[MDEV-36640] RocksDB Corruption/errors/assert/SIGSEGV upon CHECK TABLE - Jira

Details

Type: Bug
Status: Open (View Workflow)
Priority: Critical
Resolution: Unresolved
Affects Version/s: 10.5, 10.6, 10.11, 11.4, 11.8, 12.0
Fix Version/s: 10.5, 10.6, 10.11, 11.4, 11.8
Component/s: Storage Engine - RocksDB
Labels:

Description

INSTALL SONAME 'ha_rocksdb';

SET @@MAX_STATEMENT_TIME=0.0001;

CREATE TABLE t1 (a INT,b INT,KEY(a)) ENGINE=ROCKSDB PARTITION BY KEY(a) PARTITIONS 2;

CREATE TABLE t2 (c INT);

CHECK TABLE t1;

CHECK TABLE t1;

CHECK TABLE t1;  # ... Repeat until an error, corruption, assert or SIGSEGV is observed. Even if corrupted, later CHECK TABLES may show "OK"

CLI Exec works better than SOURCE-ing, likely due to small timing differences.
Leads to various outcome (errors, corruption indications, assert or SIGSEGV's):

CS 11.4.6 4a701e8ce4a178faf955641caf59fc13fcc718e9 (Debug) Build 12/04/2025
11.4.6-dbg>CHECK TABLE t1;
+---------+-------+----------+----------+
\| Table \| Op \| Msg_type \| Msg_text \|
+---------+-------+----------+----------+
\| test.t1 \| check \| status \| OK \|
+---------+-------+----------+----------+
1 row in set (0.000 sec)

11.4.6-dbg>CHECK TABLE t1;
+---------+-------+----------+-----------------------------------------------+
\| Table \| Op \| Msg_type \| Msg_text \|
+---------+-------+----------+-----------------------------------------------+
\| test.t1 \| check \| error \| Partition p1 returned error \|
\| test.t1 \| check \| error \| Unknown - internal error 188 during operation \|
+---------+-------+----------+-----------------------------------------------+
2 rows in set (0.000 sec)

11.4.6-dbg>CHECK TABLE t1;
+---------+-------+----------+---------------------------------------------------------------+
\| Table \| Op \| Msg_type \| Msg_text \|
+---------+-------+----------+---------------------------------------------------------------+
\| test.t1 \| check \| Error \| Query execution was interrupted (max_statement_time exceeded) \|
\| test.t1 \| check \| error \| Corrupt \|
+---------+-------+----------+---------------------------------------------------------------+
2 rows in set (0.000 sec)

11.4.6-dbg>CHECK TABLE t1;
+---------+-------+----------+----------+
\| Table \| Op \| Msg_type \| Msg_text \|
+---------+-------+----------+----------+
\| test.t1 \| check \| status \| OK \|
+---------+-------+----------+----------+
1 row in set (0.000 sec)

11.4.6-dbg>CHECK TABLE t1;CHECK TABLE t1;
+---------+-------+----------+---------------------------------------------------------------+
\| Table \| Op \| Msg_type \| Msg_text \|
+---------+-------+----------+---------------------------------------------------------------+
\| test.t1 \| check \| Error \| Query execution was interrupted (max_statement_time exceeded) \|
\| test.t1 \| check \| error \| Corrupt \|
+---------+-------+----------+---------------------------------------------------------------+
2 rows in set (0.000 sec)

+---------+-------+----------+-----------------------------+
\| Table \| Op \| Msg_type \| Msg_text \|
+---------+-------+----------+-----------------------------+
\| test.t1 \| check \| error \| Partition p0 returned error \|
\| test.t1 \| check \| error \| Corrupt \|
+---------+-------+----------+-----------------------------+
2 rows in set (0.000 sec)

11.4.6-dbg>CHECK TABLE t1;
+---------+-------+----------+---------------------------------------------------------------+
\| Table \| Op \| Msg_type \| Msg_text \|
+---------+-------+----------+---------------------------------------------------------------+
\| test.t1 \| check \| Error \| Query execution was interrupted (max_statement_time exceeded) \|
\| test.t1 \| check \| error \| Corrupt \|
+---------+-------+----------+---------------------------------------------------------------+
2 rows in set (0.001 sec)

11.4.6-dbg>CHECK TABLE t1;
ERROR 2026 (HY000): TLS/SSL error: The TLS connection was non-properly terminated. # SIGSEGV Crash

SIGSEV's seen:

CS 11.4.6 4a701e8ce4a178faf955641caf59fc13fcc718e9 (Debug) Build 12/04/2025
Core was generated by `/test/MD120425-mariadb-11.4.6-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000760aa220aa9c in myrocks::ha_rocksdb::index_first (this=0x7609e425b080, buf=0x7609e425b8b8 "\377")at /test/11.4_dbg/storage/rocksdb/ha_rocksdb.cc:9219

[Current thread is 1 (LWP 3991647)]
(gdb) bt
#0 0x0000760aa220aa9c in myrocks::ha_rocksdb::index_first (this=0x7609e425b080, buf=0x7609e425b8b8 "\377")at /test/11.4_dbg/storage/rocksdb/ha_rocksdb.cc:9219
#1 0x0000760aa22083d4 in myrocks::ha_rocksdb::check (this=0x7609e425b080, thd=0x7609e4000d58, check_opt=0x7609e4006330)at /test/11.4_dbg/storage/rocksdb/ha_rocksdb.cc:8841
#2 0x00005569b0236c58 in handler::ha_check (this=0x7609e425b080, thd=0x7609e4000d58, check_opt=0x7609e4006330)at /test/11.4_dbg/sql/handler.cc:5309
#3 0x00005569b05847eb in ha_partition::handle_opt_part (this=0x7609e4259f88, thd=0x7609e4000d58, check_opt=0x7609e4006330, part_id=1, flag=3)at /test/11.4_dbg/sql/ha_partition.cc:1394
#4 0x00005569b0583ae0 in ha_partition::handle_opt_partitions (this=0x7609e4259f88, thd=0x7609e4000d58, check_opt=0x7609e4006330, flag=3)at /test/11.4_dbg/sql/ha_partition.cc:1571
#5 0x00005569b05846aa in ha_partition::check (this=0x7609e4259f88, thd=0x7609e4000d58, check_opt=0x7609e4006330)at /test/11.4_dbg/sql/ha_partition.cc:1302
#6 0x00005569b0236c58 in handler::ha_check (this=0x7609e4259f88, thd=0x7609e4000d58, check_opt=0x7609e4006330)at /test/11.4_dbg/sql/handler.cc:5309
#7 0x00005569b0014491 in mysql_admin_table (thd=0x7609e4000d58, tables=0x7609e4019b78, check_opt=0x7609e4006330, operator_name=0x5569b15e8bb8 <msg_check>, lock_type=TL_READ_NO_INSERT, org_open_for_modify=false, repair_table_use_frm=false, extra_open_options=32, prepare_func=0x0, operator_func=(int (handler::)(handler const, THD , HA_CHECK_OPT )) 0x5569b0236a80 <handler::ha_check(THD, st_ha_check_opt)>, view_operator_func=0x5569aff92e30 <view_check(THD, TABLE_LIST, st_ha_check_opt*)>, is_cmd_replicated=false) at /test/11.4_dbg/sql/sql_admin.cc:915
#8 0x00005569b001702c in Sql_cmd_check_table::execute (this=0x7609e401a288, thd=0x7609e4000d58) at /test/11.4_dbg/sql/sql_admin.cc:1592
#9 0x00005569afe2b482 in mysql_execute_command (thd=0x7609e4000d58, is_called_from_prepared_stmt=false) at /test/11.4_dbg/sql/sql_parse.cc:5878
#10 0x00005569afe1a744 in mysql_parse (thd=0x7609e4000d58, rawbuf=0x7609e4019ac0 "CHECK TABLE t1", length=14, parser_state=0x760b0dacda30) at /test/11.4_dbg/sql/sql_parse.cc:7907
#11 0x00005569afe17bf4 in dispatch_command (command=COM_QUERY, thd=0x7609e4000d58, packet=0x7609e400afd9 "", packet_length=14, blocking=true) at /test/11.4_dbg/sql/sql_parse.cc:1904
#12 0x00005569afe1b2f3 in do_command (thd=0x7609e4000d58, blocking=true)at /test/11.4_dbg/sql/sql_parse.cc:1417
#13 0x00005569afffd619 in do_handle_one_connection (connect=0x5569b4a9f228, put_in_cache=true) at /test/11.4_dbg/sql/sql_connect.cc:1408
#14 0x00005569afffd3b2 in handle_one_connection (arg=0x5569b4b02cd8)at /test/11.4_dbg/sql/sql_connect.cc:1320
#15 0x0000760b14a9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#16 0x0000760b14b29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

CS 11.4.6 4a701e8ce4a178faf955641caf59fc13fcc718e9 (Debug) Build 12/04/2025

mariadbd: /test/11.4_dbg/storage/rocksdb/ha_rocksdb.cc:3004: rocksdb::Iterator *myrocks::Rdb_transaction::get_iterator(rocksdb::ColumnFamilyHandle *const, bool, bool, const rocksdb::Slice &, const rocksdb::Slice &, bool, bool): Assertion `column_family != nullptr' failed.

CS 10.6.22 690b2cf776faa2e1a6832077cec2246c86cd00bf (Debug) Build 12/04/2025
Core was generated by `/test/MD120425-mariadb-10.6.22-linux-x86_64-dbg/bin/mariadbd --no-defaults --ma'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00007dac7a41c7cd in myrocks::ha_rocksdb::can_use_bloom_filter (this=0x7dabd4071e68, thd=0x7dabd4000d58, kd=..., eq_cond=..., use_all_keys=false) at /test/10.6_dbg/storage/rocksdb/ha_rocksdb.cc:13944

[Current thread is 1 (LWP 265132)]
(gdb) bt
#0 0x00007dac7a41c7cd in myrocks::ha_rocksdb::can_use_bloom_filter (this=0x7dabd4071e68, thd=0x7dabd4000d58, kd=@0x5701cedd6c60: {static CF_FLAGS_TO_IGNORE = 4, m_index_number = 0, m_index_number_storage_form = "\000\000\000", m_cf_handle = 0x0, m_index_dict_version = 2, m_index_type = 0 '\000', m_kv_format_version = 0, m_is_reverse_cf = false, m_is_per_partition_cf = false, m_name = "", m_stats = {m_gl_index_id = {cf_id = 3, index_id = 0}, m_data_size = 0, m_rows = 0, m_actual_disk_size = 95665258596755, m_entry_deletes = 95665258598670, m_entry_single_deletes = 1305, m_entry_merges = 0, m_entry_others = 0, m_distinct_keys_per_prefix = std::vector of length -26, capacity 17272119001076 = {<error reading variable: Cannot access memory at address 0xd3>, m_index_flags_bitmap = 0, m_total_index_flags_length = 0, m_ttl_rec_offset = 0, m_ttl_duration = 2, m_ttl_column = "", m_pk_key_parts = 3, m_pk_part_no = 0x0, m_pack_info = 0x0, m_keyno = 3452012947, m_key_parts = 22273, m_ttl_pk_key_part_offset = 3452014895, m_ttl_field_index = 22273, m_prefix_extractor = std::shared_ptr<const rocksdb::SliceTransform> (empty) = { get() = 0xe45 }, m_maxlength = 0, m_mutex = {m_mutex = {global = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, mutex = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = -810081944, __spins = 22273, __elision = 0, __list = {__prev = 0xa00000000, __next = 0x80000000a}}, __size = '\000' <repeats 16 times>, "h!\267\317\001W\000\000\000\000\000\000\n\000\000\000\n\000\000\000\b\000\000", __align = 0}, file = 0x0, name = 0x0, line = 0, count = 1, create_flags = 0, active_flags = 0, id = 2, thread = 0, locked_mutex = 0x0, used_mutex = 0x0, prev = 0x0, next = 0x3}, m_psi = 0x0}}, eq_cond=@0x7dacdbffa908: {data_ = 0x7dabd4265608 "", size_ = 4}, use_all_keys=false) at /test/10.6_dbg/storage/rocksdb/ha_rocksdb.cc:13944
#1 0x00007dac7a40cc46 in myrocks::ha_rocksdb::check_bloom_and_set_bounds (this=0x7dabd4071e68, thd=0x7dabd4000d58, kd=@0x5701cedd6c60: {static CF_FLAGS_TO_IGNORE = 4, m_index_number = 0, m_index_number_storage_form = "\000\000\000", m_cf_handle = 0x0, m_index_dict_version = 2, m_index_type = 0 '\000', m_kv_format_version = 0, m_is_reverse_cf = false, m_is_per_partition_cf = false, m_name = "", m_stats = {m_gl_index_id = {cf_id = 3, index_id = 0}, m_data_size = 0, m_rows = 0, m_actual_disk_size = 95665258596755, m_entry_deletes = 95665258598670, m_entry_single_deletes = 1305, m_entry_merges = 0, m_entry_others = 0, m_distinct_keys_per_prefix = std::vector of length -26, capacity 17272119001076 = {<error reading variable: Cannot access memory at address 0xd3>, m_index_flags_bitmap = 0, m_total_index_flags_length = 0, m_ttl_rec_offset = 0, m_ttl_duration = 2, m_ttl_column = "", m_pk_key_parts = 3, m_pk_part_no = 0x0, m_pack_info = 0x0, m_keyno = 3452012947, m_key_parts = 22273, m_ttl_pk_key_part_offset = 3452014895, m_ttl_field_index = 22273, m_prefix_extractor = std::shared_ptr<const rocksdb::SliceTransform> (empty) = { get() = 0xe45 }, m_maxlength = 0, m_mutex = {m_mutex = {global = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, mutex = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = -810081944, __spins = 22273, __elision = 0, __list = {__prev = 0xa00000000, __next = 0x80000000a}}, __size = '\000' <repeats 16 times>, "h!\267\317\001W\000\000\000\000\000\000\n\000\000\000\n\000\000\000\b\000\000", __align = 0}, file = 0x0, name = 0x0, line = 0, count = 1, create_flags = 0, active_flags = 0, id = 2, thread = 0, locked_mutex = 0x0, used_mutex = 0x0, prev = 0x0, next = 0x3}, m_psi = 0x0}}, eq_cond=@0x7dacdbffa908: {data_ = 0x7dabd4265608 "", size_ = 4}, use_all_keys=false, bound_len=4, lower_bound=0x7dabd42664c8 "", upper_bound=0x7dabd42408d8 "", lower_bound_slice=0x7dabd4072440, upper_bound_slice=0x7dabd4072450)at /test/10.6_dbg/storage/rocksdb/ha_rocksdb.cc:13888
#2 0x00007dac7a407e0a in myrocks::ha_rocksdb::setup_scan_iterator (this=0x7dabd4071e68, kd=@0x5701cedd6c60: {static CF_FLAGS_TO_IGNORE = 4, m_index_number = 0, m_index_number_storage_form = "\000\000\000", m_cf_handle = 0x0, m_index_dict_version = 2, m_index_type = 0 '\000', m_kv_format_version = 0, m_is_reverse_cf = false, m_is_per_partition_cf = false, m_name = "", m_stats = {m_gl_index_id = {cf_id = 3, index_id = 0}, m_data_size = 0, m_rows = 0, m_actual_disk_size = 95665258596755, m_entry_deletes = 95665258598670, m_entry_single_deletes = 1305, m_entry_merges = 0, m_entry_others = 0, m_distinct_keys_per_prefix = std::vector of length -26, capacity 17272119001076 = {<error reading variable: Cannot access memory at address 0xd3>, m_index_flags_bitmap = 0, m_total_index_flags_length = 0, m_ttl_rec_offset = 0, m_ttl_duration = 2, m_ttl_column = "", m_pk_key_parts = 3, m_pk_part_no = 0x0, m_pack_info = 0x0, m_keyno = 3452012947, m_key_parts = 22273, m_ttl_pk_key_part_offset = 3452014895, m_ttl_field_index = 22273, m_prefix_extractor = std::shared_ptr<const rocksdb::SliceTransform> (empty) = { get() = 0xe45 }, m_maxlength = 0, m_mutex = {m_mutex = {global = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, mutex = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = -810081944, __spins = 22273, __elision = 0, __list = {__prev = 0xa00000000, __next = 0x80000000a}}, __size = '\000' <repeats 16 times>, "h!\267\317\001W\000\000\000\000\000\000\n\000\000\000\n\000\000\000\b\000\000", __align = 0}, file = 0x0, name = 0x0, line = 0, count = 1, create_flags = 0, active_flags = 0, id = 2, thread = 0, locked_mutex = 0x0, used_mutex = 0x0, prev = 0x0, next = 0x3}, m_psi = 0x0}}, slice=0x7dacdbffa980, use_all_keys=false, eq_cond_len=4)at /test/10.6_dbg/storage/rocksdb/ha_rocksdb.cc:10528
#3 0x00007dac7a40b058 in myrocks::ha_rocksdb::index_first_intern (this=0x7dabd4071e68, buf=0x7dabd4072690 "\377")at /test/10.6_dbg/storage/rocksdb/ha_rocksdb.cc:9296
#4 0x00007dac7a40aba8 in myrocks::ha_rocksdb::index_first (this=0x7dabd4071e68, buf=0x7dabd4072690 "\377")at /test/10.6_dbg/storage/rocksdb/ha_rocksdb.cc:9215
#5 0x00007dac7a4084b5 in myrocks::ha_rocksdb::check (this=0x7dabd4071e68, thd=0x7dabd4000d58, check_opt=0x7dabd4006250)at /test/10.6_dbg/storage/rocksdb/ha_rocksdb.cc:8835
#6 0x00005701ccfafab8 in handler::ha_check (this=0x7dabd4071e68, thd=0x7dabd4000d58, check_opt=0x7dabd4006250)at /test/10.6_dbg/sql/handler.cc:5116
#7 0x00005701cd32918b in ha_partition::handle_opt_part (this=0x7dabd4070d68, thd=0x7dabd4000d58, check_opt=0x7dabd4006250, part_id=1, flag=3)at /test/10.6_dbg/sql/ha_partition.cc:1394
#8 0x00005701cd328480 in ha_partition::handle_opt_partitions (this=0x7dabd4070d68, thd=0x7dabd4000d58, check_opt=0x7dabd4006250, flag=3)at /test/10.6_dbg/sql/ha_partition.cc:1571
#9 0x00005701cd32904a in ha_partition::check (this=0x7dabd4070d68, thd=0x7dabd4000d58, check_opt=0x7dabd4006250)at /test/10.6_dbg/sql/ha_partition.cc:1302
#10 0x00005701ccfafab8 in handler::ha_check (this=0x7dabd4070d68, thd=0x7dabd4000d58, check_opt=0x7dabd4006250)at /test/10.6_dbg/sql/handler.cc:5116
#11 0x00005701ccdc3385 in mysql_admin_table (thd=0x7dabd4000d58, tables=0x7dabd4013418, check_opt=0x7dabd4006250, operator_name=0x5701ce5ab120 <msg_check>, lock_type=TL_READ_NO_INSERT, org_open_for_modify=false, repair_table_use_frm=false, extra_open_options=32, prepare_func=0x0, operator_func=(int (handler::)(handler const, THD , HA_CHECK_OPT )) 0x5701ccfaf8c0 <handler::ha_check(THD, st_ha_check_opt)>, view_operator_func=0x5701ccd442a0 <view_check(THD, TABLE_LIST, st_ha_check_opt*)>, is_cmd_replicated=false) at /test/10.6_dbg/sql/sql_admin.cc:918
#12 0x00005701ccdc5ebc in Sql_cmd_check_table::execute (this=0x7dabd4013b20, thd=0x7dabd4000d58) at /test/10.6_dbg/sql/sql_admin.cc:1591
#13 0x00005701ccc0263b in mysql_execute_command (thd=0x7dabd4000d58, is_called_from_prepared_stmt=false) at /test/10.6_dbg/sql/sql_parse.cc:6167
#14 0x00005701ccbf0414 in mysql_parse (thd=0x7dabd4000d58, rawbuf=0x7dabd4013360 "CHECK TABLE t1", length=14, parser_state=0x7dacdbffda48) at /test/10.6_dbg/sql/sql_parse.cc:8209
#15 0x00005701ccbed8d4 in dispatch_command (command=COM_QUERY, thd=0x7dabd4000d58, packet=0x7dabd400ade9 "", packet_length=14, blocking=true) at /test/10.6_dbg/sql/sql_parse.cc:1908
#16 0x00005701ccbf0fc3 in do_command (thd=0x7dabd4000d58, blocking=true)at /test/10.6_dbg/sql/sql_parse.cc:1421
#17 0x00005701ccdad3e9 in do_handle_one_connection (connect=0x5701cfcc0a58, put_in_cache=true) at /test/10.6_dbg/sql/sql_connect.cc:1386
#18 0x00005701ccdad182 in handle_one_connection (arg=0x5701cfdc7ab8)at /test/10.6_dbg/sql/sql_connect.cc:1298
#19 0x00007dace089ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#20 0x00007dace0929c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Assert seen:

CS 11.4.6 4a701e8ce4a178faf955641caf59fc13fcc718e9 (Debug) Build 12/04/2025
Core was generated by `/test/MD120425-mariadb-11.4.6-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44

[Current thread is 1 (LWP 3978727)]
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
#3 0x0000734eeda4526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
#4 0x0000734eeda288ff in __GI_abort () at ./stdlib/abort.c:79
#5 0x0000734eeda2881b in __assert_fail_base (fmt=0x734eedbd01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x734e7ab8d82f "column_family != nullptr", file=file@entry=0x734e7ab87965 "/test/11.4_dbg/storage/rocksdb/ha_rocksdb.cc", line=line@entry=3004, function=function@entry=0x734e7ab8d848 "rocksdb::Iterator myrocks::Rdb_transaction::get_iterator(rocksdb::ColumnFamilyHandle const, bool, bool, const rocksdb::Slice &, const rocksdb::Slice &, bool, bool)") at ./assert/assert.c:94
#6 0x0000734eeda3b507 in __assert_fail (assertion=0x734e7ab8d82f "column_family != nullptr", file=0x734e7ab87965 "/test/11.4_dbg/storage/rocksdb/ha_rocksdb.cc", line=3004, function=0x734e7ab8d848 "rocksdb::Iterator myrocks::Rdb_transaction::get_iterator(rocksdb::ColumnFamilyHandle const, bool, bool, const rocksdb::Slice &, const rocksdb::Slice &, bool, bool)") at ./assert/assert.c:103
#7 0x0000734e7a62ed64 in myrocks::Rdb_transaction::get_iterator (this=0x734dbc25e040, column_family=0x0, skip_bloom_filter=true, fill_cache=true, eq_cond_lower_bound=@0x734dbc2759a8: {data_ = 0x734dbc26c628 "", size_ = 4}, eq_cond_upper_bound=@0x734dbc2759b8: {data_ = 0x734dbc25e018 "", size_ = 4}, read_current=false, create_snapshot=true)at /test/11.4_dbg/storage/rocksdb/ha_rocksdb.cc:3004
#8 0x0000734e7a607faa in myrocks::ha_rocksdb::setup_scan_iterator (this=0x734dbc2753b8, kd=@0x734d3f800000: {static CF_FLAGS_TO_IGNORE = 4, m_index_number = 0, m_index_number_storage_form = "\000\000\000", m_cf_handle = 0x0, m_index_dict_version = 0, m_index_type = 0 '\000', m_kv_format_version = 0, m_is_reverse_cf = false, m_is_per_partition_cf = false, m_name = "", m_stats = {m_gl_index_id = {cf_id = 0, index_id = 0}, m_data_size = 0, m_rows = 0, m_actual_disk_size = 0, m_entry_deletes = 0, m_entry_single_deletes = 0, m_entry_merges = 0, m_entry_others = 0, m_distinct_keys_per_prefix = std::vector of length 0, capacity 0, m_name = ""}, m_index_flags_bitmap = 0, m_total_index_flags_length = 0, m_ttl_rec_offset = 0, m_ttl_duration = 0, m_ttl_column = "", m_pk_key_parts = 0, m_pk_part_no = 0x0, m_pack_info = 0x0, m_keyno = 0, m_key_parts = 0, m_ttl_pk_key_part_offset = 0, m_ttl_field_index = 0, m_prefix_extractor = std::shared_ptr<const class rocksdb::SliceTransform> (empty) = { get() = 0x0 }, m_maxlength = 0, m_mutex = {m_mutex = {global = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, mutex = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}, file = 0x0, name = 0x0, line = 0, count = 0, create_flags = 0, active_flags = 0, id = 0, thread = 0, locked_mutex = 0x0, used_mutex = 0x0, prev = 0x0, next = 0x0}, m_psi = 0x0}}, slice=0x734ee81c9700, use_all_keys=false, eq_cond_len=4)at /test/11.4_dbg/storage/rocksdb/ha_rocksdb.cc:10579
#9 0x0000734e7a60af78 in myrocks::ha_rocksdb::index_first_intern (this=0x734dbc2753b8, buf=0x734dbc276428 "\377")at /test/11.4_dbg/storage/rocksdb/ha_rocksdb.cc:9302
#10 0x0000734e7a60aac8 in myrocks::ha_rocksdb::index_first (this=0x734dbc2753b8, buf=0x734dbc276428 "\377")at /test/11.4_dbg/storage/rocksdb/ha_rocksdb.cc:9221
#11 0x0000734e7a6083d4 in myrocks::ha_rocksdb::check (this=0x734dbc2753b8, thd=0x734dbc000d58, check_opt=0x734dbc006330)at /test/11.4_dbg/storage/rocksdb/ha_rocksdb.cc:8841
#12 0x000061edb35f9c58 in handler::ha_check (this=0x734dbc2753b8, thd=0x734dbc000d58, check_opt=0x734dbc006330)at /test/11.4_dbg/sql/handler.cc:5309
#13 0x000061edb39477eb in ha_partition::handle_opt_part (this=0x734dbc274af8, thd=0x734dbc000d58, check_opt=0x734dbc006330, part_id=0, flag=3)at /test/11.4_dbg/sql/ha_partition.cc:1394
#14 0x000061edb3946ae0 in ha_partition::handle_opt_partitions (this=0x734dbc274af8, thd=0x734dbc000d58, check_opt=0x734dbc006330, flag=3)at /test/11.4_dbg/sql/ha_partition.cc:1571
#15 0x000061edb39476aa in ha_partition::check (this=0x734dbc274af8, thd=0x734dbc000d58, check_opt=0x734dbc006330)at /test/11.4_dbg/sql/ha_partition.cc:1302
#16 0x000061edb35f9c58 in handler::ha_check (this=0x734dbc274af8, thd=0x734dbc000d58, check_opt=0x734dbc006330)at /test/11.4_dbg/sql/handler.cc:5309
#17 0x000061edb33d7491 in mysql_admin_table (thd=0x734dbc000d58, tables=0x734dbc019b78, check_opt=0x734dbc006330, operator_name=0x61edb49abbb8 <msg_check>, lock_type=TL_READ_NO_INSERT, org_open_for_modify=false, repair_table_use_frm=false, extra_open_options=32, prepare_func=0x0, operator_func=(int (handler::)(class handler const, class THD , HA_CHECK_OPT )) 0x61edb35f9a80 <handler::ha_check(THD, st_ha_check_opt)>, view_operator_func=0x61edb3355e30 <view_check(THD, TABLE_LIST, st_ha_check_opt*)>, is_cmd_replicated=false) at /test/11.4_dbg/sql/sql_admin.cc:915
#18 0x000061edb33da02c in Sql_cmd_check_table::execute (this=0x734dbc01a288, thd=0x734dbc000d58) at /test/11.4_dbg/sql/sql_admin.cc:1592
#19 0x000061edb31ee482 in mysql_execute_command (thd=0x734dbc000d58, is_called_from_prepared_stmt=false) at /test/11.4_dbg/sql/sql_parse.cc:5878
#20 0x000061edb31dd744 in mysql_parse (thd=0x734dbc000d58, rawbuf=0x734dbc019ac0 "CHECK TABLE t1", length=14, parser_state=0x734ee81cca30) at /test/11.4_dbg/sql/sql_parse.cc:7907
#21 0x000061edb31dabf4 in dispatch_command (command=COM_QUERY, thd=0x734dbc000d58, packet=0x734dbc00afd9 "", packet_length=14, blocking=true) at /test/11.4_dbg/sql/sql_parse.cc:1904
#22 0x000061edb31de2f3 in do_command (thd=0x734dbc000d58, blocking=true)at /test/11.4_dbg/sql/sql_parse.cc:1417
#23 0x000061edb33c0619 in do_handle_one_connection (connect=0x61edb8287228, put_in_cache=true) at /test/11.4_dbg/sql/sql_connect.cc:1408
#24 0x000061edb33c03b2 in handle_one_connection (arg=0x61edb82eacd8)at /test/11.4_dbg/sql/sql_connect.cc:1320
#25 0x0000734eeda9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#26 0x0000734eedb29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.5 dbg 120425 e6ea5d568c0fb972a391a8c64716846ddb7c57ef SIGSEGV\|myrocks::ha_rocksdb::index_first\|myrocks::ha_rocksdb::check\|handler::ha_check\|ha_partition::handle_opt_part
CS 10.5 opt 120425 e6ea5d568c0fb972a391a8c64716846ddb7c57ef SIGSEGV\|myrocks::ha_rocksdb::index_first\|myrocks::ha_rocksdb::check\|handler::ha_check\|ha_partition::handle_opt_part
CS 10.6 dbg 120425 690b2cf776faa2e1a6832077cec2246c86cd00bf SIGSEGV\|myrocks::ha_rocksdb::can_use_bloom_filter\|myrocks::ha_rocksdb::check_bloom_and_set_bounds\|myrocks::ha_rocksdb::setup_scan_iterator\|myrocks::ha_rocksdb::index_first_intern
CS 10.6 opt 120425 690b2cf776faa2e1a6832077cec2246c86cd00bf SIGSEGV\|myrocks::ha_rocksdb::index_first\|myrocks::ha_rocksdb::check\|handler::ha_check\|ha_partition::handle_opt_part
CS 10.11 dbg 120425 acd071f599f416ddb4821dec485c4d912844213f SIGSEGV\|myrocks::ha_rocksdb::index_first\|myrocks::ha_rocksdb::check\|handler::ha_check\|ha_partition::handle_opt_part
CS 10.11 opt 120425 acd071f599f416ddb4821dec485c4d912844213f SIGSEGV\|myrocks::ha_rocksdb::index_first\|myrocks::ha_rocksdb::check\|handler::ha_check\|ha_partition::handle_opt_part
CS 11.4 dbg 120425 4a701e8ce4a178faf955641caf59fc13fcc718e9 SIGSEGV\|myrocks::ha_rocksdb::index_first\|myrocks::ha_rocksdb::check\|handler::ha_check\|ha_partition::handle_opt_part
CS 11.4 opt 120425 4a701e8ce4a178faf955641caf59fc13fcc718e9 SIGSEGV\|myrocks::ha_rocksdb::index_first\|myrocks::ha_rocksdb::check\|handler::ha_check\|ha_partition::handle_opt_part
CS 11.8 dbg 120425 db5bb6f3339be5a49c0f397eb80a0f259f73f447 SIGSEGV\|myrocks::ha_rocksdb::index_first\|myrocks::ha_rocksdb::check\|handler::ha_check\|ha_partition::handle_opt_part
CS 11.8 opt 120425 db5bb6f3339be5a49c0f397eb80a0f259f73f447 SIGSEGV\|myrocks::ha_rocksdb::index_first\|myrocks::ha_rocksdb::check\|handler::ha_check\|ha_partition::handle_opt_part
CS 12.0 dbg 120425 22efc2c784e1b7199fb5804e6330168277ea7dce SIGSEGV\|myrocks::ha_rocksdb::index_first\|myrocks::ha_rocksdb::check\|handler::ha_check\|ha_partition::handle_opt_part
CS 12.0 opt 120425 22efc2c784e1b7199fb5804e6330168277ea7dce SIGSEGV\|myrocks::ha_rocksdb::index_first\|myrocks::ha_rocksdb::check\|handler::ha_check\|ha_partition::handle_opt_part
ES 10.5 dbg 120425 0d368ec0042a81d9549fc939fb742f82350b20ab SIGSEGV\|myrocks::ha_rocksdb::index_first\|myrocks::ha_rocksdb::check\|handler::ha_check\|ha_partition::handle_opt_part
ES 10.5 opt 120425 0d368ec0042a81d9549fc939fb742f82350b20ab SIGSEGV\|myrocks::ha_rocksdb::index_first\|myrocks::ha_rocksdb::check\|handler::ha_check\|ha_partition::handle_opt_part
ES 10.6 dbg 120425 74602d1b054ba6c9ee20af79d6e7807440a7a98e SIGSEGV\|myrocks::ha_rocksdb::index_first\|myrocks::ha_rocksdb::check\|handler::ha_check\|ha_partition::handle_opt_part
ES 10.6 opt 120425 74602d1b054ba6c9ee20af79d6e7807440a7a98e SIGSEGV\|myrocks::ha_rocksdb::index_first\|myrocks::ha_rocksdb::check\|handler::ha_check\|ha_partition::handle_opt_part
ES 11.4 dbg 120425 9cd12544ebfd0d52d2158af66b5aced58121cf1f SIGSEGV\|myrocks::ha_rocksdb::index_first\|myrocks::ha_rocksdb::check\|handler::ha_check\|ha_partition::handle_opt_part
ES 11.4 opt 120425 9cd12544ebfd0d52d2158af66b5aced58121cf1f SIGSEGV\|myrocks::ha_rocksdb::index_first\|myrocks::ha_rocksdb::check\|handler::ha_check\|ha_partition::handle_opt_part

The CS 10.6 dbg outcome is an example of a sporadic different SIGSEGV.

Attachments

Issue Links

relates to

MDEV-23956 Server crash or ASAN errors in myrocks::ha_rocksdb::index_first / myrocks::ha_rocksdb::inplace_populate_sk / ha_rocksdb::can_use_bloom_filter / rocksdb::DBImpl::NewIterator

Confirmed

Activity

Ascending order - Click to sort in descending order

Roel Van de Paar added a comment - 2025-04-18 08:20

SAN Results

CS 10.5.29 c43d0a015f974c5a0142e6779332089a7a979853 (Debug, UBASAN, Clang) Build 15/02/2025
==544394==ERROR: AddressSanitizer: heap-use-after-free on address 0x504000033598 at pc 0x7067332586f6 bp 0x706735cfff10 sp 0x706735cfff08
READ of size 8 at 0x504000033598 thread T16
#0 0x7067332586f5 in std::__shared_ptr<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2>::get() const /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/shared_ptr_base.h:1667:16
#1 0x7067332586f5 in std::__shared_ptr_access<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2, false, false>::_M_get() const /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/shared_ptr_base.h:1364:66
#2 0x7067332586f5 in std::__shared_ptr_access<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2, false, false>::operator->() const /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/shared_ptr_base.h:1358:9
#3 0x7067332586f5 in myrocks::ha_rocksdb::index_first(unsigned char*) /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:9191:12
#4 0x70673324f5a0 in myrocks::ha_rocksdb::check(THD, st_ha_check_opt) /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc
#5 0x63d6f63908dc in handler::ha_check(THD, st_ha_check_opt) /test/10.5_dbg_san/sql/handler.cc:4744:7
#6 0x63d6f70ce2f7 in ha_partition::handle_opt_part(THD, st_ha_check_opt, unsigned int, unsigned int) /test/10.5_dbg_san/sql/ha_partition.cc:1379:18
#7 0x63d6f70ccd20 in ha_partition::handle_opt_partitions(THD, st_ha_check_opt, unsigned int) /test/10.5_dbg_san/sql/ha_partition.cc:1556:13
#8 0x63d6f63908dc in handler::ha_check(THD, st_ha_check_opt) /test/10.5_dbg_san/sql/handler.cc:4744:7
#9 0x63d6f5cdffea in mysql_admin_table(THD, TABLE_LIST, st_ha_check_opt, char const, thr_lock_type, bool, bool, unsigned int, int ()(THD, TABLE_LIST, st_ha_check_opt), int (handler::)(THD, st_ha_check_opt), int ()(THD, TABLE_LIST, st_ha_check_opt*), bool) /test/10.5_dbg_san/sql/sql_admin.cc:875:21
#10 0x63d6f5ce4e8d in Sql_cmd_check_table::execute(THD*) /test/10.5_dbg_san/sql/sql_admin.cc:1490:8
#11 0x63d6f56abf3f in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:6194:26
#12 0x63d6f568b467 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8252:18
#13 0x63d6f567f3b9 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1891:7
#14 0x63d6f568d5be in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1375:17
#15 0x63d6f5c97257 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1386:11
#16 0x63d6f5c96b1b in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1298:5
#17 0x63d6f51a003c in asan_thread_start(void*) asan_interceptors.cpp.o
#18 0x70686fa9ca93 in start_thread nptl/pthread_create.c:447:8
#19 0x70686fb29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x504000033598 is located 8 bytes inside of 40-byte region [0x504000033590,0x5040000335b8)
freed by thread T16 here:
#0 0x63d6f51e13f1 in operator delete(void*) (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x22fc3f1) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3)
#1 0x7067332c460b in rocksdb::ColumnFamilyOptions::~ColumnFamilyOptions() /test/10.5_dbg_san/storage/rocksdb/rocksdb/include/rocksdb/options.h:84:8
#2 0x70673343ac46 in rocksdb::DBImpl::GetOptions(rocksdb::ColumnFamilyHandle*) const /test/10.5_dbg_san/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2779:3
#3 0x706733b41230 in rocksdb::StackableDB::GetOptions(rocksdb::ColumnFamilyHandle*) const /test/10.5_dbg_san/storage/rocksdb/rocksdb/include/rocksdb/utilities/stackable_db.h:308:17
#4 0x70673336360c in myrocks::Rdb_key_def::setup(TABLE const, myrocks::Rdb_tbl_def const) /test/10.5_dbg_san/storage/rocksdb/rdb_datadic.cc:583:50
#5 0x70673323985b in myrocks::ha_rocksdb::create_key_def(TABLE const, unsigned int, myrocks::Rdb_tbl_def const, std::shared_ptr<myrocks::Rdb_key_def>*, myrocks::ha_rocksdb::key_def_cf_info const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) const /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:7581:19
#6 0x7067332373e5 in myrocks::ha_rocksdb::create_key_defs(TABLE const, myrocks::Rdb_tbl_def, TABLE const, myrocks::Rdb_tbl_def const) const /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:7172:11
#7 0x70673323e3a0 in myrocks::ha_rocksdb::create_table(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, TABLE const*, unsigned long long) /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:7759:9
#8 0x70673323f65b in myrocks::ha_rocksdb::create(char const, TABLE, HA_CREATE_INFO*) /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:7905:3
#9 0x63d6f6397703 in handler::ha_create(char const, TABLE, HA_CREATE_INFO*) /test/10.5_dbg_san/sql/handler.cc:5245:14
#10 0x63d6f70c7b63 in ha_partition::create(char const, TABLE, HA_CREATE_INFO*) /test/10.5_dbg_san/sql/ha_partition.cc:854:11
#11 0x63d6f6397703 in handler::ha_create(char const, TABLE, HA_CREATE_INFO*) /test/10.5_dbg_san/sql/handler.cc:5245:14
#12 0x63d6f639fb29 in ha_create_table(THD, char const, char const, char const, HA_CREATE_INFO, st_mysql_const_unsigned_lex_string) /test/10.5_dbg_san/sql/handler.cc:5714:22
#13 0x63d6f5a22a77 in create_table_impl(THD, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, char const, DDL_options_st, HA_CREATE_INFO, Alter_info, int, bool, st_key, unsigned int, st_mysql_const_unsigned_lex_string*) /test/10.5_dbg_san/sql/sql_table.cc:5558:11
#14 0x63d6f5a209a8 in mysql_create_table_no_lock(THD, Table_specification_st, Alter_info, bool, int, TABLE_LIST*) /test/10.5_dbg_san/sql/sql_table.cc:5643:8
#15 0x63d6f5a25885 in mysql_create_table(THD, TABLE_LIST, Table_specification_st, Alter_info) /test/10.5_dbg_san/sql/sql_table.cc:5873:7
#16 0x63d6f5a771ba in Sql_cmd_create_table_like::execute(THD*) /test/10.5_dbg_san/sql/sql_table.cc:12840:12
#17 0x63d6f56abf3f in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:6194:26
#18 0x63d6f568b467 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8252:18
#19 0x63d6f567f3b9 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1891:7
#20 0x63d6f568d5be in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1375:17
#21 0x63d6f5c97257 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1386:11
#22 0x63d6f5c96b1b in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1298:5
#23 0x63d6f51a003c in asan_thread_start(void*) asan_interceptors.cpp.o

previously allocated by thread T16 here:
#0 0x63d6f51e0b71 in operator new(unsigned long) (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x22fbb71) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3)
#1 0x706733308e88 in std::__new_allocator<rocksdb::DbPath>::allocate(unsigned long, void const*) /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/new_allocator.h:151:27
#2 0x706733308e88 in std::allocator_traits<std::allocator<rocksdb::DbPath>>::allocate(std::allocator<rocksdb::DbPath>&, unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/alloc_traits.h:478:20
#3 0x706733308e88 in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath>>::_M_allocate(unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/stl_vector.h:380:20
#4 0x706733308e88 in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath>>::_M_create_storage(unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/stl_vector.h:398:33
#5 0x706733308076 in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath>>::_Vector_base(unsigned long, std::allocator<rocksdb::DbPath> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/stl_vector.h:334:9
#6 0x706733308076 in std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath>>::vector(std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath>> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/stl_vector.h:602:9
#7 0x706733308076 in rocksdb::ColumnFamilyOptions::ColumnFamilyOptions(rocksdb::ColumnFamilyOptions const&) /test/10.5_dbg_san/storage/rocksdb/rocksdb/include/rocksdb/options.h:84:8
#8 0x7067338b16e1 in rocksdb::BuildColumnFamilyOptions(rocksdb::ColumnFamilyOptions const&, rocksdb::MutableCFOptions const&) /test/10.5_dbg_san/storage/rocksdb/rocksdb/options/options_helper.cc:154:23
#9 0x706733c0bfbb in rocksdb::ColumnFamilyData::GetLatestCFOptions() const /test/10.5_dbg_san/storage/rocksdb/rocksdb/db/column_family.cc:647:10
#10 0x70673343ac16 in rocksdb::DBImpl::GetOptions(rocksdb::ColumnFamilyHandle*) const /test/10.5_dbg_san/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2780:30
#11 0x706733b41230 in rocksdb::StackableDB::GetOptions(rocksdb::ColumnFamilyHandle*) const /test/10.5_dbg_san/storage/rocksdb/rocksdb/include/rocksdb/utilities/stackable_db.h:308:17
#12 0x70673336360c in myrocks::Rdb_key_def::setup(TABLE const, myrocks::Rdb_tbl_def const) /test/10.5_dbg_san/storage/rocksdb/rdb_datadic.cc:583:50
#13 0x70673323985b in myrocks::ha_rocksdb::create_key_def(TABLE const, unsigned int, myrocks::Rdb_tbl_def const, std::shared_ptr<myrocks::Rdb_key_def>*, myrocks::ha_rocksdb::key_def_cf_info const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) const /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:7581:19
#14 0x7067332373e5 in myrocks::ha_rocksdb::create_key_defs(TABLE const, myrocks::Rdb_tbl_def, TABLE const, myrocks::Rdb_tbl_def const) const /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:7172:11
#15 0x70673323e3a0 in myrocks::ha_rocksdb::create_table(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, TABLE const*, unsigned long long) /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:7759:9
#16 0x70673323f65b in myrocks::ha_rocksdb::create(char const, TABLE, HA_CREATE_INFO*) /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:7905:3
#17 0x63d6f6397703 in handler::ha_create(char const, TABLE, HA_CREATE_INFO*) /test/10.5_dbg_san/sql/handler.cc:5245:14
#18 0x63d6f70c7b63 in ha_partition::create(char const, TABLE, HA_CREATE_INFO*) /test/10.5_dbg_san/sql/ha_partition.cc:854:11
#19 0x63d6f6397703 in handler::ha_create(char const, TABLE, HA_CREATE_INFO*) /test/10.5_dbg_san/sql/handler.cc:5245:14
#20 0x63d6f639fb29 in ha_create_table(THD, char const, char const, char const, HA_CREATE_INFO, st_mysql_const_unsigned_lex_string) /test/10.5_dbg_san/sql/handler.cc:5714:22
#21 0x63d6f5a22a77 in create_table_impl(THD, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, char const, DDL_options_st, HA_CREATE_INFO, Alter_info, int, bool, st_key, unsigned int, st_mysql_const_unsigned_lex_string*) /test/10.5_dbg_san/sql/sql_table.cc:5558:11
#22 0x63d6f5a209a8 in mysql_create_table_no_lock(THD, Table_specification_st, Alter_info, bool, int, TABLE_LIST*) /test/10.5_dbg_san/sql/sql_table.cc:5643:8
#23 0x63d6f5a25885 in mysql_create_table(THD, TABLE_LIST, Table_specification_st, Alter_info) /test/10.5_dbg_san/sql/sql_table.cc:5873:7
#24 0x63d6f5a771ba in Sql_cmd_create_table_like::execute(THD*) /test/10.5_dbg_san/sql/sql_table.cc:12840:12
#25 0x63d6f56abf3f in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:6194:26
#26 0x63d6f568b467 in mysql_parse(THD, char, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8252:18
#27 0x63d6f567f3b9 in dispatch_command(enum_server_command, THD, char, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1891:7
#28 0x63d6f568d5be in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1375:17
#29 0x63d6f5c97257 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1386:11
#30 0x63d6f5c96b1b in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1298:5
#31 0x63d6f51a003c in asan_thread_start(void*) asan_interceptors.cpp.o

Thread T16 created by T0 here:
#0 0x63d6f5187ec5 in pthread_create (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x22a2ec5) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3)
#1 0x63d6f51f364a in create_thread_to_handle_connection(CONNECT*) /test/10.5_dbg_san/sql/mysqld.cc:6072:19
#2 0x63d6f51f4721 in handle_connections_sockets() /test/10.5_dbg_san/sql/mysqld.cc:6327:9
#3 0x63d6f51f28ea in run_main_loop() /test/10.5_dbg_san/sql/mysqld.cc:5313:3
#4 0x63d6f51e98f4 in mysqld_main(int, char**) /test/10.5_dbg_san/sql/mysqld.cc:5724:3
#5 0x70686fa2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#6 0x70686fa2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#7 0x63d6f5107704 in _start (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x2222704) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3)

SUMMARY: AddressSanitizer: heap-use-after-free /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:9191:12 in myrocks::ha_rocksdb::index_first(unsigned char*)
Shadow bytes around the buggy address:
0x504000033300: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
0x504000033380: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
0x504000033400: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
0x504000033480: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
0x504000033500: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
=>0x504000033580: fa fa fd[fd]fd fd fd fa fa fa fd fd fd fd fd fa
0x504000033600: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
0x504000033680: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
0x504000033700: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
0x504000033780: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
0x504000033800: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==544394==ABORTING

Setup:

Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18. Ubuntu instructions:

  # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev

Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1   # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter

    export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1

SAN Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.5 dbg 150225 c43d0a015f974c5a0142e6779332089a7a979853 ASAN\|heap-use-after-free\|include/c++/current_version/bits/shared_ptr_base.h\|std::__shared_ptr<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|myrocks::ha_rocksdb::index_first
CS 10.5 opt 150225 c43d0a015f974c5a0142e6779332089a7a979853 ASAN\|heap-use-after-free\|include/c++/current_version/bits/shared_ptr_base.h\|std::__shared_ptr<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|myrocks::ha_rocksdb::index_first
CS 10.6 dbg 150225 f1d7e0c17e33f77278e6226dd94aeb30fc856bf0 ASAN\|heap-use-after-free\|include/c++/current_version/bits/shared_ptr_base.h\|std::__shared_ptr<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|myrocks::ha_rocksdb::index_first
CS 10.6 opt 150225 f1d7e0c17e33f77278e6226dd94aeb30fc856bf0 ASAN\|heap-use-after-free\|include/c++/current_version/bits/shared_ptr_base.h\|std::__shared_ptr<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|myrocks::ha_rocksdb::index_first
CS 10.11 dbg 150225 43c5d1303f5c7c726db276815c459436110f342f ASAN\|heap-use-after-free\|include/c++/current_version/bits/shared_ptr_base.h\|std::__shared_ptr<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|myrocks::ha_rocksdb::index_first
CS 10.11 opt 150225 43c5d1303f5c7c726db276815c459436110f342f ASAN\|heap-use-after-free\|include/c++/current_version/bits/shared_ptr_base.h\|std::__shared_ptr<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|myrocks::ha_rocksdb::index_first
CS 11.4 dbg 150225 ef966af801afc2a07222b5df65dddd52c77431dd ASAN\|heap-use-after-free\|include/c++/current_version/bits/shared_ptr_base.h\|std::__shared_ptr<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|myrocks::ha_rocksdb::index_first
CS 11.4 opt 150225 ef966af801afc2a07222b5df65dddd52c77431dd ASAN\|heap-use-after-free\|include/c++/current_version/bits/shared_ptr_base.h\|std::__shared_ptr<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|myrocks::ha_rocksdb::index_first
CS 11.8 dbg 150225 33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d ASAN\|heap-use-after-free\|include/c++/current_version/bits/shared_ptr_base.h\|std::__shared_ptr<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|myrocks::ha_rocksdb::index_first
CS 11.8 opt 150225 33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d ASAN\|heap-use-after-free\|include/c++/current_version/bits/shared_ptr_base.h\|std::__shared_ptr<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|myrocks::ha_rocksdb::index_first
CS 12.0 dbg 150225 c92add291e636c797e6d6ddca605905541b2a441 ASAN\|heap-use-after-free\|include/c++/current_version/bits/shared_ptr_base.h\|std::__shared_ptr<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|myrocks::ha_rocksdb::index_first
CS 12.0 opt 150225 c92add291e636c797e6d6ddca605905541b2a441 ASAN\|heap-use-after-free\|include/c++/current_version/bits/shared_ptr_base.h\|std::__shared_ptr<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|myrocks::ha_rocksdb::index_first
ES 10.5 dbg 140325 6553c62369ab3606efc74295c902181f793fd6d1 ASAN\|heap-use-after-free\|include/c++/current_version/bits/shared_ptr_base.h\|std::__shared_ptr<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|myrocks::ha_rocksdb::index_first
ES 10.5 opt 140325 6553c62369ab3606efc74295c902181f793fd6d1 ASAN\|heap-use-after-free\|include/c++/current_version/bits/shared_ptr_base.h\|std::__shared_ptr<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|myrocks::ha_rocksdb::index_first
ES 10.6 dbg 140325 a99e9e4101f5d56a379577e6d81c829b7658df99 ASAN\|heap-use-after-free\|include/c++/current_version/bits/shared_ptr_base.h\|std::__shared_ptr<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|myrocks::ha_rocksdb::index_first
ES 10.6 opt 140325 a99e9e4101f5d56a379577e6d81c829b7658df99 No bug found
ES 11.4 dbg 140325 26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba ASAN\|heap-use-after-free\|include/c++/current_version/bits/shared_ptr_base.h\|std::__shared_ptr<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|myrocks::ha_rocksdb::index_first
ES 11.4 opt 140325 26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba ASAN\|heap-use-after-free\|include/c++/current_version/bits/shared_ptr_base.h\|std::__shared_ptr<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|std::__shared_ptr_access<myrocks::Rdb_key_def,\|myrocks::ha_rocksdb::index_first

The ES 10.6 opt difference is another occurence of MENT-2277.

Roel Van de Paar added a comment - 2025-04-18 08:20 SAN Results CS 10.5.29 c43d0a015f974c5a0142e6779332089a7a979853 (Debug, UBASAN, Clang) Build 15/02/2025 ==544394==ERROR: AddressSanitizer: heap-use-after-free on address 0x504000033598 at pc 0x7067332586f6 bp 0x706735cfff10 sp 0x706735cfff08 READ of size 8 at 0x504000033598 thread T16 #0 0x7067332586f5 in std::__shared_ptr<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2>::get() const /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/shared_ptr_base.h:1667:16 #1 0x7067332586f5 in std::__shared_ptr_access<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2, false, false>::_M_get() const /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/shared_ptr_base.h:1364:66 #2 0x7067332586f5 in std::__shared_ptr_access<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2, false, false>::operator->() const /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/shared_ptr_base.h:1358:9 #3 0x7067332586f5 in myrocks::ha_rocksdb::index_first(unsigned char*) /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:9191:12 #4 0x70673324f5a0 in myrocks::ha_rocksdb::check(THD*, st_ha_check_opt*) /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc #5 0x63d6f63908dc in handler::ha_check(THD*, st_ha_check_opt*) /test/10.5_dbg_san/sql/handler.cc:4744:7 #6 0x63d6f70ce2f7 in ha_partition::handle_opt_part(THD*, st_ha_check_opt*, unsigned int, unsigned int) /test/10.5_dbg_san/sql/ha_partition.cc:1379:18 #7 0x63d6f70ccd20 in ha_partition::handle_opt_partitions(THD*, st_ha_check_opt*, unsigned int) /test/10.5_dbg_san/sql/ha_partition.cc:1556:13 #8 0x63d6f63908dc in handler::ha_check(THD*, st_ha_check_opt*) /test/10.5_dbg_san/sql/handler.cc:4744:7 #9 0x63d6f5cdffea in mysql_admin_table(THD*, TABLE_LIST*, st_ha_check_opt*, char const*, thr_lock_type, bool, bool, unsigned int, int (*)(THD*, TABLE_LIST*, st_ha_check_opt*), int (handler::*)(THD*, st_ha_check_opt*), int (*)(THD*, TABLE_LIST*, st_ha_check_opt*), bool) /test/10.5_dbg_san/sql/sql_admin.cc:875:21 #10 0x63d6f5ce4e8d in Sql_cmd_check_table::execute(THD*) /test/10.5_dbg_san/sql/sql_admin.cc:1490:8 #11 0x63d6f56abf3f in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:6194:26 #12 0x63d6f568b467 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8252:18 #13 0x63d6f567f3b9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1891:7 #14 0x63d6f568d5be in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1375:17 #15 0x63d6f5c97257 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1386:11 #16 0x63d6f5c96b1b in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1298:5 #17 0x63d6f51a003c in asan_thread_start(void*) asan_interceptors.cpp.o #18 0x70686fa9ca93 in start_thread nptl/pthread_create.c:447:8 #19 0x70686fb29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 0x504000033598 is located 8 bytes inside of 40-byte region [0x504000033590,0x5040000335b8) freed by thread T16 here: #0 0x63d6f51e13f1 in operator delete(void*) (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x22fc3f1) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3) #1 0x7067332c460b in rocksdb::ColumnFamilyOptions::~ColumnFamilyOptions() /test/10.5_dbg_san/storage/rocksdb/rocksdb/include/rocksdb/options.h:84:8 #2 0x70673343ac46 in rocksdb::DBImpl::GetOptions(rocksdb::ColumnFamilyHandle*) const /test/10.5_dbg_san/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2779:3 #3 0x706733b41230 in rocksdb::StackableDB::GetOptions(rocksdb::ColumnFamilyHandle*) const /test/10.5_dbg_san/storage/rocksdb/rocksdb/include/rocksdb/utilities/stackable_db.h:308:17 #4 0x70673336360c in myrocks::Rdb_key_def::setup(TABLE const*, myrocks::Rdb_tbl_def const*) /test/10.5_dbg_san/storage/rocksdb/rdb_datadic.cc:583:50 #5 0x70673323985b in myrocks::ha_rocksdb::create_key_def(TABLE const*, unsigned int, myrocks::Rdb_tbl_def const*, std::shared_ptr<myrocks::Rdb_key_def>*, myrocks::ha_rocksdb::key_def_cf_info const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) const /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:7581:19 #6 0x7067332373e5 in myrocks::ha_rocksdb::create_key_defs(TABLE const*, myrocks::Rdb_tbl_def*, TABLE const*, myrocks::Rdb_tbl_def const*) const /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:7172:11 #7 0x70673323e3a0 in myrocks::ha_rocksdb::create_table(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, TABLE const*, unsigned long long) /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:7759:9 #8 0x70673323f65b in myrocks::ha_rocksdb::create(char const*, TABLE*, HA_CREATE_INFO*) /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:7905:3 #9 0x63d6f6397703 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /test/10.5_dbg_san/sql/handler.cc:5245:14 #10 0x63d6f70c7b63 in ha_partition::create(char const*, TABLE*, HA_CREATE_INFO*) /test/10.5_dbg_san/sql/ha_partition.cc:854:11 #11 0x63d6f6397703 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /test/10.5_dbg_san/sql/handler.cc:5245:14 #12 0x63d6f639fb29 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /test/10.5_dbg_san/sql/handler.cc:5714:22 #13 0x63d6f5a22a77 in create_table_impl(THD*, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, char const*, DDL_options_st, HA_CREATE_INFO*, Alter_info*, int, bool*, st_key**, unsigned int*, st_mysql_const_unsigned_lex_string*) /test/10.5_dbg_san/sql/sql_table.cc:5558:11 #14 0x63d6f5a209a8 in mysql_create_table_no_lock(THD*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /test/10.5_dbg_san/sql/sql_table.cc:5643:8 #15 0x63d6f5a25885 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /test/10.5_dbg_san/sql/sql_table.cc:5873:7 #16 0x63d6f5a771ba in Sql_cmd_create_table_like::execute(THD*) /test/10.5_dbg_san/sql/sql_table.cc:12840:12 #17 0x63d6f56abf3f in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:6194:26 #18 0x63d6f568b467 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8252:18 #19 0x63d6f567f3b9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1891:7 #20 0x63d6f568d5be in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1375:17 #21 0x63d6f5c97257 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1386:11 #22 0x63d6f5c96b1b in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1298:5 #23 0x63d6f51a003c in asan_thread_start(void*) asan_interceptors.cpp.o previously allocated by thread T16 here: #0 0x63d6f51e0b71 in operator new(unsigned long) (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x22fbb71) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3) #1 0x706733308e88 in std::__new_allocator<rocksdb::DbPath>::allocate(unsigned long, void const*) /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/new_allocator.h:151:27 #2 0x706733308e88 in std::allocator_traits<std::allocator<rocksdb::DbPath>>::allocate(std::allocator<rocksdb::DbPath>&, unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/alloc_traits.h:478:20 #3 0x706733308e88 in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath>>::_M_allocate(unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/stl_vector.h:380:20 #4 0x706733308e88 in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath>>::_M_create_storage(unsigned long) /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/stl_vector.h:398:33 #5 0x706733308076 in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath>>::_Vector_base(unsigned long, std::allocator<rocksdb::DbPath> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/stl_vector.h:334:9 #6 0x706733308076 in std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath>>::vector(std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath>> const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/14/../../../../include/c++/14/bits/stl_vector.h:602:9 #7 0x706733308076 in rocksdb::ColumnFamilyOptions::ColumnFamilyOptions(rocksdb::ColumnFamilyOptions const&) /test/10.5_dbg_san/storage/rocksdb/rocksdb/include/rocksdb/options.h:84:8 #8 0x7067338b16e1 in rocksdb::BuildColumnFamilyOptions(rocksdb::ColumnFamilyOptions const&, rocksdb::MutableCFOptions const&) /test/10.5_dbg_san/storage/rocksdb/rocksdb/options/options_helper.cc:154:23 #9 0x706733c0bfbb in rocksdb::ColumnFamilyData::GetLatestCFOptions() const /test/10.5_dbg_san/storage/rocksdb/rocksdb/db/column_family.cc:647:10 #10 0x70673343ac16 in rocksdb::DBImpl::GetOptions(rocksdb::ColumnFamilyHandle*) const /test/10.5_dbg_san/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2780:30 #11 0x706733b41230 in rocksdb::StackableDB::GetOptions(rocksdb::ColumnFamilyHandle*) const /test/10.5_dbg_san/storage/rocksdb/rocksdb/include/rocksdb/utilities/stackable_db.h:308:17 #12 0x70673336360c in myrocks::Rdb_key_def::setup(TABLE const*, myrocks::Rdb_tbl_def const*) /test/10.5_dbg_san/storage/rocksdb/rdb_datadic.cc:583:50 #13 0x70673323985b in myrocks::ha_rocksdb::create_key_def(TABLE const*, unsigned int, myrocks::Rdb_tbl_def const*, std::shared_ptr<myrocks::Rdb_key_def>*, myrocks::ha_rocksdb::key_def_cf_info const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&) const /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:7581:19 #14 0x7067332373e5 in myrocks::ha_rocksdb::create_key_defs(TABLE const*, myrocks::Rdb_tbl_def*, TABLE const*, myrocks::Rdb_tbl_def const*) const /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:7172:11 #15 0x70673323e3a0 in myrocks::ha_rocksdb::create_table(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const&, TABLE const*, unsigned long long) /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:7759:9 #16 0x70673323f65b in myrocks::ha_rocksdb::create(char const*, TABLE*, HA_CREATE_INFO*) /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:7905:3 #17 0x63d6f6397703 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /test/10.5_dbg_san/sql/handler.cc:5245:14 #18 0x63d6f70c7b63 in ha_partition::create(char const*, TABLE*, HA_CREATE_INFO*) /test/10.5_dbg_san/sql/ha_partition.cc:854:11 #19 0x63d6f6397703 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /test/10.5_dbg_san/sql/handler.cc:5245:14 #20 0x63d6f639fb29 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /test/10.5_dbg_san/sql/handler.cc:5714:22 #21 0x63d6f5a22a77 in create_table_impl(THD*, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, char const*, DDL_options_st, HA_CREATE_INFO*, Alter_info*, int, bool*, st_key**, unsigned int*, st_mysql_const_unsigned_lex_string*) /test/10.5_dbg_san/sql/sql_table.cc:5558:11 #22 0x63d6f5a209a8 in mysql_create_table_no_lock(THD*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /test/10.5_dbg_san/sql/sql_table.cc:5643:8 #23 0x63d6f5a25885 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /test/10.5_dbg_san/sql/sql_table.cc:5873:7 #24 0x63d6f5a771ba in Sql_cmd_create_table_like::execute(THD*) /test/10.5_dbg_san/sql/sql_table.cc:12840:12 #25 0x63d6f56abf3f in mysql_execute_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:6194:26 #26 0x63d6f568b467 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:8252:18 #27 0x63d6f567f3b9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /test/10.5_dbg_san/sql/sql_parse.cc:1891:7 #28 0x63d6f568d5be in do_command(THD*) /test/10.5_dbg_san/sql/sql_parse.cc:1375:17 #29 0x63d6f5c97257 in do_handle_one_connection(CONNECT*, bool) /test/10.5_dbg_san/sql/sql_connect.cc:1386:11 #30 0x63d6f5c96b1b in handle_one_connection /test/10.5_dbg_san/sql/sql_connect.cc:1298:5 #31 0x63d6f51a003c in asan_thread_start(void*) asan_interceptors.cpp.o Thread T16 created by T0 here: #0 0x63d6f5187ec5 in pthread_create (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x22a2ec5) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3) #1 0x63d6f51f364a in create_thread_to_handle_connection(CONNECT*) /test/10.5_dbg_san/sql/mysqld.cc:6072:19 #2 0x63d6f51f4721 in handle_connections_sockets() /test/10.5_dbg_san/sql/mysqld.cc:6327:9 #3 0x63d6f51f28ea in run_main_loop() /test/10.5_dbg_san/sql/mysqld.cc:5313:3 #4 0x63d6f51e98f4 in mysqld_main(int, char**) /test/10.5_dbg_san/sql/mysqld.cc:5724:3 #5 0x70686fa2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #6 0x70686fa2a28a in __libc_start_main csu/../csu/libc-start.c:360:3 #7 0x63d6f5107704 in _start (/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd+0x2222704) (BuildId: c8e170931c5f37b4c1ae0bc251c54af4ad5ab6e3) SUMMARY: AddressSanitizer: heap-use-after-free /test/10.5_dbg_san/storage/rocksdb/ha_rocksdb.cc:9191:12 in myrocks::ha_rocksdb::index_first(unsigned char*) Shadow bytes around the buggy address: 0x504000033300: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa 0x504000033380: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x504000033400: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x504000033480: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x504000033500: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa =>0x504000033580: fa fa fd[fd]fd fd fd fa fa fa fd fd fd fd fd fa 0x504000033600: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x504000033680: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x504000033700: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd 0x504000033780: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa 0x504000033800: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==544394==ABORTING Setup: Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18. Ubuntu instructions: # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref dpkg --list | grep -iE 'clang|llvm' and use apt purge and dpkg --purge to remove the packages), before installing Clang/LLVM 18 sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and: -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON Set before execution: export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1 # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1 SAN Bug Detection Matrix Rel o/d Build Commit UniqueID observed CS 10.5 dbg 150225 c43d0a015f974c5a0142e6779332089a7a979853 ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first CS 10.5 opt 150225 c43d0a015f974c5a0142e6779332089a7a979853 ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first CS 10.6 dbg 150225 f1d7e0c17e33f77278e6226dd94aeb30fc856bf0 ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first CS 10.6 opt 150225 f1d7e0c17e33f77278e6226dd94aeb30fc856bf0 ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first CS 10.11 dbg 150225 43c5d1303f5c7c726db276815c459436110f342f ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first CS 10.11 opt 150225 43c5d1303f5c7c726db276815c459436110f342f ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first CS 11.4 dbg 150225 ef966af801afc2a07222b5df65dddd52c77431dd ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first CS 11.4 opt 150225 ef966af801afc2a07222b5df65dddd52c77431dd ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first CS 11.8 dbg 150225 33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first CS 11.8 opt 150225 33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first CS 12.0 dbg 150225 c92add291e636c797e6d6ddca605905541b2a441 ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first CS 12.0 opt 150225 c92add291e636c797e6d6ddca605905541b2a441 ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first ES 10.5 dbg 140325 6553c62369ab3606efc74295c902181f793fd6d1 ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first ES 10.5 opt 140325 6553c62369ab3606efc74295c902181f793fd6d1 ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first ES 10.6 dbg 140325 a99e9e4101f5d56a379577e6d81c829b7658df99 ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first ES 10.6 opt 140325 a99e9e4101f5d56a379577e6d81c829b7658df99 No bug found ES 11.4 dbg 140325 26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first ES 11.4 opt 140325 26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first The ES 10.6 opt difference is another occurence of MENT-2277.

Roel Van de Paar added a comment - 2025-04-18 08:40 - edited

An MTR test that triggers the given ASAN

--source include/have_partition.inc

INSTALL SONAME 'ha_rocksdb';

SET @@MAX_STATEMENT_TIME=0.0001;

CREATE TABLE t1 (a INT,b INT,KEY(a)) ENGINE=ROCKSDB PARTITION BY KEY(a) PARTITIONS 2;

CREATE TABLE t2 (c INT);

CHECK TABLE t1;

CHECK TABLE t1;

CHECK TABLE t1;   # Repeat 10k times (in vi use 'yy' on the line then '10000p')

Roel Van de Paar added a comment - 2025-04-18 08:40 - edited An MTR test that triggers the given ASAN --source include/have_partition.inc INSTALL SONAME 'ha_rocksdb' ; SET @@MAX_STATEMENT_TIME=0.0001; CREATE TABLE t1 (a INT ,b INT , KEY (a)) ENGINE=ROCKSDB PARTITION BY KEY (a) PARTITIONS 2; CREATE TABLE t2 (c INT ); CHECK TABLE t1; CHECK TABLE t1; CHECK TABLE t1; # Repeat 10k times ( in vi use 'yy' on the line then '10000p' )

People

Assignee:: Sergei Petrunia

Reporter:: Roel Van de Paar

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2025-04-18 07:43

Updated:: 2025-04-23 14:51

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.

MariaDB Server