[MDEV-28998] ASAN errors in spider_fields::free_conn_holder or spider_create_group_by_handler - Jira

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Critical
Resolution: Fixed
Affects Version/s: 10.3(EOL), 10.4(EOL), 10.5, 10.6, 10.7(EOL), 10.8(EOL), 10.9(EOL), 10.10(EOL), 10.11, 11.0(EOL)
Fix Version/s: 10.4.32, 10.5.23, 10.6.16, 10.10.7, 10.11.6, 11.0.4, 11.1.3
Component/s: Storage Engine - Spider
Labels:

Description

--source plugin/spider/spider/include/init_spider.inc

SET spider_same_server_link = on;

eval create server s foreign data wrapper mysql options (host "127.0.0.1", database "test", user "root", port $MASTER_MYPORT);

CREATE TABLE t1 (a INT);

INSERT INTO t1 VALUES (1),(2);

CREATE TABLE t1_SPIDER (a INT) ENGINE=SPIDER COMMENT = "wrapper 'mysql', srv 's', table 't1'";

CREATE TABLE t2 AS SELECT a FROM t1_SPIDER;

# Cleanup

DROP TABLE t2, t1_SPIDER, t1;

--source plugin/spider/spider/include/deinit_spider.inc

10.3 e34f8781
==4139841==ERROR: AddressSanitizer: heap-use-after-free on address 0x61e00001ea10 at pc 0x7f7105e0a505 bp 0x7f7106159190 sp 0x7f7106159188
WRITE of size 8 at 0x61e00001ea10 thread T5
#0 0x7f7105e0a504 in spider_fields::free_conn_holder(spider_conn_holder*) /data/src/10.3/storage/spider/spd_group_by_handler.cc:862:54
#1 0x7f7105e09e62 in spider_fields::~spider_fields() /data/src/10.3/storage/spider/spd_group_by_handler.cc:95:7
#2 0x7f7105e0a7ab in spider_fields::~spider_fields() /data/src/10.3/storage/spider/spd_group_by_handler.cc:61:1
#3 0x7f7105e1e710 in spider_group_by_handler::~spider_group_by_handler() /data/src/10.3/storage/spider/spd_group_by_handler.cc:1190:3
#4 0x7f7105e1e8ab in spider_group_by_handler::~spider_group_by_handler() /data/src/10.3/storage/spider/spd_group_by_handler.cc:1188:1
#5 0xd6ce31 in Pushdown_query::~Pushdown_query() /data/src/10.3/sql/sql_select.h:2469:23
#6 0xcc89a1 in JOIN::cleanup(bool) /data/src/10.3/sql/sql_select.cc:13243:5
#7 0xcc753f in JOIN::destroy() /data/src/10.3/sql/sql_select.cc:4177:3
#8 0xef3d42 in st_select_lex::cleanup() /data/src/10.3/sql/sql_union.cc:2102:18
#9 0xc328f1 in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.3/sql/sql_select.cc:4366:29
#10 0xc312d4 in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:372:10
#11 0xea3fc3 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11400:20
#12 0xb6a0e0 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075:26
#13 0xb42226 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870:18
#14 0xb32dac in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852:7
#15 0xb3c0ac in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398:17
#16 0x10813d6 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403:11
#17 0x1080aa3 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308:3
#18 0x2e93861 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869:3
#19 0x7f7110c8fea6 in start_thread nptl/pthread_create.c:477:8
#20 0x7f7110b9adee in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x61e00001ea10 is located 2448 bytes inside of 2628-byte region [0x61e00001e080,0x61e00001eac4)
freed by thread T5 here:
#0 0x71c53d in free (/mnt8t/bld/10.3-asan/bin/mysqld+0x71c53d)
#1 0x306d1c7 in free_memory /data/src/10.3/mysys/safemalloc.c:279:3
#2 0x306d21d in sf_free /data/src/10.3/mysys/safemalloc.c:197:3
#3 0x30252cf in my_free /data/src/10.3/mysys/my_malloc.c:223:5
#4 0x7f7105bb854c in spider_free_mem(st_spider_transaction, void, unsigned long) /data/src/10.3/storage/spider/spd_malloc.cc:187:3
#5 0x7f7105a7a1c1 in spider_free_conn(st_spider_conn*) /data/src/10.3/storage/spider/spd_conn.cc:1246:3
#6 0x7f7105a79679 in spider_free_conn_from_trx(st_spider_transaction, st_spider_conn, bool, bool, int*) /data/src/10.3/storage/spider/spd_conn.cc:309:9
#7 0x7f710596ecd0 in spider_free_trx_conn(st_spider_transaction*, bool) /data/src/10.3/storage/spider/spd_trx.cc:116:9
#8 0x7f710599b02f in spider_commit(handlerton, THD, bool) /data/src/10.3/storage/spider/spd_trx.cc:3454:5
#9 0x15a85a0 in commit_one_phase_2(THD, bool, THD_TRANS, bool) /data/src/10.3/sql/handler.cc:1658:17
#10 0x15a8e56 in ha_commit_one_phase(THD*, bool) /data/src/10.3/sql/handler.cc:1638:8
#11 0x15a6926 in ha_commit_trans(THD*, bool) /data/src/10.3/sql/handler.cc:1500:12
#12 0x10c6e19 in trans_commit_stmt(THD*) /data/src/10.3/sql/transaction.cc:506:10
#13 0xaa1c85 in select_create::send_eof() /data/src/10.3/sql/sql_insert.cc:4760:5
#14 0xe08373 in Pushdown_query::execute(JOIN*) /data/src/10.3/sql/group_by_handler.cc:126:50
#15 0xcc52d4 in do_select(JOIN, Procedure) /data/src/10.3/sql/sql_select.cc:19331:36
#16 0xcc28a5 in JOIN::exec_inner() /data/src/10.3/sql/sql_select.cc:4151:50
#17 0xcbf33e in JOIN::exec() /data/src/10.3/sql/sql_select.cc:3945:3
#18 0xc326ec in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.3/sql/sql_select.cc:4354:9
#19 0xc312d4 in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:372:10
#20 0xea3fc3 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11400:20
#21 0xb6a0e0 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075:26
#22 0xb42226 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870:18
#23 0xb32dac in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852:7
#24 0xb3c0ac in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398:17
#25 0x10813d6 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403:11
#26 0x1080aa3 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308:3
#27 0x2e93861 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869:3
#28 0x7f7110c8fea6 in start_thread nptl/pthread_create.c:477:8

previously allocated by thread T5 here:
#0 0x71c7bd in malloc (/mnt8t/bld/10.3-asan/bin/mysqld+0x71c7bd)
#1 0x306c180 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118:28
#2 0x3024d4f in my_malloc /data/src/10.3/mysys/my_malloc.c:101:10
#3 0x7f7105bb925e in spider_bulk_alloc_mem(st_spider_transaction, unsigned int, char const, char const*, unsigned long, unsigned long, ...) /data/src/10.3/storage/spider/spd_malloc.cc:235:29
#4 0x7f7105a7b8bd in spider_create_conn(st_spider_share, ha_spider, int, int, unsigned int, int*) /data/src/10.3/storage/spider/spd_conn.cc:472:7
#5 0x7f7105a829fb in spider_get_conn(st_spider_share, int, char, st_spider_transaction, ha_spider, bool, bool, unsigned int, int*) /data/src/10.3/storage/spider/spd_conn.cc:1074:20
#6 0x7f7105b2632c in spider_get_share(char const, TABLE, THD, ha_spider, int*) /data/src/10.3/storage/spider/spd_table.cc:5020:13
#7 0x7f7105bf1b45 in ha_spider::open(char const*, int, unsigned int) /data/src/10.3/storage/spider/ha_spider.cc:359:8
#8 0x15b2873 in handler::ha_open(TABLE, char const, int, unsigned int, st_mem_root, List<String>) /data/src/10.3/sql/handler.cc:2778:7
#9 0xf6ae58 in open_table_from_share(THD, TABLE_SHARE, st_mysql_const_lex_string const, unsigned int, unsigned int, unsigned int, TABLE, bool, List<String>*) /data/src/10.3/sql/table.cc:3690:33
#10 0x94ca65 in open_table(THD, TABLE_LIST, Open_table_context*) /data/src/10.3/sql/sql_base.cc:2004:12
#11 0x95a7d5 in open_and_process_table(THD, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy, bool, Open_table_context*) /data/src/10.3/sql/sql_base.cc:3731:14
#12 0x956531 in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4206:14
#13 0x963998 in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5146:7
#14 0xeaf50f in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int) /data/src/10.3/sql/sql_base.h:495:10
#15 0xea3957 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11348:10
#16 0xb6a0e0 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075:26
#17 0xb42226 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870:18
#18 0xb32dac in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852:7
#19 0xb3c0ac in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398:17
#20 0x10813d6 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403:11
#21 0x1080aa3 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308:3
#22 0x2e93861 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869:3
#23 0x7f7110c8fea6 in start_thread nptl/pthread_create.c:477:8

Thread T5 created by T0 here:
#0 0x7071ea in pthread_create (/mnt8t/bld/10.3-asan/bin/mysqld+0x7071ea)
#1 0x2e99b09 in spawn_thread_v1(unsigned int, unsigned long, pthread_attr_t const, void* ()(void), void*) /data/src/10.3/storage/perfschema/pfs.cc:1919:15
#2 0x757a1a in inline_mysql_thread_create(unsigned int, unsigned long, pthread_attr_t const, void* ()(void), void*) /data/src/10.3/include/mysql/psi/mysql_thread.h:1275:11
#3 0x769453 in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6668:15
#4 0x76ac4a in create_new_thread(CONNECT*) /data/src/10.3/sql/mysqld.cc:6738:3
#5 0x7689cd in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6996:9
#6 0x75b3de in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6290:3
#7 0x74ed61 in main /data/src/10.3/sql/main.cc:25:10
#8 0x7f7110ac3d09 in __libc_start_main csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/spider/spd_group_by_handler.cc:862:54 in spider_fields::free_conn_holder(spider_conn_holder*)
Shadow bytes around the buggy address:
0x0c3c7fffbcf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3c7fffbd00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3c7fffbd10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3c7fffbd20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3c7fffbd30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c3c7fffbd40: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3c7fffbd50: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x0c3c7fffbd60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3c7fffbd70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3c7fffbd80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3c7fffbd90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==4139841==ABORTING

Same test case, only t2 already exists; very different stack trace:

--source plugin/spider/spider/include/init_spider.inc

SET spider_same_server_link = on;

eval create server s foreign data wrapper mysql options (host "127.0.0.1", database "test", user "root", port $MASTER_MYPORT);

CREATE TABLE t1 (a INT);

INSERT INTO t1 VALUES (1),(2);

CREATE TABLE t1_SPIDER (a INT) ENGINE=SPIDER COMMENT = "wrapper 'mysql', srv 's', table 't1'";

CREATE TABLE t2 (x INT);

CREATE OR REPLACE TABLE t2 AS SELECT a FROM t1_SPIDER;

# Cleanup

DROP TABLE t2, t1_SPIDER, t1;

--source plugin/spider/spider/include/deinit_spider.inc

10.3 63137022
==620941==ERROR: AddressSanitizer: heap-use-after-free on address 0x61c00004d95c at pc 0x7f5a73caf99f bp 0x7f5a73eefd20 sp 0x7f5a73eefd18
READ of size 4 at 0x61c00004d95c thread T5
#0 0x7f5a73caf99e in spider_create_group_by_handler(THD, Query) /data/src/10.3/storage/spider/spd_group_by_handler.cc:1964
#1 0x55c848e0d039 in JOIN::make_aggr_tables_info() /data/src/10.3/sql/sql_select.cc:2927
#2 0x55c848e2c971 in JOIN::optimize_stage2() /data/src/10.3/sql/sql_select.cc:2697
#3 0x55c848e367da in JOIN::optimize_inner() /data/src/10.3/sql/sql_select.cc:2003
#4 0x55c848e3d741 in JOIN::optimize() /data/src/10.3/sql/sql_select.cc:1519
#5 0x55c848e45b58 in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.3/sql/sql_select.cc:4340
#6 0x55c848e465ff in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:372
#7 0x55c848f0cd96 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11399
#8 0x55c848cf3526 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075
#9 0x55c848d045d7 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870
#10 0x55c848d09119 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
#11 0x55c848d0eebd in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
#12 0x55c84902cc36 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
#13 0x55c84902d49a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
#14 0x55c84a2730f4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
#15 0x7f5a7e910ea6 in start_thread nptl/pthread_create.c:477
#16 0x7f5a7e840dee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfddee)

0x61c00004d95c is located 220 bytes inside of 1880-byte region [0x61c00004d880,0x61c00004dfd8)
freed by thread T5 here:
#0 0x7f5a7f1b2b6f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:123
#1 0x7f5a73be9811 in spider_free_mem(st_spider_transaction, void, unsigned long) /data/src/10.3/storage/spider/spd_malloc.cc:187
#2 0x7f5a73b4ebf0 in spider_free_conn(st_spider_conn*) /data/src/10.3/storage/spider/spd_conn.cc:1246
#3 0x7f5a73b4f28f in spider_free_conn_from_trx(st_spider_transaction, st_spider_conn, bool, bool, int*) /data/src/10.3/storage/spider/spd_conn.cc:286
#4 0x7f5a73ae5293 in spider_free_trx_conn(st_spider_transaction*, bool) /data/src/10.3/storage/spider/spd_trx.cc:116
#5 0x7f5a73af5152 in spider_rollback(handlerton, THD, bool) /data/src/10.3/storage/spider/spd_trx.cc:3527
#6 0x55c8493415d2 in ha_rollback_trans(THD*, bool) /data/src/10.3/sql/handler.cc:1765
#7 0x55c8490595ba in trans_rollback_stmt(THD*) /data/src/10.3/sql/transaction.cc:569
#8 0x55c848f07aee in create_table_impl /data/src/10.3/sql/sql_table.cc:5025
#9 0x55c848f0889b in mysql_create_table_no_lock(THD, st_mysql_const_lex_string const, st_mysql_const_lex_string const, Table_specification_st, Alter_info, bool, int, TABLE_LIST*) /data/src/10.3/sql/sql_table.cc:5239
#10 0x55c848c53d30 in select_create::create_table_from_items(THD, List<Item>, st_mysql_lock*, TABLEOP_HOOKS) /data/src/10.3/sql/sql_insert.cc:4352
#11 0x55c848c54a97 in select_create::prepare(List<Item>&, st_select_lex_unit*) /data/src/10.3/sql/sql_insert.cc:4543
#12 0x55c848e03c0b in JOIN::prepare(TABLE_LIST, unsigned int, Item, unsigned int, st_order, bool, st_order, Item, st_order, st_select_lex, st_select_lex_unit) /data/src/10.3/sql/sql_select.cc:1407
#13 0x55c848e45b41 in mysql_select(THD, TABLE_LIST, unsigned int, List<Item>&, Item, unsigned int, st_order, st_order, Item, st_order, unsigned long long, select_result, st_select_lex_unit, st_select_lex) /data/src/10.3/sql/sql_select.cc:4332
#14 0x55c848e465ff in handle_select(THD, LEX, select_result*, unsigned long) /data/src/10.3/sql/sql_select.cc:372
#15 0x55c848f0cd96 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11399
#16 0x55c848cf3526 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075
#17 0x55c848d045d7 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870
#18 0x55c848d09119 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
#19 0x55c848d0eebd in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
#20 0x55c84902cc36 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
#21 0x55c84902d49a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
#22 0x55c84a2730f4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
#23 0x7f5a7e910ea6 in start_thread nptl/pthread_create.c:477

previously allocated by thread T5 here:
#0 0x7f5a7f1b2e8f in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x55c84a344462 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
#2 0x7f5a73be9b3b in spider_bulk_alloc_mem(st_spider_transaction, unsigned int, char const, char const*, unsigned long, unsigned long, ...) /data/src/10.3/storage/spider/spd_malloc.cc:235
#3 0x7f5a73b612d6 in spider_create_conn(st_spider_share, ha_spider, int, int, unsigned int, int*) /data/src/10.3/storage/spider/spd_conn.cc:472
#4 0x7f5a73b6689e in spider_get_conn(st_spider_share, int, char, st_spider_transaction, ha_spider, bool, bool, unsigned int, int*) /data/src/10.3/storage/spider/spd_conn.cc:1074
#5 0x7f5a73bb9662 in spider_get_share(char const, TABLE, THD, ha_spider, int*) /data/src/10.3/storage/spider/spd_table.cc:5020
#6 0x7f5a73c05504 in ha_spider::open(char const*, int, unsigned int) /data/src/10.3/storage/spider/ha_spider.cc:359
#7 0x55c84934692f in handler::ha_open(TABLE, char const, int, unsigned int, st_mem_root, List<String>) /data/src/10.3/sql/handler.cc:2778
#8 0x55c848f9df74 in open_table_from_share(THD, TABLE_SHARE, st_mysql_const_lex_string const, unsigned int, unsigned int, unsigned int, TABLE, bool, List<String>*) /data/src/10.3/sql/table.cc:3690
#9 0x55c848bacd8f in open_table(THD, TABLE_LIST, Open_table_context*) /data/src/10.3/sql/sql_base.cc:2004
#10 0x55c848bb5eb9 in open_and_process_table /data/src/10.3/sql/sql_base.cc:3731
#11 0x55c848bb5eb9 in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4206
#12 0x55c848bb7b9e in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5146
#13 0x55c848f0ca66 in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int) /data/src/10.3/sql/sql_base.h:495
#14 0x55c848f0ca66 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11347
#15 0x55c848cf3526 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6075
#16 0x55c848d045d7 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7870
#17 0x55c848d09119 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1852
#18 0x55c848d0eebd in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1398
#19 0x55c84902cc36 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
#20 0x55c84902d49a in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
#21 0x55c84a2730f4 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
#22 0x7f5a7e910ea6 in start_thread nptl/pthread_create.c:477

Thread T5 created by T0 here:
#0 0x7f5a7f15e2a2 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:214
#1 0x55c84a27774a in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919
#2 0x55c848a9bf3b in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275
#3 0x55c848a9bf3b in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6668
#4 0x55c848aac24d in create_new_thread /data/src/10.3/sql/mysqld.cc:6738
#5 0x55c848aac24d in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6996
#6 0x55c848aae1f5 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6290
#7 0x7f5a7e769d09 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/spider/spd_group_by_handler.cc:1964 in spider_create_group_by_handler(THD, Query)
Shadow bytes around the buggy address:
0x0c3880001ad0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3880001ae0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3880001af0: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa
0x0c3880001b00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3880001b10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c3880001b20: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
0x0c3880001b30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3880001b40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3880001b50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3880001b60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c3880001b70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==620941==ABORTING

This one also crashes on a non-ASAN build.

Attachments

Issue Links

relates to

MDEV-32238 Add a switch to disable spider group by handler

Closed

Activity

People

Assignee:: Yuchen Pei

Reporter:: Elena Stepanova

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Dates

Created:: 2022-07-01 13:19

Updated:: 2023-10-20 00:38

Resolved:: 2023-10-13 05:38

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.