Details
-
Bug
-
Status: Closed (View Workflow)
-
Critical
-
Resolution: Fixed
-
10.5, 10.6, 10.11, 10.3(EOL), 10.4(EOL), 10.7(EOL), 10.8(EOL), 10.9(EOL), 10.10(EOL), 11.0(EOL)
Description
--source plugin/spider/spider/include/init_spider.inc
|
|
SET spider_same_server_link = on; |
eval create server s foreign data wrapper mysql options (host "127.0.0.1", database "test", user "root", port $MASTER_MYPORT); |
|
CREATE TABLE t1 (a INT); |
INSERT INTO t1 VALUES (1),(2); |
CREATE TABLE t1_SPIDER (a INT) ENGINE=SPIDER COMMENT = "wrapper 'mysql', srv 's', table 't1'"; |
|
CREATE TABLE t2 AS SELECT a FROM t1_SPIDER; |
|
# Cleanup
|
DROP TABLE t2, t1_SPIDER, t1; |
|
--source plugin/spider/spider/include/deinit_spider.inc |
10.3 e34f8781 |
==4139841==ERROR: AddressSanitizer: heap-use-after-free on address 0x61e00001ea10 at pc 0x7f7105e0a505 bp 0x7f7106159190 sp 0x7f7106159188
|
WRITE of size 8 at 0x61e00001ea10 thread T5
|
#0 0x7f7105e0a504 in spider_fields::free_conn_holder(spider_conn_holder*) /data/src/10.3/storage/spider/spd_group_by_handler.cc:862:54
|
#1 0x7f7105e09e62 in spider_fields::~spider_fields() /data/src/10.3/storage/spider/spd_group_by_handler.cc:95:7
|
#2 0x7f7105e0a7ab in spider_fields::~spider_fields() /data/src/10.3/storage/spider/spd_group_by_handler.cc:61:1
|
#3 0x7f7105e1e710 in spider_group_by_handler::~spider_group_by_handler() /data/src/10.3/storage/spider/spd_group_by_handler.cc:1190:3
|
#4 0x7f7105e1e8ab in spider_group_by_handler::~spider_group_by_handler() /data/src/10.3/storage/spider/spd_group_by_handler.cc:1188:1
|
#5 0xd6ce31 in Pushdown_query::~Pushdown_query() /data/src/10.3/sql/sql_select.h:2469:23
|
#6 0xcc89a1 in JOIN::cleanup(bool) /data/src/10.3/sql/sql_select.cc:13243:5
|
#7 0xcc753f in JOIN::destroy() /data/src/10.3/sql/sql_select.cc:4177:3
|
#8 0xef3d42 in st_select_lex::cleanup() /data/src/10.3/sql/sql_union.cc:2102:18
|
#9 0xc328f1 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4366:29
|
#10 0xc312d4 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:372:10
|
#11 0xea3fc3 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11400:20
|
#12 0xb6a0e0 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075:26
|
#13 0xb42226 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870:18
|
#14 0xb32dac in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852:7
|
#15 0xb3c0ac in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398:17
|
#16 0x10813d6 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403:11
|
#17 0x1080aa3 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308:3
|
#18 0x2e93861 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869:3
|
#19 0x7f7110c8fea6 in start_thread nptl/pthread_create.c:477:8
|
#20 0x7f7110b9adee in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
|
|
0x61e00001ea10 is located 2448 bytes inside of 2628-byte region [0x61e00001e080,0x61e00001eac4)
|
freed by thread T5 here:
|
#0 0x71c53d in free (/mnt8t/bld/10.3-asan/bin/mysqld+0x71c53d)
|
#1 0x306d1c7 in free_memory /data/src/10.3/mysys/safemalloc.c:279:3
|
#2 0x306d21d in sf_free /data/src/10.3/mysys/safemalloc.c:197:3
|
#3 0x30252cf in my_free /data/src/10.3/mysys/my_malloc.c:223:5
|
#4 0x7f7105bb854c in spider_free_mem(st_spider_transaction*, void*, unsigned long) /data/src/10.3/storage/spider/spd_malloc.cc:187:3
|
#5 0x7f7105a7a1c1 in spider_free_conn(st_spider_conn*) /data/src/10.3/storage/spider/spd_conn.cc:1246:3
|
#6 0x7f7105a79679 in spider_free_conn_from_trx(st_spider_transaction*, st_spider_conn*, bool, bool, int*) /data/src/10.3/storage/spider/spd_conn.cc:309:9
|
#7 0x7f710596ecd0 in spider_free_trx_conn(st_spider_transaction*, bool) /data/src/10.3/storage/spider/spd_trx.cc:116:9
|
#8 0x7f710599b02f in spider_commit(handlerton*, THD*, bool) /data/src/10.3/storage/spider/spd_trx.cc:3454:5
|
#9 0x15a85a0 in commit_one_phase_2(THD*, bool, THD_TRANS*, bool) /data/src/10.3/sql/handler.cc:1658:17
|
#10 0x15a8e56 in ha_commit_one_phase(THD*, bool) /data/src/10.3/sql/handler.cc:1638:8
|
#11 0x15a6926 in ha_commit_trans(THD*, bool) /data/src/10.3/sql/handler.cc:1500:12
|
#12 0x10c6e19 in trans_commit_stmt(THD*) /data/src/10.3/sql/transaction.cc:506:10
|
#13 0xaa1c85 in select_create::send_eof() /data/src/10.3/sql/sql_insert.cc:4760:5
|
#14 0xe08373 in Pushdown_query::execute(JOIN*) /data/src/10.3/sql/group_by_handler.cc:126:50
|
#15 0xcc52d4 in do_select(JOIN*, Procedure*) /data/src/10.3/sql/sql_select.cc:19331:36
|
#16 0xcc28a5 in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:4151:50
|
#17 0xcbf33e in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3945:3
|
#18 0xc326ec in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4354:9
|
#19 0xc312d4 in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:372:10
|
#20 0xea3fc3 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11400:20
|
#21 0xb6a0e0 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075:26
|
#22 0xb42226 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870:18
|
#23 0xb32dac in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852:7
|
#24 0xb3c0ac in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398:17
|
#25 0x10813d6 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403:11
|
#26 0x1080aa3 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308:3
|
#27 0x2e93861 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869:3
|
#28 0x7f7110c8fea6 in start_thread nptl/pthread_create.c:477:8
|
|
previously allocated by thread T5 here:
|
#0 0x71c7bd in malloc (/mnt8t/bld/10.3-asan/bin/mysqld+0x71c7bd)
|
#1 0x306c180 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118:28
|
#2 0x3024d4f in my_malloc /data/src/10.3/mysys/my_malloc.c:101:10
|
#3 0x7f7105bb925e in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /data/src/10.3/storage/spider/spd_malloc.cc:235:29
|
#4 0x7f7105a7b8bd in spider_create_conn(st_spider_share*, ha_spider*, int, int, unsigned int, int*) /data/src/10.3/storage/spider/spd_conn.cc:472:7
|
#5 0x7f7105a829fb in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /data/src/10.3/storage/spider/spd_conn.cc:1074:20
|
#6 0x7f7105b2632c in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /data/src/10.3/storage/spider/spd_table.cc:5020:13
|
#7 0x7f7105bf1b45 in ha_spider::open(char const*, int, unsigned int) /data/src/10.3/storage/spider/ha_spider.cc:359:8
|
#8 0x15b2873 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/src/10.3/sql/handler.cc:2778:7
|
#9 0xf6ae58 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/src/10.3/sql/table.cc:3690:33
|
#10 0x94ca65 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.3/sql/sql_base.cc:2004:12
|
#11 0x95a7d5 in open_and_process_table(THD*, TABLE_LIST*, unsigned int*, unsigned int, Prelocking_strategy*, bool, Open_table_context*) /data/src/10.3/sql/sql_base.cc:3731:14
|
#12 0x956531 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4206:14
|
#13 0x963998 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5146:7
|
#14 0xeaf50f in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:495:10
|
#15 0xea3957 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11348:10
|
#16 0xb6a0e0 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075:26
|
#17 0xb42226 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870:18
|
#18 0xb32dac in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852:7
|
#19 0xb3c0ac in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398:17
|
#20 0x10813d6 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403:11
|
#21 0x1080aa3 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308:3
|
#22 0x2e93861 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869:3
|
#23 0x7f7110c8fea6 in start_thread nptl/pthread_create.c:477:8
|
|
Thread T5 created by T0 here:
|
#0 0x7071ea in pthread_create (/mnt8t/bld/10.3-asan/bin/mysqld+0x7071ea)
|
#1 0x2e99b09 in spawn_thread_v1(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.3/storage/perfschema/pfs.cc:1919:15
|
#2 0x757a1a in inline_mysql_thread_create(unsigned int, unsigned long*, pthread_attr_t const*, void* (*)(void*), void*) /data/src/10.3/include/mysql/psi/mysql_thread.h:1275:11
|
#3 0x769453 in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6668:15
|
#4 0x76ac4a in create_new_thread(CONNECT*) /data/src/10.3/sql/mysqld.cc:6738:3
|
#5 0x7689cd in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6996:9
|
#6 0x75b3de in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6290:3
|
#7 0x74ed61 in main /data/src/10.3/sql/main.cc:25:10
|
#8 0x7f7110ac3d09 in __libc_start_main csu/../csu/libc-start.c:308:16
|
|
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/spider/spd_group_by_handler.cc:862:54 in spider_fields::free_conn_holder(spider_conn_holder*)
|
Shadow bytes around the buggy address:
|
0x0c3c7fffbcf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3c7fffbd00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3c7fffbd10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3c7fffbd20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3c7fffbd30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
=>0x0c3c7fffbd40: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3c7fffbd50: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
|
0x0c3c7fffbd60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c3c7fffbd70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c3c7fffbd80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c3c7fffbd90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
Shadow gap: cc
|
==4139841==ABORTING
|
Same test case, only t2 already exists; very different stack trace:
--source plugin/spider/spider/include/init_spider.inc
|
|
SET spider_same_server_link = on; |
eval create server s foreign data wrapper mysql options (host "127.0.0.1", database "test", user "root", port $MASTER_MYPORT); |
|
CREATE TABLE t1 (a INT); |
INSERT INTO t1 VALUES (1),(2); |
CREATE TABLE t1_SPIDER (a INT) ENGINE=SPIDER COMMENT = "wrapper 'mysql', srv 's', table 't1'"; |
|
CREATE TABLE t2 (x INT); |
CREATE OR REPLACE TABLE t2 AS SELECT a FROM t1_SPIDER; |
|
# Cleanup
|
DROP TABLE t2, t1_SPIDER, t1; |
|
--source plugin/spider/spider/include/deinit_spider.inc |
10.3 63137022 |
==620941==ERROR: AddressSanitizer: heap-use-after-free on address 0x61c00004d95c at pc 0x7f5a73caf99f bp 0x7f5a73eefd20 sp 0x7f5a73eefd18
|
READ of size 4 at 0x61c00004d95c thread T5
|
#0 0x7f5a73caf99e in spider_create_group_by_handler(THD*, Query*) /data/src/10.3/storage/spider/spd_group_by_handler.cc:1964
|
#1 0x55c848e0d039 in JOIN::make_aggr_tables_info() /data/src/10.3/sql/sql_select.cc:2927
|
#2 0x55c848e2c971 in JOIN::optimize_stage2() /data/src/10.3/sql/sql_select.cc:2697
|
#3 0x55c848e367da in JOIN::optimize_inner() /data/src/10.3/sql/sql_select.cc:2003
|
#4 0x55c848e3d741 in JOIN::optimize() /data/src/10.3/sql/sql_select.cc:1519
|
#5 0x55c848e45b58 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4340
|
#6 0x55c848e465ff in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:372
|
#7 0x55c848f0cd96 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11399
|
#8 0x55c848cf3526 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075
|
#9 0x55c848d045d7 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870
|
#10 0x55c848d09119 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
|
#11 0x55c848d0eebd in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
|
#12 0x55c84902cc36 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
|
#13 0x55c84902d49a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
|
#14 0x55c84a2730f4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
|
#15 0x7f5a7e910ea6 in start_thread nptl/pthread_create.c:477
|
#16 0x7f5a7e840dee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfddee)
|
|
0x61c00004d95c is located 220 bytes inside of 1880-byte region [0x61c00004d880,0x61c00004dfd8)
|
freed by thread T5 here:
|
#0 0x7f5a7f1b2b6f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:123
|
#1 0x7f5a73be9811 in spider_free_mem(st_spider_transaction*, void*, unsigned long) /data/src/10.3/storage/spider/spd_malloc.cc:187
|
#2 0x7f5a73b4ebf0 in spider_free_conn(st_spider_conn*) /data/src/10.3/storage/spider/spd_conn.cc:1246
|
#3 0x7f5a73b4f28f in spider_free_conn_from_trx(st_spider_transaction*, st_spider_conn*, bool, bool, int*) /data/src/10.3/storage/spider/spd_conn.cc:286
|
#4 0x7f5a73ae5293 in spider_free_trx_conn(st_spider_transaction*, bool) /data/src/10.3/storage/spider/spd_trx.cc:116
|
#5 0x7f5a73af5152 in spider_rollback(handlerton*, THD*, bool) /data/src/10.3/storage/spider/spd_trx.cc:3527
|
#6 0x55c8493415d2 in ha_rollback_trans(THD*, bool) /data/src/10.3/sql/handler.cc:1765
|
#7 0x55c8490595ba in trans_rollback_stmt(THD*) /data/src/10.3/sql/transaction.cc:569
|
#8 0x55c848f07aee in create_table_impl /data/src/10.3/sql/sql_table.cc:5025
|
#9 0x55c848f0889b in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /data/src/10.3/sql/sql_table.cc:5239
|
#10 0x55c848c53d30 in select_create::create_table_from_items(THD*, List<Item>*, st_mysql_lock**, TABLEOP_HOOKS*) /data/src/10.3/sql/sql_insert.cc:4352
|
#11 0x55c848c54a97 in select_create::prepare(List<Item>&, st_select_lex_unit*) /data/src/10.3/sql/sql_insert.cc:4543
|
#12 0x55c848e03c0b in JOIN::prepare(TABLE_LIST*, unsigned int, Item*, unsigned int, st_order*, bool, st_order*, Item*, st_order*, st_select_lex*, st_select_lex_unit*) /data/src/10.3/sql/sql_select.cc:1407
|
#13 0x55c848e45b41 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.3/sql/sql_select.cc:4332
|
#14 0x55c848e465ff in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:372
|
#15 0x55c848f0cd96 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11399
|
#16 0x55c848cf3526 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075
|
#17 0x55c848d045d7 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870
|
#18 0x55c848d09119 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
|
#19 0x55c848d0eebd in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
|
#20 0x55c84902cc36 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
|
#21 0x55c84902d49a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
|
#22 0x55c84a2730f4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
|
#23 0x7f5a7e910ea6 in start_thread nptl/pthread_create.c:477
|
|
previously allocated by thread T5 here:
|
#0 0x7f5a7f1b2e8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
|
#1 0x55c84a344462 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
|
#2 0x7f5a73be9b3b in spider_bulk_alloc_mem(st_spider_transaction*, unsigned int, char const*, char const*, unsigned long, unsigned long, ...) /data/src/10.3/storage/spider/spd_malloc.cc:235
|
#3 0x7f5a73b612d6 in spider_create_conn(st_spider_share*, ha_spider*, int, int, unsigned int, int*) /data/src/10.3/storage/spider/spd_conn.cc:472
|
#4 0x7f5a73b6689e in spider_get_conn(st_spider_share*, int, char*, st_spider_transaction*, ha_spider*, bool, bool, unsigned int, int*) /data/src/10.3/storage/spider/spd_conn.cc:1074
|
#5 0x7f5a73bb9662 in spider_get_share(char const*, TABLE*, THD*, ha_spider*, int*) /data/src/10.3/storage/spider/spd_table.cc:5020
|
#6 0x7f5a73c05504 in ha_spider::open(char const*, int, unsigned int) /data/src/10.3/storage/spider/ha_spider.cc:359
|
#7 0x55c84934692f in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/src/10.3/sql/handler.cc:2778
|
#8 0x55c848f9df74 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/src/10.3/sql/table.cc:3690
|
#9 0x55c848bacd8f in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.3/sql/sql_base.cc:2004
|
#10 0x55c848bb5eb9 in open_and_process_table /data/src/10.3/sql/sql_base.cc:3731
|
#11 0x55c848bb5eb9 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4206
|
#12 0x55c848bb7b9e in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5146
|
#13 0x55c848f0ca66 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:495
|
#14 0x55c848f0ca66 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11347
|
#15 0x55c848cf3526 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075
|
#16 0x55c848d045d7 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870
|
#17 0x55c848d09119 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
|
#18 0x55c848d0eebd in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
|
#19 0x55c84902cc36 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
|
#20 0x55c84902d49a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
|
#21 0x55c84a2730f4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
|
#22 0x7f5a7e910ea6 in start_thread nptl/pthread_create.c:477
|
|
Thread T5 created by T0 here:
|
#0 0x7f5a7f15e2a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
|
#1 0x55c84a27774a in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919
|
#2 0x55c848a9bf3b in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275
|
#3 0x55c848a9bf3b in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6668
|
#4 0x55c848aac24d in create_new_thread /data/src/10.3/sql/mysqld.cc:6738
|
#5 0x55c848aac24d in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6996
|
#6 0x55c848aae1f5 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6290
|
#7 0x7f5a7e769d09 in __libc_start_main ../csu/libc-start.c:308
|
|
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/spider/spd_group_by_handler.cc:1964 in spider_create_group_by_handler(THD*, Query*)
|
Shadow bytes around the buggy address:
|
0x0c3880001ad0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3880001ae0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3880001af0: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa
|
0x0c3880001b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
|
0x0c3880001b10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
=>0x0c3880001b20: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
|
0x0c3880001b30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3880001b40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3880001b50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3880001b60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
0x0c3880001b70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
Shadow gap: cc
|
==620941==ABORTING
|
This one also crashes on a non-ASAN build.
Attachments
Issue Links
- relates to
-
MDEV-32238 Add a switch to disable spider group by handler
- Closed