Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-35028

Unexpected ER_DUP_ENTRY/ER_DUP_KEY, ASAN errors after TRUNCATE on table with vector index

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Critical
    • Resolution: Fixed
    • N/A
    • 11.7.1
    • Vector search
    • None

    Description

      Test case 1

      --source include/have_innodb.inc
       
      CREATE TABLE t (pk INT PRIMARY KEY, i INT, v BLOB NOT NULL DEFAULT x'00000000', KEY (i), VECTOR INDEX (v)) ENGINE=InnoDB;
      INSERT INTO t (pk,i) VALUES (1,1),(2,2);
      TRUNCATE TABLE t;
      INSERT INTO t (pk,i) VALUES (1,3),(2,4);
       
      # Cleanup
      DROP TABLE t;
      

      bb-11.6-MDEV-32887-vector f20a1f4e94f5fc700959ff6b7945aa8a5fd0c307

      TRUNCATE TABLE t;
      INSERT INTO t (pk,i) VALUES (1,3),(2,4);
      bug.vec12a-1                             [ fail ]
              Test ended at 2024-09-27 15:25:47
       
      CURRENT_TEST: bug.vec12a-1
      mysqltest: At line 6: query 'INSERT INTO t (pk,i) VALUES (1,3),(2,4)' failed: ER_DUP_ENTRY (1062): Duplicate entry '3' for key 'i'
      

      Obviously, the error is unexpected, as key i is not unique, and moreover, the value 3 is not a duplicate of anything.

      In the above test case, the primary key is not needed, its presence just makes the error more descriptive. Here is a variation without PK:

      Test case 2

      --source include/have_innodb.inc
       
      CREATE TABLE t (i INT, v BLOB NOT NULL DEFAULT x'00000000', KEY (i), VECTOR INDEX (v)) ENGINE=InnoDB;
      INSERT INTO t (i) VALUES (1),(2);
      TRUNCATE TABLE t;
      INSERT INTO t (i) VALUES (3),(4);
       
      # Cleanup
      DROP TABLE t;
      

      TRUNCATE TABLE t;
      INSERT INTO t (i) VALUES (3),(4);
      bug.vec12a-1                             [ fail ]
              Test ended at 2024-09-27 15:27:48
       
      CURRENT_TEST: bug.vec12a-1
      mysqltest: At line 6: query 'INSERT INTO t (i) VALUES (3),(4)' failed: ER_DUP_KEY (1022): Can't write; duplicate key in table 't'
      

      In both cases, if instead of the failing INSERT we use REPLACE, an ASAN error occurs:

      Test case 3

      --source include/have_innodb.inc
       
      CREATE TABLE t (i INT, v BLOB NOT NULL DEFAULT x'00000000', KEY (i), VECTOR INDEX (v)) ENGINE=InnoDB;
      INSERT INTO t (i) VALUES (1),(2);
      TRUNCATE TABLE t;
      REPLACE INTO t (i) VALUES (3),(4);
       
      # Cleanup
      DROP TABLE t;
      

      ==3119576==ERROR: AddressSanitizer: dynamic-stack-buffer-overflow on address 0x7effb7bf9040 at pc 0x55b7034629de bp 0x7effb7bf8f10 sp 0x7effb7bf8f08
      WRITE of size 2 at 0x7effb7bf9040 thread T11
          #0 0x55b7034629dd in Field_blob::get_key_image_itRAW(unsigned char const*, unsigned char*, unsigned int) const /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/field.cc:8976
          #1 0x55b703484195 in Field_blob::get_key_image(unsigned char*, unsigned int, unsigned char const*, Field::imagetype) const /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/field.h:4642
          #2 0x55b70380c277 in key_copy(unsigned char*, unsigned char const*, st_key const*, unsigned int, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/key.cc:150
          #3 0x55b702a6fcc2 in write_record(THD*, TABLE*, st_copy_info*, select_result*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/sql_insert.cc:2050
          #4 0x55b702a68cfd in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/sql_insert.cc:1179
          #5 0x55b702b38fc7 in mysql_execute_command(THD*, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/sql_parse.cc:4458
          #6 0x55b702b50b89 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/sql_parse.cc:7873
          #7 0x55b702b27bab in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/sql_parse.cc:1892
          #8 0x55b702b248bf in do_command(THD*, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/sql_parse.cc:1405
          #9 0x55b703014420 in do_handle_one_connection(CONNECT*, bool) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/sql_connect.cc:1448
          #10 0x55b703013de1 in handle_one_connection /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/sql_connect.cc:1350
          #11 0x55b703cb5999 in pfs_spawn_thread /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/storage/perfschema/pfs.cc:2198
          #12 0x7effc7aa8043 in start_thread nptl/pthread_create.c:442
          #13 0x7effc7b2861b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
       
      Address 0x7effb7bf9040 is located in stack of thread T11
      SUMMARY: AddressSanitizer: dynamic-stack-buffer-overflow /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/field.cc:8976 in Field_blob::get_key_image_itRAW(unsigned char const*, unsigned char*, unsigned int) const
      Shadow bytes around the buggy address:
        0x0fe076f771b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0fe076f771c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0fe076f771d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0fe076f771e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0fe076f771f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      =>0x0fe076f77200: 00 00 00 00 ca ca ca ca[cb]cb cb cb 00 00 00 00
        0x0fe076f77210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0fe076f77220: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 f3 f3 f3 f3
        0x0fe076f77230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0fe076f77240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0fe076f77250: 00 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 f8 f8
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
      Thread T11 created by T0 here:
          #0 0x7effc8649726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
          #1 0x55b703cb173b in my_thread_create /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/storage/perfschema/my_thread.h:38
          #2 0x55b703cb5d88 in pfs_spawn_thread_v1 /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/storage/perfschema/pfs.cc:2249
          #3 0x55b702740c33 in inline_mysql_thread_create /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/include/mysql/psi/mysql_thread.h:1139
          #4 0x55b7027593fa in create_thread_to_handle_connection(CONNECT*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/mysqld.cc:6267
          #5 0x55b702759a1f in create_new_thread(CONNECT*) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/mysqld.cc:6329
          #6 0x55b702759d0a in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/mysqld.cc:6391
          #7 0x55b70275a992 in handle_connections_sockets() /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/mysqld.cc:6504
          #8 0x55b702758c77 in mysqld_main(int, char**) /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/mysqld.cc:6162
          #9 0x55b70273fd58 in main /data/bld/preview-11.7-bb-11.6-MDEV-32887-vector-asan/sql/main.cc:34
          #10 0x7effc7a461c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
      

      Attachments

        Issue Links

          Activity

            People

              serg Sergei Golubchik
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.