Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-31083

ASAN use-after-poison in myrg_attach_children

Details

    Description

      CREATE TABLE t (f TEXT, FULLTEXT (f)) ENGINE=MyISAM;
      INSERT INTO t VALUES ('foo'),('bar'); # Optional, fails either way
      CREATE TABLE tmrg (f TEXT) ENGINE=MERGE, UNION(t);
      SELECT * FROM tmrg;
       
      # Cleanup
      DROP TABLE tmrg, t;
      

      10.5 75063d12

      ==3017382==ERROR: AddressSanitizer: use-after-poison on address 0x61d000231098 at pc 0x557f6777a665 bp 0x7f5b079662b0 sp 0x7f5b079662a8
      READ of size 8 at 0x61d000231098 thread T5
          #0 0x557f6777a664 in myrg_attach_children /data/src/10.5/storage/myisammrg/myrg_open.c:481
          #1 0x557f6776dff2 in ha_myisammrg::attach_children() /data/src/10.5/storage/myisammrg/ha_myisammrg.cc:839
          #2 0x557f67772f6f in ha_myisammrg::extra(ha_extra_function) /data/src/10.5/storage/myisammrg/ha_myisammrg.cc:1340
          #3 0x557f657a3b6b in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:4429
          #4 0x557f657a825e in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:5237
          #5 0x557f656feac5 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.5/sql/sql_base.h:507
          #6 0x557f6594a4d4 in execute_sqlcom_select /data/src/10.5/sql/sql_parse.cc:6252
          #7 0x557f65939a6c in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:4008
          #8 0x557f65955eb8 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8106
          #9 0x557f6592ba49 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891
          #10 0x557f659283e6 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375
          #11 0x557f65d7519e in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1416
          #12 0x557f65d74b66 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1318
          #13 0x557f669c1433 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201
          #14 0x7f5b0f0a7fd3 in start_thread nptl/pthread_create.c:442
          #15 0x7f5b0f1285bb in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
       
      0x61d000231098 is located 1560 bytes inside of 2296-byte region [0x61d000230a80,0x61d000231378)
      allocated by thread T5 here:
          #0 0x7f5b0fcb89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
          #1 0x557f67615035 in my_malloc /data/src/10.5/mysys/my_malloc.c:91
          #2 0x557f675ef618 in my_multi_malloc /data/src/10.5/mysys/mulalloc.c:59
          #3 0x557f674f9613 in mi_open /data/src/10.5/storage/myisam/mi_open.c:313
          #4 0x557f674766ad in ha_myisam::open(char const*, int, unsigned int) /data/src/10.5/storage/myisam/ha_myisam.cc:834
          #5 0x557f661562d0 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/src/10.5/sql/handler.cc:3012
          #6 0x557f65c9440f in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/src/10.5/sql/table.cc:4323
          #7 0x557f65796cc3 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.5/sql/sql_base.cc:2015
          #8 0x557f657a05f8 in open_and_process_table /data/src/10.5/sql/sql_base.cc:3807
          #9 0x557f657a3125 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:4290
          #10 0x557f657a825e in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.5/sql/sql_base.cc:5237
          #11 0x557f656feac5 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.5/sql/sql_base.h:507
          #12 0x557f65872469 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /data/src/10.5/sql/sql_insert.cc:757
          #13 0x557f6593da0a in mysql_execute_command(THD*) /data/src/10.5/sql/sql_parse.cc:4629
          #14 0x557f65955eb8 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.5/sql/sql_parse.cc:8106
          #15 0x557f6592ba49 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.5/sql/sql_parse.cc:1891
          #16 0x557f659283e6 in do_command(THD*) /data/src/10.5/sql/sql_parse.cc:1375
          #17 0x557f65d7519e in do_handle_one_connection(CONNECT*, bool) /data/src/10.5/sql/sql_connect.cc:1416
          #18 0x557f65d74b66 in handle_one_connection /data/src/10.5/sql/sql_connect.cc:1318
          #19 0x557f669c1433 in pfs_spawn_thread /data/src/10.5/storage/perfschema/pfs.cc:2201
          #20 0x7f5b0f0a7fd3 in start_thread nptl/pthread_create.c:442
       
      Thread T5 created by T0 here:
          #0 0x7f5b0fc49726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
          #1 0x557f669bd166 in my_thread_create /data/src/10.5/storage/perfschema/my_thread.h:52
          #2 0x557f669c1822 in pfs_spawn_thread_v1 /data/src/10.5/storage/perfschema/pfs.cc:2252
          #3 0x557f6561deeb in inline_mysql_thread_create /data/src/10.5/include/mysql/psi/mysql_thread.h:1323
          #4 0x557f65633c32 in create_thread_to_handle_connection(CONNECT*) /data/src/10.5/sql/mysqld.cc:6057
          #5 0x557f65634243 in create_new_thread(CONNECT*) /data/src/10.5/sql/mysqld.cc:6116
          #6 0x557f65634516 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.5/sql/mysqld.cc:6181
          #7 0x557f65635107 in handle_connections_sockets() /data/src/10.5/sql/mysqld.cc:6308
          #8 0x557f656334af in mysqld_main(int, char**) /data/src/10.5/sql/mysqld.cc:5703
          #9 0x557f6561c8f8 in main /data/src/10.5/sql/main.cc:25
          #10 0x7f5b0f046189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
       
      SUMMARY: AddressSanitizer: use-after-poison /data/src/10.5/storage/myisammrg/myrg_open.c:481 in myrg_attach_children
      Shadow bytes around the buggy address:
        0x0c3a8003e1c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c3a8003e1d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c3a8003e1e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c3a8003e1f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c3a8003e200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      =>0x0c3a8003e210: 00 f7 00[f7]00 00 00 00 00 00 00 00 00 00 00 00
        0x0c3a8003e220: 00 00 f7 f7 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c3a8003e230: 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00 00
        0x0c3a8003e240: 00 00 00 00 00 00 00 f7 00 00 00 f7 00 00 00 00
        0x0c3a8003e250: 00 00 f7 00 00 f7 00 00 f7 00 f7 00 f7 00 00 00
        0x0c3a8003e260: 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 f7 fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
      ==3017382==ABORTING
      230419 15:45:29 [ERROR] mysqld got signal 6 ;
      This could be because you hit a bug. It is also possible that this binary
      or one of the libraries it was linked against is corrupt, improperly built,
      or misconfigured. This error can also be caused by malfunctioning hardware.
       
      To report this bug, see https://mariadb.com/kb/en/reporting-bugs
       
      We will try our best to scrape up some info that will hopefully help
      diagnose the problem, but since we have already crashed, 
      something is definitely wrong and this may fail.
       
      Server version: 10.5.20-MariaDB-debug-log source revision: 75063d128812347228873e2dce4ae7799f348ebf
      key_buffer_size=1048576
      read_buffer_size=131072
      max_used_connections=1
      max_threads=153
      thread_count=1
      It is possible that mysqld could use up to 
      key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 63762 K  bytes of memory
      Hope that's ok; if not, decrease some variables in the equation.
       
      Thread pointer: 0x62b000069218
      Attempting backtrace. You can use the following information to find out
      where mysqld died. If you see no messages after this, something went
      terribly wrong...
      stack_bottom = 0x7f5b07968c50 thread_stack 0x100000
      sanitizer_common/sanitizer_common_interceptors.inc:4277(__interceptor_backtrace.part.0)[0x7f5b0fc51f31]
      mysys/stacktrace.c:212(my_print_stacktrace)[0x557f67624eb5]
      sql/signal_handler.cc:241(handle_fatal_signal)[0x557f6613e1c7]
      libc_sigaction.c:0(__restore_rt)[0x7f5b0f05af90]
      nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x7f5b0f0a9ccc]
      posix/raise.c:27(__GI_raise)[0x7f5b0f05aef2]
      stdlib/abort.c:81(__GI_abort)[0x7f5b0f045472]
      sanitizer_common/sanitizer_posix_libcdep.cpp:137(__sanitizer::Abort())[0x7f5b0fcd650f]
      sanitizer_common/sanitizer_termination.cpp:59(__sanitizer::Die())[0x7f5b0fce2ba1]
      asan/asan_report.cpp:190(__asan::ScopedInErrorReport::~ScopedInErrorReport())[0x7f5b0fcc1f5e]
      asan/asan_report.cpp:479(__asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool))[0x7f5b0fcc14c6]
      asan/asan_rtl.cpp:123(__asan_report_load8)[0x7f5b0fcc25ac]
      myisammrg/myrg_open.c:481(myrg_attach_children)[0x557f6777a665]
      myisammrg/ha_myisammrg.cc:839(ha_myisammrg::attach_children())[0x557f6776dff3]
      myisammrg/ha_myisammrg.cc:1340(ha_myisammrg::extra(ha_extra_function))[0x557f67772f70]
      sql/sql_base.cc:4429(open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*))[0x557f657a3b6c]
      sql/sql_base.cc:5237(open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*))[0x557f657a825f]
      sql/sql_base.h:507(open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int))[0x557f656feac6]
      sql/sql_parse.cc:6252(execute_sqlcom_select(THD*, TABLE_LIST*))[0x557f6594a4d5]
      sql/sql_parse.cc:4008(mysql_execute_command(THD*))[0x557f65939a6d]
      sql/sql_parse.cc:8106(mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool))[0x557f65955eb9]
      sql/sql_parse.cc:1894(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x557f6592ba4a]
      sql/sql_parse.cc:1375(do_command(THD*))[0x557f659283e7]
      sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x557f65d7519f]
      sql/sql_connect.cc:1320(handle_one_connection)[0x557f65d74b67]
      perfschema/pfs.cc:2203(pfs_spawn_thread)[0x557f669c1434]
      nptl/pthread_create.c:442(start_thread)[0x7f5b0f0a7fd4]
      x86_64/clone3.S:83(clone3)[0x7f5b0f1285bc]
       
      Trying to get some variables.
      Some pointers may be invalid and cause the dump to abort.
      Query (0x62b000038238): SELECT * FROM tmrg
       
      Connection ID (thread ID): 4
      Status: NOT_KILLED
      

      The failure started happening on 10.5 after this commit:

      commit 57c526ffb852fb027e25fdc77173d45bdc60b8a2
      Author: Monty
      Date:   Sun Feb 26 18:33:10 2023 +0200
       
          Added detection of memory overwrite with multi_malloc
      

      Attachments

        Activity

          The above is a usable bug in using merge tables. The merge table must have the exact same definition as the used tables.

          monty Michael Widenius added a comment - The above is a usable bug in using merge tables. The merge table must have the exact same definition as the used tables.
          elenst Elena Stepanova added a comment - - edited

          Demoted from a blocker since Monty's analysis confirmed it is not a real regression, but the patch just made an existing problem visible.

          elenst Elena Stepanova added a comment - - edited Demoted from a blocker since Monty's analysis confirmed it is not a real regression, but the patch just made an existing problem visible.

          Ran into this one as well. The following executed in MTR on a ASAN debug build:

          CREATE TABLE t3 (a INT,b INT,KEY(a,b)) ENGINE=MERGE UNION=(t,t2);
          CREATE TABLE t2 (b INT) ENGINE=MyISAM;
          CREATE TABLE t (val INT,KEY USING BTREE (val)) ENGINE=MyISAM;
          INSERT INTO t2 SELECT * FROM t3;
          

          Crashes, and results in this ASAN trace:

          11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Debug, UBASAN)

          ==3167718==ERROR: AddressSanitizer: use-after-poison on address 0x61d0001fc890 at pc 0x55dc4dcad38d bp 0x14cf40bf7180 sp 0x14cf40bf7170
          READ of size 8 at 0x61d0001fc890 thread T22
              #0 0x55dc4dcad38c in myrg_attach_children /test/11.0_dbg_san/storage/myisammrg/myrg_open.c:481
              #1 0x55dc4dca5b8c in ha_myisammrg::attach_children() /test/11.0_dbg_san/storage/myisammrg/ha_myisammrg.cc:866
              #2 0x55dc4dca7d5d in ha_myisammrg::extra(ha_extra_function) /test/11.0_dbg_san/storage/myisammrg/ha_myisammrg.cc:1358
              #3 0x55dc49872296 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:4737
              #4 0x55dc49874dbe in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:5570
              #5 0x55dc49caa28e in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /test/11.0_dbg_san/sql/sql_base.h:510
              #6 0x55dc49caa28e in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:4656
              #7 0x55dc49ccd973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014
              #8 0x55dc49cdd707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
              #9 0x55dc49ceb542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
              #10 0x55dc4a6c08b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
              #11 0x55dc4a6c1dd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
              #12 0x14cf64094b42 in start_thread nptl/pthread_create.c:442
              #13 0x14cf641269ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
           
          0x61d0001fc890 is located 1552 bytes inside of 1968-byte region [0x61d0001fc280,0x61d0001fca30)
          allocated by thread T22 here:
              #0 0x55dc49352337 in __interceptor_malloc (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7964337)
              #1 0x55dc4da69703 in my_malloc /test/11.0_dbg_san/mysys/my_malloc.c:91
              #2 0x55dc4da470d8 in my_multi_malloc /test/11.0_dbg_san/mysys/mulalloc.c:59
              #3 0x55dc4d95dcc7 in mi_open /test/11.0_dbg_san/storage/myisam/mi_open.c:313
              #4 0x55dc4d8c5328 in ha_myisam::open(char const*, int, unsigned int) /test/11.0_dbg_san/storage/myisam/ha_myisam.cc:846
              #5 0x55dc4b3be235 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/11.0_dbg_san/sql/handler.cc:3487
              #6 0x55dc4a507885 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.0_dbg_san/sql/table.cc:4540
              #7 0x55dc498563e3 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.0_dbg_san/sql/sql_base.cc:2178
              #8 0x55dc4986df14 in open_and_process_table /test/11.0_dbg_san/sql/sql_base.cc:4108
              #9 0x55dc4986df14 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:4595
              #10 0x55dc49874dbe in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:5570
              #11 0x55dc49caa28e in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /test/11.0_dbg_san/sql/sql_base.h:510
              #12 0x55dc49caa28e in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:4656
              #13 0x55dc49ccd973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014
              #14 0x55dc49cdd707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894
              #15 0x55dc49ceb542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407
              #16 0x55dc4a6c08b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416
              #17 0x55dc4a6c1dd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318
              #18 0x14cf64094b42 in start_thread nptl/pthread_create.c:442
           
          Thread T22 created by T0 here:
              #0 0x55dc492f6175 in pthread_create (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7908175)
              #1 0x55dc493ac98b in create_thread_to_handle_connection(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6129
              #2 0x55dc493b9e67 in create_new_thread(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6191
              #3 0x55dc493ba6e7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.0_dbg_san/sql/mysqld.cc:6253
              #4 0x55dc493bb738 in handle_connections_sockets() /test/11.0_dbg_san/sql/mysqld.cc:6377
              #5 0x55dc493c2ee7 in mysqld_main(int, char**) /test/11.0_dbg_san/sql/mysqld.cc:6024
              #6 0x55dc49397eca in main /test/11.0_dbg_san/sql/main.cc:34
              #7 0x14cf64029d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
           
          SUMMARY: AddressSanitizer: use-after-poison /test/11.0_dbg_san/storage/myisammrg/myrg_open.c:481 in myrg_attach_children
          Shadow bytes around the buggy address:
            0x0c3a800378c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            0x0c3a800378d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            0x0c3a800378e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            0x0c3a800378f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
            0x0c3a80037900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
          =>0x0c3a80037910: 00 f7[f7]f7 f7 f7 00 00 00 00 00 00 00 00 00 00
            0x0c3a80037920: 00 00 00 00 00 00 00 00 f7 f7 00 00 00 00 00 00
            0x0c3a80037930: 00 00 00 f7 00 00 f7 00 00 f7 f7 f7 f7 00 00 00
            0x0c3a80037940: 00 00 00 00 00 f7 fa fa fa fa fa fa fa fa fa fa
            0x0c3a80037950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
            0x0c3a80037960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
          Shadow byte legend (one shadow byte represents 8 application bytes):
            Addressable:           00
            Partially addressable: 01 02 03 04 05 06 07 
            Heap left redzone:       fa
            Freed heap region:       fd
            Stack left redzone:      f1
            Stack mid redzone:       f2
            Stack right redzone:     f3
            Stack after return:      f5
            Stack use after scope:   f8
            Global redzone:          f9
            Global init order:       f6
            Poisoned by user:        f7
            Container overflow:      fc
            Array cookie:            ac
            Intra object redzone:    bb
            ASan internal:           fe
            Left alloca redzone:     ca
            Right alloca redzone:    cb
            Shadow gap:              cc
          ==3167718==ABORTING
          230701 13:30:01 [ERROR] mysqld got signal 6 ;
          This could be because you hit a bug. It is also possible that this binary
          or one of the libraries it was linked against is corrupt, improperly built,
          or misconfigured. This error can also be caused by malfunctioning hardware.
           
          To report this bug, see https://mariadb.com/kb/en/reporting-bugs
           
          We will try our best to scrape up some info that will hopefully help
          diagnose the problem, but since we have already crashed, 
          something is definitely wrong and this may fail.
           
          Server version: 11.0.2-MariaDB-debug source revision: 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a
          key_buffer_size=134217728
          read_buffer_size=131072
          max_used_connections=1
          max_threads=153
          thread_count=1
          It is possible that mysqld could use up to 
          key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 468071 K  bytes of memory
          Hope that's ok; if not, decrease some variables in the equation.
           
          Thread pointer: 0x62b00015e218
          Attempting backtrace. You can use the following information to find out
          where mysqld died. If you see no messages after this, something went
          terribly wrong...
          stack_bottom = 0x14cf40bf9ac0 thread_stack 0x100000
          asan_interceptors.o:0(__interceptor_backtrace.part.0)[0x55dc492e36fe]
          mysys/stacktrace.c:215(my_print_stacktrace)[0x55dc4da76001]
          sql/signal_handler.cc:238(handle_fatal_signal)[0x55dc4b391534]
          libc_sigaction.c:0(__restore_rt)[0x14cf64042520]
          nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x14cf64096a7c]
          posix/raise.c:27(__GI_raise)[0x14cf64042476]
          stdlib/abort.c:81(__GI_abort)[0x14cf640287f3]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x79821c2)[0x55dc493701c2]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x798dd7c)[0x55dc4937bd7c]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x796d22c)[0x55dc4935b22c]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x796cac5)[0x55dc4935aac5]
          /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(__asan_report_load8+0x3b)[0x55dc4935b90b]
          myisammrg/myrg_open.c:481(myrg_attach_children)[0x55dc4dcad38d]
          myisammrg/ha_myisammrg.cc:866(ha_myisammrg::attach_children())[0x55dc4dca5b8d]
          myisammrg/ha_myisammrg.cc:1358(ha_myisammrg::extra(ha_extra_function))[0x55dc4dca7d5e]
          sql/sql_base.cc:4737(open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*))[0x55dc49872297]
          sql/sql_base.cc:5570(open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*))[0x55dc49874dbf]
          sql/sql_base.h:510(open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int))[0x55dc49caa28f]
          sql/sql_parse.cc:8031(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x55dc49ccd974]
          sql/sql_parse.cc:1894(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x55dc49cdd708]
          sql/sql_parse.cc:1407(do_command(THD*, bool))[0x55dc49ceb543]
          sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x55dc4a6c08b6]
          sql/sql_connect.cc:1318(handle_one_connection)[0x55dc4a6c1dd1]
          nptl/pthread_create.c:442(start_thread)[0x14cf64094b43]
          x86_64/clone3.S:83(__clone3)[0x14cf64126a00]
           
          Trying to get some variables.
          Some pointers may be invalid and cause the dump to abort.
          Query (0x6290000d7238): INSERT INTO t2 SELECT * FROM t3
          

          On a regular (non ASAN) debug build, we get:

          11.1.2 3883eb63dc5e663558571c33d086c9fd3aa0cf8f (Debug)

          11.1.2-dbg>INSERT INTO t2 SELECT * FROM t3;
          ERROR 1168 (HY000): Unable to open underlying table which is differently defined or of non-MyISAM type or doesn't exist
          

          Roel Roel Van de Paar added a comment - Ran into this one as well. The following executed in MTR on a ASAN debug build: CREATE TABLE t3 (a INT ,b INT , KEY (a,b)) ENGINE=MERGE UNION =(t,t2); CREATE TABLE t2 (b INT ) ENGINE=MyISAM; CREATE TABLE t (val INT , KEY USING BTREE (val)) ENGINE=MyISAM; INSERT INTO t2 SELECT * FROM t3; Crashes, and results in this ASAN trace: 11.0.2 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a (Debug, UBASAN) ==3167718==ERROR: AddressSanitizer: use-after-poison on address 0x61d0001fc890 at pc 0x55dc4dcad38d bp 0x14cf40bf7180 sp 0x14cf40bf7170 READ of size 8 at 0x61d0001fc890 thread T22 #0 0x55dc4dcad38c in myrg_attach_children /test/11.0_dbg_san/storage/myisammrg/myrg_open.c:481 #1 0x55dc4dca5b8c in ha_myisammrg::attach_children() /test/11.0_dbg_san/storage/myisammrg/ha_myisammrg.cc:866 #2 0x55dc4dca7d5d in ha_myisammrg::extra(ha_extra_function) /test/11.0_dbg_san/storage/myisammrg/ha_myisammrg.cc:1358 #3 0x55dc49872296 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:4737 #4 0x55dc49874dbe in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:5570 #5 0x55dc49caa28e in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /test/11.0_dbg_san/sql/sql_base.h:510 #6 0x55dc49caa28e in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:4656 #7 0x55dc49ccd973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014 #8 0x55dc49cdd707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894 #9 0x55dc49ceb542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407 #10 0x55dc4a6c08b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416 #11 0x55dc4a6c1dd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318 #12 0x14cf64094b42 in start_thread nptl/pthread_create.c:442 #13 0x14cf641269ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)   0x61d0001fc890 is located 1552 bytes inside of 1968-byte region [0x61d0001fc280,0x61d0001fca30) allocated by thread T22 here: #0 0x55dc49352337 in __interceptor_malloc (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7964337) #1 0x55dc4da69703 in my_malloc /test/11.0_dbg_san/mysys/my_malloc.c:91 #2 0x55dc4da470d8 in my_multi_malloc /test/11.0_dbg_san/mysys/mulalloc.c:59 #3 0x55dc4d95dcc7 in mi_open /test/11.0_dbg_san/storage/myisam/mi_open.c:313 #4 0x55dc4d8c5328 in ha_myisam::open(char const*, int, unsigned int) /test/11.0_dbg_san/storage/myisam/ha_myisam.cc:846 #5 0x55dc4b3be235 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/11.0_dbg_san/sql/handler.cc:3487 #6 0x55dc4a507885 in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/11.0_dbg_san/sql/table.cc:4540 #7 0x55dc498563e3 in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/11.0_dbg_san/sql/sql_base.cc:2178 #8 0x55dc4986df14 in open_and_process_table /test/11.0_dbg_san/sql/sql_base.cc:4108 #9 0x55dc4986df14 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:4595 #10 0x55dc49874dbe in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /test/11.0_dbg_san/sql/sql_base.cc:5570 #11 0x55dc49caa28e in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /test/11.0_dbg_san/sql/sql_base.h:510 #12 0x55dc49caa28e in mysql_execute_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:4656 #13 0x55dc49ccd973 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_dbg_san/sql/sql_parse.cc:8014 #14 0x55dc49cdd707 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1894 #15 0x55dc49ceb542 in do_command(THD*, bool) /test/11.0_dbg_san/sql/sql_parse.cc:1407 #16 0x55dc4a6c08b5 in do_handle_one_connection(CONNECT*, bool) /test/11.0_dbg_san/sql/sql_connect.cc:1416 #17 0x55dc4a6c1dd0 in handle_one_connection /test/11.0_dbg_san/sql/sql_connect.cc:1318 #18 0x14cf64094b42 in start_thread nptl/pthread_create.c:442   Thread T22 created by T0 here: #0 0x55dc492f6175 in pthread_create (/test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd+0x7908175) #1 0x55dc493ac98b in create_thread_to_handle_connection(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6129 #2 0x55dc493b9e67 in create_new_thread(CONNECT*) /test/11.0_dbg_san/sql/mysqld.cc:6191 #3 0x55dc493ba6e7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.0_dbg_san/sql/mysqld.cc:6253 #4 0x55dc493bb738 in handle_connections_sockets() /test/11.0_dbg_san/sql/mysqld.cc:6377 #5 0x55dc493c2ee7 in mysqld_main(int, char**) /test/11.0_dbg_san/sql/mysqld.cc:6024 #6 0x55dc49397eca in main /test/11.0_dbg_san/sql/main.cc:34 #7 0x14cf64029d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58   SUMMARY: AddressSanitizer: use-after-poison /test/11.0_dbg_san/storage/myisammrg/myrg_open.c:481 in myrg_attach_children Shadow bytes around the buggy address: 0x0c3a800378c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a800378d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a800378e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a800378f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c3a80037900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c3a80037910: 00 f7[f7]f7 f7 f7 00 00 00 00 00 00 00 00 00 00 0x0c3a80037920: 00 00 00 00 00 00 00 00 f7 f7 00 00 00 00 00 00 0x0c3a80037930: 00 00 00 f7 00 00 f7 00 00 f7 f7 f7 f7 00 00 00 0x0c3a80037940: 00 00 00 00 00 f7 fa fa fa fa fa fa fa fa fa fa 0x0c3a80037950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3a80037960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==3167718==ABORTING 230701 13:30:01 [ERROR] mysqld got signal 6 ; This could be because you hit a bug. It is also possible that this binary or one of the libraries it was linked against is corrupt, improperly built, or misconfigured. This error can also be caused by malfunctioning hardware.   To report this bug, see https://mariadb.com/kb/en/reporting-bugs   We will try our best to scrape up some info that will hopefully help diagnose the problem, but since we have already crashed, something is definitely wrong and this may fail.   Server version: 11.0.2-MariaDB-debug source revision: 368dd22a816f3b437bccd0b9ff28b9de9b1abf0a key_buffer_size=134217728 read_buffer_size=131072 max_used_connections=1 max_threads=153 thread_count=1 It is possible that mysqld could use up to key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 468071 K bytes of memory Hope that's ok; if not, decrease some variables in the equation.   Thread pointer: 0x62b00015e218 Attempting backtrace. You can use the following information to find out where mysqld died. If you see no messages after this, something went terribly wrong... stack_bottom = 0x14cf40bf9ac0 thread_stack 0x100000 asan_interceptors.o:0(__interceptor_backtrace.part.0)[0x55dc492e36fe] mysys/stacktrace.c:215(my_print_stacktrace)[0x55dc4da76001] sql/signal_handler.cc:238(handle_fatal_signal)[0x55dc4b391534] libc_sigaction.c:0(__restore_rt)[0x14cf64042520] nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x14cf64096a7c] posix/raise.c:27(__GI_raise)[0x14cf64042476] stdlib/abort.c:81(__GI_abort)[0x14cf640287f3] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x79821c2)[0x55dc493701c2] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x798dd7c)[0x55dc4937bd7c] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x796d22c)[0x55dc4935b22c] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(+0x796cac5)[0x55dc4935aac5] /test/UBASAN_MD120523-mariadb-11.0.2-linux-x86_64-dbg/bin/mariadbd(__asan_report_load8+0x3b)[0x55dc4935b90b] myisammrg/myrg_open.c:481(myrg_attach_children)[0x55dc4dcad38d] myisammrg/ha_myisammrg.cc:866(ha_myisammrg::attach_children())[0x55dc4dca5b8d] myisammrg/ha_myisammrg.cc:1358(ha_myisammrg::extra(ha_extra_function))[0x55dc4dca7d5e] sql/sql_base.cc:4737(open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*))[0x55dc49872297] sql/sql_base.cc:5570(open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*))[0x55dc49874dbf] sql/sql_base.h:510(open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int))[0x55dc49caa28f] sql/sql_parse.cc:8031(mysql_parse(THD*, char*, unsigned int, Parser_state*))[0x55dc49ccd974] sql/sql_parse.cc:1894(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool))[0x55dc49cdd708] sql/sql_parse.cc:1407(do_command(THD*, bool))[0x55dc49ceb543] sql/sql_connect.cc:1416(do_handle_one_connection(CONNECT*, bool))[0x55dc4a6c08b6] sql/sql_connect.cc:1318(handle_one_connection)[0x55dc4a6c1dd1] nptl/pthread_create.c:442(start_thread)[0x14cf64094b43] x86_64/clone3.S:83(__clone3)[0x14cf64126a00]   Trying to get some variables. Some pointers may be invalid and cause the dump to abort. Query (0x6290000d7238): INSERT INTO t2 SELECT * FROM t3 On a regular (non ASAN) debug build, we get: 11.1.2 3883eb63dc5e663558571c33d086c9fd3aa0cf8f (Debug) 11.1.2-dbg>INSERT INTO t2 SELECT * FROM t3; ERROR 1168 (HY000): Unable to open underlying table which is differently defined or of non-MyISAM type or doesn't exist

          People

            monty Michael Widenius
            elenst Elena Stepanova
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.