0x14a8c0000db8, all=all@entry=true) at /test/10.7_dbg/sql/handler.cc:1635
      #5  0x0000558d981cf6d5 in trans_begin (thd=thd@entry=0x14a8c0000db8, flags=0) at /test/10.7_dbg/sql/transaction.cc:127
      #6  0x0000558d980461e0 in mysql_execute_command (thd=thd@entry=0x14a8c0000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.7_dbg/sql/sql_parse.cc:5597
      #7  0x0000558d9802de0f in mysql_parse (thd=thd@entry=0x14a8c0000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14a93adc7400) at /test/10.7_dbg/sql/sql_parse.cc:8028
      #8  0x0000558d9803caab in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14a8c0000db8, packet=packet@entry=0x14a8c000b879 "BEGIN WORK", packet_length=packet_length@entry=10, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_class.h:1360
      #9  0x0000558d9803feea in do_command (thd=0x14a8c0000db8, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_parse.cc:1402
      #10 0x0000558d981b9902 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x558d9b28bd78, put_in_cache=put_in_cache@entry=true) at /test/10.7_dbg/sql/sql_connect.cc:1418
      #11 0x0000558d981b9f07 in handle_one_connection (arg=arg@entry=0x558d9b28bd78) at /test/10.7_dbg/sql/sql_connect.cc:1312
      #12 0x0000558d9863a33e in pfs_spawn_thread (arg=0x558d9b19d608) at /test/10.7_dbg/storage/perfschema/pfs.cc:2201
      #13 0x000014a958f5e609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #14 0x000014a958b4c293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.5.14 (dbg), 10.6.6 (dbg), 10.7.2 (dbg), 10.8.0 (dbg)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.2.42 (dbg), 10.2.42 (opt), 10.3.33 (dbg), 10.3.33 (opt), 10.4.23 (dbg), 10.4.23 (opt), 10.5.14 (opt), 10.6.6 (opt), 10.7.2 (opt), 10.8.0 (opt)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.36 (dbg), 5.7.36 (opt), 8.0.27 (dbg), 8.0.27 (opt)

      Attachments

        Issue Links

          Activity

            I disabled the test temporarily.

            heap-use-after-free seems not to be due to my refactoring. The server too fails on 2ada51ccd0d4368eea7d173163c36e2792990a10.

            nayuta-yanagisawa Nayuta Yanagisawa (Inactive) added a comment - - edited I disabled the test temporarily. heap-use-after-free seems not to be due to my refactoring. The server too fails on 2ada51ccd0d4368eea7d173163c36e2792990a10.

            =================================================================
            ==153765==ERROR: AddressSanitizer: heap-use-after-free on address 0x61f0000541ec at pc 0x7f218e572770 bp 0x7f218ec926b0 sp 0x7f218ec926a0
            READ of size 4 at 0x61f0000541ec thread T16
                #0 0x7f218e57276f in ha_spider::lock_tables() /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/ha_spider.cc:16309
                #1 0x7f218e4d6a3b in ha_spider::external_lock(THD*, int) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/ha_spider.cc:1286
                #2 0x55d928ec682c in handler::ha_external_lock(THD*, int) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/handler.cc:6718
                #3 0x55d92892ebe1 in handler::ha_external_unlock(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/handler.h:3392
                #4 0x55d9291dd20b in unlock_external /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/lock.cc:727
                #5 0x55d9291da8ec in mysql_unlock_tables(THD*, st_mysql_lock*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/lock.cc:432
                #6 0x55d9291da70f in mysql_unlock_tables(THD*, st_mysql_lock*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/lock.cc:415
                #7 0x55d9284b5694 in close_thread_tables(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_base.cc:911
                #8 0x55d9284be26f in Locked_tables_list::unlock_locked_tables(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_base.cc:2376
                #9 0x55d928aebf43 in trans_begin(THD*, unsigned int) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/transaction.cc:115
                #10 0x55d928672e8d in mysql_execute_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:5674
                #11 0x55d928683719 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:8116
                #12 0x55d928658e7f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:1907
                #13 0x55d928655583 in do_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:1375
                #14 0x55d928aaaf38 in do_handle_one_connection(CONNECT*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_connect.cc:1418
                #15 0x55d928aaa76f in handle_one_connection /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_connect.cc:1312
                #16 0x55d92973bbba in pfs_spawn_thread /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/perfschema/pfs.cc:2201
                #17 0x7f219d563946  (/lib/x86_64-linux-gnu/libc.so.6+0x94946)
                #18 0x7f219d5f3a43 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x124a43)
             
            0x61f0000541ec is located 364 bytes inside of 3120-byte region [0x61f000054080,0x61f000054cb0)
            freed by thread T16 here:
                #0 0x7f219e090517 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
                #1 0x55d92a3ef560 in my_free /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/mysys/my_malloc.c:211
                #2 0x7f218e4a50c7 in spider_free_mem(st_spider_transaction*, void*, unsigned long) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_malloc.cc:188
                #3 0x7f218e3bfa38 in spider_free_conn(st_spider_conn*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_conn.cc:1404
                #4 0x7f218e3b80ab in spider_free_conn_from_trx(st_spider_transaction*, st_spider_conn*, bool, bool, int*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_conn.cc:420
                #5 0x7f218e2ee987 in spider_free_trx_conn(st_spider_transaction*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_trx.cc:117
                #6 0x7f218e30c0b8 in spider_commit(handlerton*, THD*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_trx.cc:3486
                #7 0x55d928e9bc95 in commit_one_phase_2 /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/handler.cc:1971
                #8 0x55d928e9b9a3 in ha_commit_one_phase(THD*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/handler.cc:1950
                #9 0x55d928e99c6a in ha_commit_trans(THD*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/handler.cc:1744
                #10 0x55d928aeed06 in trans_commit_stmt(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/transaction.cc:472
                #11 0x55d92867650e in mysql_execute_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:6132
                #12 0x55d928683719 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:8116
                #13 0x55d928658e7f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:1907
                #14 0x55d928655583 in do_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:1375
                #15 0x55d928aaaf38 in do_handle_one_connection(CONNECT*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_connect.cc:1418
                #16 0x55d928aaa76f in handle_one_connection /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_connect.cc:1312
                #17 0x55d92973bbba in pfs_spawn_thread /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/perfschema/pfs.cc:2201
                #18 0x7f219d563946  (/lib/x86_64-linux-gnu/libc.so.6+0x94946)
             
            previously allocated by thread T16 here:
                #0 0x7f219e090867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
                #1 0x55d92a3ee6d9 in my_malloc /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/mysys/my_malloc.c:90
                #2 0x7f218e4a5833 in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_malloc.cc:236
                #3 0x7f218e3b9162 in spider_create_conn(st_spider_share*, ha_spider*, int, int, unsigned int, int*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_conn.cc:593
                #4 0x7f218e3be84b in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_conn.cc:1218
                #5 0x7f218e432d07 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_table.cc:5356
                #6 0x7f218e4cd66b in ha_spider::open(char const*, int, unsigned int) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/ha_spider.cc:444
                #7 0x55d928ea3f66 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/handler.cc:3013
                #8 0x55d9289c64b1 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/table.cc:4252
                #9 0x55d9284bb4e8 in open_table(THD*, TABLE_LIST*, Open_table_context*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_base.cc:2001
                #10 0x55d9284c51dc in open_and_process_table /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_base.cc:3788
                #11 0x55d9284c7e29 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_base.cc:4271
                #12 0x55d9284cd177 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_base.cc:5218
                #13 0x55d928b46ea7 in open_and_lock_tables /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_base.h:276
                #14 0x55d928b493cb in flush_tables_with_read_lock(THD*, TABLE_LIST*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_reload.cc:584
                #15 0x55d928671a2c in mysql_execute_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:5481
                #16 0x55d928683719 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:8116
                #17 0x55d928658e7f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:1907
                #18 0x55d928655583 in do_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:1375
                #19 0x55d928aaaf38 in do_handle_one_connection(CONNECT*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_connect.cc:1418
                #20 0x55d928aaa76f in handle_one_connection /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_connect.cc:1312
                #21 0x55d92973bbba in pfs_spawn_thread /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/perfschema/pfs.cc:2201
                #22 0x7f219d563946  (/lib/x86_64-linux-gnu/libc.so.6+0x94946)
             
            Thread T16 created by T0 here:
                #0 0x7f219e034685 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:216
                #1 0x55d929737644 in my_thread_create /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/perfschema/my_thread.h:52
                #2 0x55d92973bfad in pfs_spawn_thread_v1 /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/perfschema/pfs.cc:2252
                #3 0x55d92833c702 in inline_mysql_thread_create /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/include/mysql/psi/mysql_thread.h:1323
                #4 0x55d928352f90 in create_thread_to_handle_connection(CONNECT*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/mysqld.cc:6018
                #5 0x55d928353626 in create_new_thread(CONNECT*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/mysqld.cc:6077
                #6 0x55d928353989 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/mysqld.cc:6142
                #7 0x55d9283545d4 in handle_connections_sockets() /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/mysqld.cc:6269
                #8 0x55d928352764 in mysqld_main(int, char**) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/mysqld.cc:5664
                #9 0x55d92833b1cc in main /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/main.cc:25
                #10 0x7f219d4f8fcf  (/lib/x86_64-linux-gnu/libc.so.6+0x29fcf)
             
            SUMMARY: AddressSanitizer: heap-use-after-free /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/ha_spider.cc:16309 in ha_spider::lock_tables()
            Shadow bytes around the buggy address:
              0x0c3e800027e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
              0x0c3e800027f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
              0x0c3e80002800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
              0x0c3e80002810: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x0c3e80002820: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
            =>0x0c3e80002830: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd
              0x0c3e80002840: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x0c3e80002850: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x0c3e80002860: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x0c3e80002870: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x0c3e80002880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
            Shadow byte legend (one shadow byte represents 8 application bytes):
              Addressable:           00
              Partially addressable: 01 02 03 04 05 06 07 
              Heap left redzone:       fa
              Freed heap region:       fd
              Stack left redzone:      f1
              Stack mid redzone:       f2
              Stack right redzone:     f3
              Stack after return:      f5
              Stack use after scope:   f8
              Global redzone:          f9
              Global init order:       f6
              Poisoned by user:        f7
              Container overflow:      fc
              Array cookie:            ac
              Intra object redzone:    bb
              ASan internal:           fe
              Left alloca redzone:     ca
              Right alloca redzone:    cb
              Shadow gap:              cc
            ==153765==ABORTING
            ----------SERVER LOG END-------------
            

            nayuta-yanagisawa Nayuta Yanagisawa (Inactive) added a comment - - edited ================================================================= ==153765==ERROR: AddressSanitizer: heap-use-after-free on address 0x61f0000541ec at pc 0x7f218e572770 bp 0x7f218ec926b0 sp 0x7f218ec926a0 READ of size 4 at 0x61f0000541ec thread T16 #0 0x7f218e57276f in ha_spider::lock_tables() /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/ha_spider.cc:16309 #1 0x7f218e4d6a3b in ha_spider::external_lock(THD*, int) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/ha_spider.cc:1286 #2 0x55d928ec682c in handler::ha_external_lock(THD*, int) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/handler.cc:6718 #3 0x55d92892ebe1 in handler::ha_external_unlock(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/handler.h:3392 #4 0x55d9291dd20b in unlock_external /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/lock.cc:727 #5 0x55d9291da8ec in mysql_unlock_tables(THD*, st_mysql_lock*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/lock.cc:432 #6 0x55d9291da70f in mysql_unlock_tables(THD*, st_mysql_lock*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/lock.cc:415 #7 0x55d9284b5694 in close_thread_tables(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_base.cc:911 #8 0x55d9284be26f in Locked_tables_list::unlock_locked_tables(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_base.cc:2376 #9 0x55d928aebf43 in trans_begin(THD*, unsigned int) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/transaction.cc:115 #10 0x55d928672e8d in mysql_execute_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:5674 #11 0x55d928683719 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:8116 #12 0x55d928658e7f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:1907 #13 0x55d928655583 in do_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:1375 #14 0x55d928aaaf38 in do_handle_one_connection(CONNECT*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_connect.cc:1418 #15 0x55d928aaa76f in handle_one_connection /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_connect.cc:1312 #16 0x55d92973bbba in pfs_spawn_thread /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/perfschema/pfs.cc:2201 #17 0x7f219d563946 (/lib/x86_64-linux-gnu/libc.so.6+0x94946) #18 0x7f219d5f3a43 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x124a43)   0x61f0000541ec is located 364 bytes inside of 3120-byte region [0x61f000054080,0x61f000054cb0) freed by thread T16 here: #0 0x7f219e090517 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127 #1 0x55d92a3ef560 in my_free /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/mysys/my_malloc.c:211 #2 0x7f218e4a50c7 in spider_free_mem(st_spider_transaction*, void*, unsigned long) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_malloc.cc:188 #3 0x7f218e3bfa38 in spider_free_conn(st_spider_conn*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_conn.cc:1404 #4 0x7f218e3b80ab in spider_free_conn_from_trx(st_spider_transaction*, st_spider_conn*, bool, bool, int*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_conn.cc:420 #5 0x7f218e2ee987 in spider_free_trx_conn(st_spider_transaction*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_trx.cc:117 #6 0x7f218e30c0b8 in spider_commit(handlerton*, THD*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_trx.cc:3486 #7 0x55d928e9bc95 in commit_one_phase_2 /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/handler.cc:1971 #8 0x55d928e9b9a3 in ha_commit_one_phase(THD*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/handler.cc:1950 #9 0x55d928e99c6a in ha_commit_trans(THD*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/handler.cc:1744 #10 0x55d928aeed06 in trans_commit_stmt(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/transaction.cc:472 #11 0x55d92867650e in mysql_execute_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:6132 #12 0x55d928683719 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:8116 #13 0x55d928658e7f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:1907 #14 0x55d928655583 in do_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:1375 #15 0x55d928aaaf38 in do_handle_one_connection(CONNECT*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_connect.cc:1418 #16 0x55d928aaa76f in handle_one_connection /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_connect.cc:1312 #17 0x55d92973bbba in pfs_spawn_thread /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/perfschema/pfs.cc:2201 #18 0x7f219d563946 (/lib/x86_64-linux-gnu/libc.so.6+0x94946)   previously allocated by thread T16 here: #0 0x7f219e090867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 #1 0x55d92a3ee6d9 in my_malloc /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/mysys/my_malloc.c:90 #2 0x7f218e4a5833 in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_malloc.cc:236 #3 0x7f218e3b9162 in spider_create_conn(st_spider_share*, ha_spider*, int, int, unsigned int, int*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_conn.cc:593 #4 0x7f218e3be84b in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_conn.cc:1218 #5 0x7f218e432d07 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/spd_table.cc:5356 #6 0x7f218e4cd66b in ha_spider::open(char const*, int, unsigned int) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/ha_spider.cc:444 #7 0x55d928ea3f66 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/handler.cc:3013 #8 0x55d9289c64b1 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/table.cc:4252 #9 0x55d9284bb4e8 in open_table(THD*, TABLE_LIST*, Open_table_context*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_base.cc:2001 #10 0x55d9284c51dc in open_and_process_table /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_base.cc:3788 #11 0x55d9284c7e29 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_base.cc:4271 #12 0x55d9284cd177 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_base.cc:5218 #13 0x55d928b46ea7 in open_and_lock_tables /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_base.h:276 #14 0x55d928b493cb in flush_tables_with_read_lock(THD*, TABLE_LIST*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_reload.cc:584 #15 0x55d928671a2c in mysql_execute_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:5481 #16 0x55d928683719 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:8116 #17 0x55d928658e7f in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:1907 #18 0x55d928655583 in do_command(THD*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_parse.cc:1375 #19 0x55d928aaaf38 in do_handle_one_connection(CONNECT*, bool) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_connect.cc:1418 #20 0x55d928aaa76f in handle_one_connection /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/sql_connect.cc:1312 #21 0x55d92973bbba in pfs_spawn_thread /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/perfschema/pfs.cc:2201 #22 0x7f219d563946 (/lib/x86_64-linux-gnu/libc.so.6+0x94946)   Thread T16 created by T0 here: #0 0x7f219e034685 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:216 #1 0x55d929737644 in my_thread_create /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/perfschema/my_thread.h:52 #2 0x55d92973bfad in pfs_spawn_thread_v1 /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/perfschema/pfs.cc:2252 #3 0x55d92833c702 in inline_mysql_thread_create /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/include/mysql/psi/mysql_thread.h:1323 #4 0x55d928352f90 in create_thread_to_handle_connection(CONNECT*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/mysqld.cc:6018 #5 0x55d928353626 in create_new_thread(CONNECT*) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/mysqld.cc:6077 #6 0x55d928353989 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/mysqld.cc:6142 #7 0x55d9283545d4 in handle_connections_sockets() /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/mysqld.cc:6269 #8 0x55d928352764 in mysqld_main(int, char**) /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/mysqld.cc:5664 #9 0x55d92833b1cc in main /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/sql/main.cc:25 #10 0x7f219d4f8fcf (/lib/x86_64-linux-gnu/libc.so.6+0x29fcf)   SUMMARY: AddressSanitizer: heap-use-after-free /home/nayuta_mariadb/repo/mariadb-server/bb-10.5-MDEV-27239/storage/spider/ha_spider.cc:16309 in ha_spider::lock_tables() Shadow bytes around the buggy address: 0x0c3e800027e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3e800027f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3e80002800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3e80002810: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3e80002820: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c3e80002830: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd 0x0c3e80002840: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3e80002850: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3e80002860: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3e80002870: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3e80002880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==153765==ABORTING ----------SERVER LOG END-------------

            ASAN build doesn't fail on 8e6e5ace.

            Further, even if I cherry-picked the fix, db1a7cf, on the first bad commit, e954d9d, the ASAN build doesn't fail with the test case. So, use-after-free is introduced between e954d9d and 10.5 HEAD.

            nayuta-yanagisawa Nayuta Yanagisawa (Inactive) added a comment - ASAN build doesn't fail on 8e6e5ace. Further, even if I cherry-picked the fix, db1a7cf, on the first bad commit, e954d9d, the ASAN build doesn't fail with the test case. So, use-after-free is introduced between e954d9d and 10.5 HEAD.

            The ASAN build failure seems to be a different bug and is handled by MDEV-28352.

            nayuta-yanagisawa Nayuta Yanagisawa (Inactive) added a comment - The ASAN build failure seems to be a different bug and is handled by MDEV-28352 .

            Also see MDEV-29962

            Roel Roel Van de Paar added a comment - Also see MDEV-29962

            People

              nayuta-yanagisawa Nayuta Yanagisawa (Inactive)
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.