Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-33170

ASAN errors upon CONVERT TABLE TO PARTITION with query cache

Details

    • Bug
    • Status: Open (View Workflow)
    • Major
    • Resolution: Unresolved
    • 10.7(EOL), 10.11, 11.0(EOL), 11.1(EOL), 11.2(EOL), 11.3(EOL)
    • 10.11
    • Partitioning, Query Cache
    • None

    Description

      --source include/have_partition.inc
      --source include/have_query_cache.inc
       
      SET @qcache= @@global.query_cache_type;
      SET GLOBAL query_cache_type= 1;
       
      CREATE TABLE t (a INT) PARTITION BY LIST (a) (PARTITION p0 VALUES IN (1));
      CREATE TABLE t1 (a INT);
      ALTER TABLE t CONVERT TABLE t1 TO PARTITION pn VALUES IN (2);
       
      # Cleanup
      DROP TABLE IF EXISTS t1, t;
      SET GLOBAL query_cache_type= @qcache;
      

      10.11 9a7deb1c36f9ed08a1ce48e7fd635b45c721dcd6

      ==4010492==ERROR: AddressSanitizer: heap-use-after-free on address 0x61900009ab98 at pc 0x56371711790f bp 0x7fa528c10900 sp 0x7fa528c108f8
      READ of size 8 at 0x61900009ab98 thread T5
          #0 0x56371711790e in Query_cache::invalidate_table(THD*, TABLE*) /data/bld/10.11-asan/sql/sql_cache.cc:3306
          #1 0x563717117845 in Query_cache::invalidate_table(THD*, TABLE_LIST*) /data/bld/10.11-asan/sql/sql_cache.cc:3291
          #2 0x563717110f91 in Query_cache::invalidate(THD*, TABLE_LIST*, char) /data/bld/10.11-asan/sql/sql_cache.cc:2256
          #3 0x5637172d0a9c in fast_end_partition /data/bld/10.11-asan/sql/sql_partition.cc:4612
          #4 0x5637172e6704 in fast_alter_partition_table(THD*, TABLE*, Alter_info*, Alter_table_ctx*, HA_CREATE_INFO*, TABLE_LIST*) /data/bld/10.11-asan/sql/sql_partition.cc:7883
          #5 0x563717584a6e in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool) /data/bld/10.11-asan/sql/sql_table.cc:10698
          #6 0x56371774d1eb in Sql_cmd_alter_table::execute(THD*) /data/bld/10.11-asan/sql/sql_alter.cc:688
          #7 0x563717293bd8 in mysql_execute_command(THD*, bool) /data/bld/10.11-asan/sql/sql_parse.cc:6075
          #8 0x5637172a0ca2 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/10.11-asan/sql/sql_parse.cc:8080
          #9 0x563717276934 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/10.11-asan/sql/sql_parse.cc:1894
          #10 0x563717273661 in do_command(THD*, bool) /data/bld/10.11-asan/sql/sql_parse.cc:1407
          #11 0x56371772e3d2 in do_handle_one_connection(CONNECT*, bool) /data/bld/10.11-asan/sql/sql_connect.cc:1415
          #12 0x56371772dd93 in handle_one_connection /data/bld/10.11-asan/sql/sql_connect.cc:1317
          #13 0x56371831c141 in pfs_spawn_thread /data/bld/10.11-asan/storage/perfschema/pfs.cc:2201
          #14 0x7fa5318a8043 in start_thread nptl/pthread_create.c:442
          #15 0x7fa53192861b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
       
      0x61900009ab98 is located 24 bytes inside of 992-byte region [0x61900009ab80,0x61900009af60)
      freed by thread T5 here:
          #0 0x7fa5324b76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
          #1 0x563718f31fe1 in my_free /data/bld/10.11-asan/mysys/my_malloc.c:220
          #2 0x5637179a1dc7 in intern_close_table /data/bld/10.11-asan/sql/table_cache.cc:232
          #3 0x5637179a1fdd in tc_remove_table /data/bld/10.11-asan/sql/table_cache.cc:268
          #4 0x5637179a34b7 in tc_release_table(TABLE*) /data/bld/10.11-asan/sql/table_cache.cc:459
          #5 0x5637170c5e8f in close_thread_table(THD*, TABLE**) /data/bld/10.11-asan/sql/sql_base.cc:1041
          #6 0x5637170c42a4 in close_all_tables_for_name(THD*, TABLE_SHARE*, ha_extra_function, TABLE*) /data/bld/10.11-asan/sql/sql_base.cc:772
          #7 0x563717738ebf in alter_partition_convert_in(st_lock_param_type*) /data/bld/10.11-asan/sql/sql_partition_admin.cc:1040
          #8 0x5637172e5045 in fast_alter_partition_table(THD*, TABLE*, Alter_info*, Alter_table_ctx*, HA_CREATE_INFO*, TABLE_LIST*) /data/bld/10.11-asan/sql/sql_partition.cc:7681
          #9 0x563717584a6e in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool) /data/bld/10.11-asan/sql/sql_table.cc:10698
          #10 0x56371774d1eb in Sql_cmd_alter_table::execute(THD*) /data/bld/10.11-asan/sql/sql_alter.cc:688
          #11 0x563717293bd8 in mysql_execute_command(THD*, bool) /data/bld/10.11-asan/sql/sql_parse.cc:6075
          #12 0x5637172a0ca2 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/10.11-asan/sql/sql_parse.cc:8080
          #13 0x563717276934 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/10.11-asan/sql/sql_parse.cc:1894
          #14 0x563717273661 in do_command(THD*, bool) /data/bld/10.11-asan/sql/sql_parse.cc:1407
          #15 0x56371772e3d2 in do_handle_one_connection(CONNECT*, bool) /data/bld/10.11-asan/sql/sql_connect.cc:1415
          #16 0x56371772dd93 in handle_one_connection /data/bld/10.11-asan/sql/sql_connect.cc:1317
          #17 0x56371831c141 in pfs_spawn_thread /data/bld/10.11-asan/storage/perfschema/pfs.cc:2201
          #18 0x7fa5318a8043 in start_thread nptl/pthread_create.c:442
       
      previously allocated by thread T5 here:
          #0 0x7fa5324b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
          #1 0x563718f31112 in my_malloc /data/bld/10.11-asan/mysys/my_malloc.c:92
          #2 0x5637170cbcb7 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/bld/10.11-asan/sql/sql_base.cc:2199
          #3 0x5637170d6fc9 in open_and_process_table /data/bld/10.11-asan/sql/sql_base.cc:4136
          #4 0x5637170d9b20 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/bld/10.11-asan/sql/sql_base.cc:4624
          #5 0x563717535c36 in open_tables /data/bld/10.11-asan/sql/sql_base.h:269
          #6 0x56371758086c in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, TABLE_LIST*, Recreate_info*, Alter_info*, unsigned int, st_order*, bool, bool) /data/bld/10.11-asan/sql/sql_table.cc:10166
          #7 0x56371774d1eb in Sql_cmd_alter_table::execute(THD*) /data/bld/10.11-asan/sql/sql_alter.cc:688
          #8 0x563717293bd8 in mysql_execute_command(THD*, bool) /data/bld/10.11-asan/sql/sql_parse.cc:6075
          #9 0x5637172a0ca2 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/10.11-asan/sql/sql_parse.cc:8080
          #10 0x563717276934 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/10.11-asan/sql/sql_parse.cc:1894
          #11 0x563717273661 in do_command(THD*, bool) /data/bld/10.11-asan/sql/sql_parse.cc:1407
          #12 0x56371772e3d2 in do_handle_one_connection(CONNECT*, bool) /data/bld/10.11-asan/sql/sql_connect.cc:1415
          #13 0x56371772dd93 in handle_one_connection /data/bld/10.11-asan/sql/sql_connect.cc:1317
          #14 0x56371831c141 in pfs_spawn_thread /data/bld/10.11-asan/storage/perfschema/pfs.cc:2201
          #15 0x7fa5318a8043 in start_thread nptl/pthread_create.c:442
       
      Thread T5 created by T0 here:
          #0 0x7fa532449726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
          #1 0x563718317e7c in my_thread_create /data/bld/10.11-asan/storage/perfschema/my_thread.h:52
          #2 0x56371831c530 in pfs_spawn_thread_v1 /data/bld/10.11-asan/storage/perfschema/pfs.cc:2252
          #3 0x563716eb389b in inline_mysql_thread_create /data/bld/10.11-asan/include/mysql/psi/mysql_thread.h:1139
          #4 0x563716ecb34f in create_thread_to_handle_connection(CONNECT*) /data/bld/10.11-asan/sql/mysqld.cc:6111
          #5 0x563716ecb960 in create_new_thread(CONNECT*) /data/bld/10.11-asan/sql/mysqld.cc:6170
          #6 0x563716ecbc4b in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/10.11-asan/sql/mysqld.cc:6232
          #7 0x563716ecc5cf in handle_connections_sockets() /data/bld/10.11-asan/sql/mysqld.cc:6356
          #8 0x563716ecabcc in mysqld_main(int, char**) /data/bld/10.11-asan/sql/mysqld.cc:6006
          #9 0x563716eb29a8 in main /data/bld/10.11-asan/sql/main.cc:34
          #10 0x7fa5318461c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
       
      SUMMARY: AddressSanitizer: heap-use-after-free /data/bld/10.11-asan/sql/sql_cache.cc:3306 in Query_cache::invalidate_table(THD*, TABLE*)
      Shadow bytes around the buggy address:
        0x0c328000b520: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328000b530: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328000b540: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328000b550: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c328000b560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      =>0x0c328000b570: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328000b580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328000b590: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328000b5a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328000b5b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
        0x0c328000b5c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
      ==4010492==ABORTING
      

      Not reproducible with EXCHANGE PARTITION or with CONVERT PARTITION TO TABLE.

      Attachments

        Issue Links

          Activity

            There are no comments yet on this issue.

            People

              sanja Oleksandr Byelkin
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.