[MDEV-36644] Assertion failure or ASAN errors upon concurrent sequence-related operations - Jira

XML

Word

Printable

Details

Type: Bug
Status: Open (View Workflow)
Priority: Major
Resolution: Unresolved
Affects Version/s: 10.6, 10.11, 11.4, 11.8, 10.5(EOL)
Fix Version/s: 10.11, 11.4, 11.8
Component/s: Sequences
Labels:
None

Description

The test case is non-deterministic, run with --repeat=N. It usually fails for me in ~3-5 attempts, but it can vary on different machines and builds.

--source include/have_innodb.inc

CREATE SEQUENCE s1;

CREATE TABLE t (a BIGINT DEFAULT(NEXTVAL(s1))) ENGINE=InnoDB;

INSERT INTO t VALUES (1),(2);

--connect (con1,localhost,root,,)

--send

  ALTER TABLE t FORCE;

--connect (con2,localhost,root,,)

SELECT * FROM t;

--send

  RENAME TABLE s1 TO s2;

--connection default

--error 0,ER_NO_SUCH_TABLE

INSERT INTO t VALUES (3);

--connection con1

--reap

--disconnect con1

--connection con2

--reap

--disconnect con2

--connection default

DROP TABLE t;

DROP SEQUENCE s2;

11.8 f9125dffc624809731e22fd64e4158fb3a76da69 ASAN
==3020812==ERROR: AddressSanitizer: heap-use-after-free on address 0x625000611b08 at pc 0x56163a978afd bp 0x7fe05d3ab910 sp 0x7fe05d3ab908
READ of size 4 at 0x625000611b08 thread T12
#0 0x56163a978afc in my_strcoll_ascii_4bytes_found /data/bld/11.8-asan/strings/ctype-ascii.h:111
#1 0x56163a981735 in my_strnncoll_utf8mb3_general1400_as_ci /data/bld/11.8-asan/strings/strcoll.inl:238
#2 0x561638653f65 in charset_info_st::strnncoll(st_mysql_const_lex_string, st_mysql_const_lex_string, char) const /data/bld/11.8-asan/include/m_ctype.h:1081
#3 0x561638653be1 in charset_info_st::streq(st_mysql_const_lex_string, st_mysql_const_lex_string) const /data/bld/11.8-asan/include/m_ctype.h:1073
#4 0x561638656909 in Lex_ident<Compare_ident_ci>::streq(st_mysql_const_lex_string const&) const /data/bld/11.8-asan/sql/lex_ident.h:119
#5 0x56163878f4fb in is_infoschema_db(st_mysql_const_lex_string const*) /data/bld/11.8-asan/sql/table.h:3586
#6 0x56163876603a in open_and_process_table /data/bld/11.8-asan/sql/sql_base.cc:4020
#7 0x561638769c78 in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /data/bld/11.8-asan/sql/sql_base.cc:4683
#8 0x56163876eac9 in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*) /data/bld/11.8-asan/sql/sql_base.cc:5652
#9 0x561638794fd4 in open_and_lock_tables(THD, TABLE_LIST, bool, unsigned int) /data/bld/11.8-asan/sql/sql_base.h:535
#10 0x5616388549d3 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /data/bld/11.8-asan/sql/sql_insert.cc:784
#11 0x56163892ae70 in mysql_execute_command(THD*, bool) /data/bld/11.8-asan/sql/sql_parse.cc:4484
#12 0x561638942a69 in mysql_parse(THD, char, unsigned int, Parser_state*) /data/bld/11.8-asan/sql/sql_parse.cc:7915
#13 0x5616389198ae in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /data/bld/11.8-asan/sql/sql_parse.cc:1902
#14 0x5616389165b6 in do_command(THD*, bool) /data/bld/11.8-asan/sql/sql_parse.cc:1415
#15 0x561638e13148 in do_handle_one_connection(CONNECT*, bool) /data/bld/11.8-asan/sql/sql_connect.cc:1415
#16 0x561638e12ca7 in handle_one_connection /data/bld/11.8-asan/sql/sql_connect.cc:1327
#17 0x561639ad64a5 in pfs_spawn_thread /data/bld/11.8-asan/storage/perfschema/pfs.cc:2198
#18 0x7fe0742a81c3 in start_thread nptl/pthread_create.c:442
#19 0x7fe07432885b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x625000611b08 is located 4616 bytes inside of 8184-byte region [0x625000610900,0x6250006128f8)
freed by thread T13 here:
#0 0x7fe074eb76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
#1 0x56163a858335 in my_free /data/bld/11.8-asan/mysys/my_malloc.c:221
#2 0x56163a8299eb in root_free /data/bld/11.8-asan/mysys/my_alloc.c:77
#3 0x56163a82c643 in free_root /data/bld/11.8-asan/mysys/my_alloc.c:517
#4 0x561638d27101 in closefrm(TABLE*) /data/bld/11.8-asan/sql/table.cc:4879
#5 0x5616390eeffd in intern_close_table /data/bld/11.8-asan/sql/table_cache.cc:230
#6 0x5616390f73ab in TDC_element::flush_unused(bool) /data/bld/11.8-asan/sql/table_cache.cc:1318
#7 0x5616390f7038 in TDC_element::flush(THD*, bool) /data/bld/11.8-asan/sql/table_cache.cc:1283
#8 0x56163875797f in wait_while_table_is_used(THD, TABLE, ha_extra_function) /data/bld/11.8-asan/sql/sql_base.cc:1435
#9 0x561638c3d551 in mysql_inplace_alter_table /data/bld/11.8-asan/sql/sql_table.cc:8223
#10 0x561638c570b9 in mysql_alter_table(THD, st_mysql_const_lex_string const, st_mysql_const_lex_string const, Table_specification_st, TABLE_LIST, Recreate_info, Alter_info, unsigned int, st_order, bool, bool) /data/bld/11.8-asan/sql/sql_table.cc:11664
#11 0x561638e32421 in Sql_cmd_alter_table::execute(THD*) /data/bld/11.8-asan/sql/sql_alter.cc:701
#12 0x5616389358bf in mysql_execute_command(THD*, bool) /data/bld/11.8-asan/sql/sql_parse.cc:5886
#13 0x561638942a69 in mysql_parse(THD, char, unsigned int, Parser_state*) /data/bld/11.8-asan/sql/sql_parse.cc:7915
#14 0x5616389198ae in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /data/bld/11.8-asan/sql/sql_parse.cc:1902
#15 0x5616389165b6 in do_command(THD*, bool) /data/bld/11.8-asan/sql/sql_parse.cc:1415
#16 0x561638e13148 in do_handle_one_connection(CONNECT*, bool) /data/bld/11.8-asan/sql/sql_connect.cc:1415
#17 0x561638e12ca7 in handle_one_connection /data/bld/11.8-asan/sql/sql_connect.cc:1327
#18 0x561639ad64a5 in pfs_spawn_thread /data/bld/11.8-asan/storage/perfschema/pfs.cc:2198
#19 0x7fe0742a81c3 in start_thread nptl/pthread_create.c:442

previously allocated by thread T12 here:
#0 0x7fe074eb89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x56163a857466 in my_malloc /data/bld/11.8-asan/mysys/my_malloc.c:93
#2 0x56163a829967 in root_alloc /data/bld/11.8-asan/mysys/my_alloc.c:66
#3 0x56163a82a192 in init_alloc_root /data/bld/11.8-asan/mysys/my_alloc.c:178
#4 0x561638d5ea7c in init_sql_alloc(unsigned int, st_mem_root*, unsigned int, unsigned int, unsigned long) /data/bld/11.8-asan/sql/thr_malloc.cc:64
#5 0x561638d22d41 in open_table_from_share(THD, TABLE_SHARE, st_mysql_const_lex_string const, unsigned int, unsigned int, unsigned int, TABLE, bool, List<String>*) /data/bld/11.8-asan/sql/table.cc:4362
#6 0x56163875be1a in open_table(THD, TABLE_LIST, Open_table_context*) /data/bld/11.8-asan/sql/sql_base.cc:2259
#7 0x56163876712a in open_and_process_table /data/bld/11.8-asan/sql/sql_base.cc:4197
#8 0x561638769c78 in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /data/bld/11.8-asan/sql/sql_base.cc:4683
#9 0x56163876eac9 in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*) /data/bld/11.8-asan/sql/sql_base.cc:5652
#10 0x561638794fd4 in open_and_lock_tables(THD, TABLE_LIST, bool, unsigned int) /data/bld/11.8-asan/sql/sql_base.h:535
#11 0x5616388549d3 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /data/bld/11.8-asan/sql/sql_insert.cc:784
#12 0x56163892ae70 in mysql_execute_command(THD*, bool) /data/bld/11.8-asan/sql/sql_parse.cc:4484
#13 0x561638942a69 in mysql_parse(THD, char, unsigned int, Parser_state*) /data/bld/11.8-asan/sql/sql_parse.cc:7915
#14 0x5616389198ae in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /data/bld/11.8-asan/sql/sql_parse.cc:1902
#15 0x5616389165b6 in do_command(THD*, bool) /data/bld/11.8-asan/sql/sql_parse.cc:1415
#16 0x561638e13148 in do_handle_one_connection(CONNECT*, bool) /data/bld/11.8-asan/sql/sql_connect.cc:1415
#17 0x561638e12ca7 in handle_one_connection /data/bld/11.8-asan/sql/sql_connect.cc:1327
#18 0x561639ad64a5 in pfs_spawn_thread /data/bld/11.8-asan/storage/perfschema/pfs.cc:2198
#19 0x7fe0742a81c3 in start_thread nptl/pthread_create.c:442

Thread T12 created by T0 here:
#0 0x7fe074e49726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
#1 0x561639ad2247 in my_thread_create /data/bld/11.8-asan/storage/perfschema/my_thread.h:38
#2 0x561639ad6894 in pfs_spawn_thread_v1 /data/bld/11.8-asan/storage/perfschema/pfs.cc:2249
#3 0x561638525b90 in inline_mysql_thread_create /data/bld/11.8-asan/include/mysql/psi/mysql_thread.h:1139
#4 0x56163853e5f3 in create_thread_to_handle_connection(CONNECT*) /data/bld/11.8-asan/sql/mysqld.cc:6263
#5 0x56163853ec18 in create_new_thread(CONNECT*) /data/bld/11.8-asan/sql/mysqld.cc:6325
#6 0x56163853ef03 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/11.8-asan/sql/mysqld.cc:6387
#7 0x56163853fb8b in handle_connections_sockets() /data/bld/11.8-asan/sql/mysqld.cc:6499
#8 0x56163853c7be in run_main_loop /data/bld/11.8-asan/sql/mysqld.cc:5741
#9 0x56163853dec2 in mysqld_main(int, char**) /data/bld/11.8-asan/sql/mysqld.cc:6164
#10 0x561638524e58 in main /data/bld/11.8-asan/sql/main.cc:34
#11 0x7fe074246249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Thread T13 created by T0 here:
#0 0x7fe074e49726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
#1 0x561639ad2247 in my_thread_create /data/bld/11.8-asan/storage/perfschema/my_thread.h:38
#2 0x561639ad6894 in pfs_spawn_thread_v1 /data/bld/11.8-asan/storage/perfschema/pfs.cc:2249
#3 0x561638525b90 in inline_mysql_thread_create /data/bld/11.8-asan/include/mysql/psi/mysql_thread.h:1139
#4 0x56163853e5f3 in create_thread_to_handle_connection(CONNECT*) /data/bld/11.8-asan/sql/mysqld.cc:6263
#5 0x56163853ec18 in create_new_thread(CONNECT*) /data/bld/11.8-asan/sql/mysqld.cc:6325
#6 0x56163853ef03 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/11.8-asan/sql/mysqld.cc:6387
#7 0x56163853fb8b in handle_connections_sockets() /data/bld/11.8-asan/sql/mysqld.cc:6499
#8 0x56163853c7be in run_main_loop /data/bld/11.8-asan/sql/mysqld.cc:5741
#9 0x56163853dec2 in mysqld_main(int, char**) /data/bld/11.8-asan/sql/mysqld.cc:6164
#10 0x561638524e58 in main /data/bld/11.8-asan/sql/main.cc:34
#11 0x7fe074246249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free /data/bld/11.8-asan/strings/ctype-ascii.h:111 in my_strcoll_ascii_4bytes_found
Shadow bytes around the buggy address:
0x0c4a800ba310: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800ba320: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800ba330: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800ba340: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800ba350: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c4a800ba360: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800ba370: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800ba380: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800ba390: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800ba3a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800ba3b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==3020812==ABORTING
250418 21:29:32 [ERROR] /share8t/bld/11.8-asan/sql/mariadbd got signal 6 ;
Sorry, we probably made a mistake, and this is a bug.

Your assistance in bug reporting will enable us to fix this for the next release.
To report this bug, see https://mariadb.com/kb/en/reporting-bugs about how to report
a bug on https://jira.mariadb.org/.

Please include the information from the server start above, to the end of the
information below.

Server version: 11.8.1-MariaDB-debug-log source revision: f9125dffc624809731e22fd64e4158fb3a76da69

The information page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mariadbd/
contains instructions to obtain a better version of the backtrace below.
Following these instructions will help MariaDB developers provide a fix quicker.

Attempting backtrace. Include this in the bug report.
(note: Retrieving this information may fail)

Thread pointer: 0x62c000230218
stack_bottom = 0x7fe05d3b0000 thread_stack 0xb00000
sanitizer_common/sanitizer_common_interceptors.inc:4277(__interceptor_backtrace.part.0)[0x7fe074e51f31]
mysys/stacktrace.c:215(my_print_stacktrace)[0x56163a8683f1]
sql/signal_handler.cc:230(handle_fatal_signal)[0x5616392b7fca]
libc_sigaction.c:0(__restore_rt)[0x7fe07425b050]
nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x7fe0742a9ebc]
posix/raise.c:27(__GI_raise)[0x7fe07425afb2]
stdlib/abort.c:81(__GI_abort)[0x7fe074245472]
sanitizer_common/sanitizer_posix_libcdep.cpp:137(__sanitizer::Abort())[0x7fe074ed650f]
sanitizer_common/sanitizer_termination.cpp:59(__sanitizer::Die())[0x7fe074ee2ba1]
asan/asan_report.cpp:190(__asan::ScopedInErrorReport::~ScopedInErrorReport())[0x7fe074ec1f5e]
asan/asan_report.cpp:479(__asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool))[0x7fe074ec14c6]
asan/asan_rtl.cpp:122(__asan_report_load4)[0x7fe074ec251c]
strings/ctype-ascii.h:111(my_strcoll_ascii_4bytes_found)[0x56163a978afd]
strings/strcoll.inl:238(my_strnncoll_utf8mb3_general1400_as_ci)[0x56163a981736]
include/m_ctype.h:1083(charset_info_st::strnncoll(st_mysql_const_lex_string, st_mysql_const_lex_string, char) const)[0x561638653f66]
include/m_ctype.h:1073(charset_info_st::streq(st_mysql_const_lex_string, st_mysql_const_lex_string) const)[0x561638653be2]
sql/lex_ident.h:119(Lex_ident<Compare_ident_ci>::streq(st_mysql_const_lex_string const&) const)[0x56163865690a]
sql/table.h:3587(is_infoschema_db(st_mysql_const_lex_string const*))[0x56163878f4fc]
sql/sql_base.cc:4020(open_and_process_table(THD, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy, bool, Open_table_context*))[0x56163876603b]
sql/sql_base.cc:4683(open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*))[0x561638769c79]
sql/sql_base.cc:5652(open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*))[0x56163876eaca]
sql/sql_base.h:535(open_and_lock_tables(THD, TABLE_LIST, bool, unsigned int))[0x561638794fd5]
sql/sql_insert.cc:784(mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*))[0x5616388549d4]
sql/sql_parse.cc:4484(mysql_execute_command(THD*, bool))[0x56163892ae71]
sql/sql_parse.cc:7915(mysql_parse(THD, char, unsigned int, Parser_state*))[0x561638942a6a]
sql/sql_parse.cc:1904(dispatch_command(enum_server_command, THD, char, unsigned int, bool))[0x5616389198af]
sql/sql_parse.cc:1415(do_command(THD*, bool))[0x5616389165b7]
sql/sql_connect.cc:1415(do_handle_one_connection(CONNECT*, bool))[0x561638e13149]
sql/sql_connect.cc:1329(handle_one_connection)[0x561638e12ca8]
perfschema/pfs.cc:2200(pfs_spawn_thread)[0x561639ad64a6]
nptl/pthread_create.c:442(start_thread)[0x7fe0742a81c4]
x86_64/clone3.S:83(clone3)[0x7fe07432885c]

Connection ID (thread ID): 10
Status: NOT_KILLED
Query (0x62d0005fa438): INSERT INTO t VALUES (3)

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off,hash_join_cardinality=on,cset_narrowing=on,sargable_casefold=on

Writing a core file...
Working directory at /dev/shm/var_auto_6ttw/mysqld.1/data
Resource Limits (excludes unlimited resources):
Limit Soft Limit Hard Limit Units
Max stack size 8388608 unlimited bytes
Max processes 514196 514196 processes
Max open files 65536 65536 files
Max locked memory 16854077440 16854077440 bytes
Max pending signals 514196 514196 signals
Max msgqueue size 819200 819200 bytes
Max nice priority 0 0
Max realtime priority 0 0
Core pattern: core

Kernel version: Linux version 6.1.0-27-amd64 (debian-kernel@lists.debian.org) (gcc-12 (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #1 SMP PREEMPT_DYNAMIC Debian 6.1.115-1 (2024-11-01)

11.8 f9125dffc624809731e22fd64e4158fb3a76da69 non-ASAN debug
mariadbd: /data/bld/11.8-debug/sql/sql_base.cc:206: uint get_table_def_key(const TABLE_LIST, const char*): Assertion `!strcmp(table_list->get_db_name().str, table_list->mdl_request.key.db_name())' failed.
250418 21:32:44 [ERROR] /share8t/bld/11.8-debug/sql/mariadbd got signal 6 ;

#9 0x00007fa8c0c53eb2 in __GI___assert_fail (assertion=0x55664b05ebf0 "!strcmp(table_list->get_db_name().str, table_list->mdl_request.key.db_name())", file=0x55664b05ec40 "/data/bld/11.8-debug/sql/sql_base.cc", line=206, function=0x55664b05ec68 "uint get_table_def_key(const TABLE_LIST, const char*)") at ./assert/assert.c:101
#10 0x000055664a03eaf9 in get_table_def_key (table_list=0x7fa87c018218, key=0x7fa8b40bd278) at /data/bld/11.8-debug/sql/sql_base.cc:206
#11 0x000055664a042c60 in open_table (thd=0x7fa87c000dc8, table_list=0x7fa87c018218, ot_ctx=0x7fa8b40bd640) at /data/bld/11.8-debug/sql/sql_base.cc:1968
#12 0x000055664a04813b in open_and_process_table (thd=0x7fa87c000dc8, tables=0x7fa87c018218, counter=0x7fa8b40bd6d4, flags=0, prelocking_strategy=0x7fa8b40bd758, has_prelocking_list=false, ot_ctx=0x7fa8b40bd640) at /data/bld/11.8-debug/sql/sql_base.cc:4197
#13 0x000055664a04945c in open_tables (thd=0x7fa87c000dc8, options=..., start=0x7fa8b40bd6b8, counter=0x7fa8b40bd6d4, flags=0, prelocking_strategy=0x7fa8b40bd758) at /data/bld/11.8-debug/sql/sql_base.cc:4683
#14 0x000055664a04b409 in open_and_lock_tables (thd=0x7fa87c000dc8, options=..., tables=0x7fa87c016ae0, derived=true, flags=0, prelocking_strategy=0x7fa8b40bd758) at /data/bld/11.8-debug/sql/sql_base.cc:5652
#15 0x000055664a05b341 in open_and_lock_tables (thd=0x7fa87c000dc8, tables=0x7fa87c016ae0, derived=true, flags=0) at /data/bld/11.8-debug/sql/sql_base.h:535
#16 0x000055664a0ae121 in mysql_insert (thd=0x7fa87c000dc8, table_list=0x7fa87c016ae0, fields=..., values_list=..., update_fields=..., update_values=..., duplic=DUP_ERROR, ignore=false, result=0x0) at /data/bld/11.8-debug/sql/sql_insert.cc:784
#17 0x000055664a109ec9 in mysql_execute_command (thd=0x7fa87c000dc8, is_called_from_prepared_stmt=false) at /data/bld/11.8-debug/sql/sql_parse.cc:4484
#18 0x000055664a1157c6 in mysql_parse (thd=0x7fa87c000dc8, rawbuf=0x7fa87c016a00 "INSERT INTO t VALUES (3)", length=24, parser_state=0x7fa8b40be2e0) at /data/bld/11.8-debug/sql/sql_parse.cc:7915
#19 0x000055664a1019dc in dispatch_command (command=COM_QUERY, thd=0x7fa87c000dc8, packet=0x7fa87c00be89 "INSERT INTO t VALUES (3)", packet_length=24, blocking=true) at /data/bld/11.8-debug/sql/sql_parse.cc:1902
#20 0x000055664a100335 in do_command (thd=0x7fa87c000dc8, blocking=true) at /data/bld/11.8-debug/sql/sql_parse.cc:1415
#21 0x000055664a30e713 in do_handle_one_connection (connect=0x55665fa31ac8, put_in_cache=true) at /data/bld/11.8-debug/sql/sql_connect.cc:1415
#22 0x000055664a30e494 in handle_one_connection (arg=0x55665fa30b88) at /data/bld/11.8-debug/sql/sql_connect.cc:1327
#23 0x000055664a894a9e in pfs_spawn_thread (arg=0x55665fa30c68) at /data/bld/11.8-debug/storage/perfschema/pfs.cc:2198
#24 0x00007fa8c0ca81c4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#25 0x00007fa8c0d2885c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

10.11 07b442aa688835610e1a3174154dc53cf273744a
==3022158==ERROR: AddressSanitizer: heap-use-after-free on address 0x62500060f2a0 at pc 0x7f23cdaa8596 bp 0x7f23bb784d30 sp 0x7f23bb7844e0
READ of size 5 at 0x62500060f2a0 thread T12
#0 0x7f23cdaa8595 in __interceptor_strcmp ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:466
#1 0x5579c734a08b in get_table_def_key(TABLE_LIST const, char const*) /data/bld/10.11-asan/sql/sql_base.cc:203
#2 0x5579c73532cd in open_table(THD, TABLE_LIST, Open_table_context*) /data/bld/10.11-asan/sql/sql_base.cc:1942
#3 0x5579c73603d0 in open_and_process_table /data/bld/10.11-asan/sql/sql_base.cc:4166
#4 0x5579c7362f27 in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /data/bld/10.11-asan/sql/sql_base.cc:4654
#5 0x5579c7367e67 in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*) /data/bld/10.11-asan/sql/sql_base.cc:5628
#6 0x5579c72bcfc9 in open_and_lock_tables(THD, TABLE_LIST, bool, unsigned int) /data/bld/10.11-asan/sql/sql_base.h:517
#7 0x5579c7446384 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /data/bld/10.11-asan/sql/sql_insert.cc:774
#8 0x5579c7515e98 in mysql_execute_command(THD*, bool) /data/bld/10.11-asan/sql/sql_parse.cc:4632
#9 0x5579c752e799 in mysql_parse(THD, char, unsigned int, Parser_state*) /data/bld/10.11-asan/sql/sql_parse.cc:8188
#10 0x5579c7503dd1 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /data/bld/10.11-asan/sql/sql_parse.cc:1905
#11 0x5579c7500afe in do_command(THD*, bool) /data/bld/10.11-asan/sql/sql_parse.cc:1418
#12 0x5579c79cc720 in do_handle_one_connection(CONNECT*, bool) /data/bld/10.11-asan/sql/sql_connect.cc:1386
#13 0x5579c79cc27f in handle_one_connection /data/bld/10.11-asan/sql/sql_connect.cc:1298
#14 0x5579c85fe733 in pfs_spawn_thread /data/bld/10.11-asan/storage/perfschema/pfs.cc:2201
#15 0x7f23ccea81c3 in start_thread nptl/pthread_create.c:442
#16 0x7f23ccf2885b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x62500060f2a0 is located 4512 bytes inside of 8184-byte region [0x62500060e100,0x6250006100f8)
freed by thread T13 here:
#0 0x7f23cdab76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
#1 0x5579c93ab827 in my_free /data/bld/10.11-asan/mysys/my_malloc.c:220
#2 0x5579c937df25 in root_free /data/bld/10.11-asan/mysys/my_alloc.c:77
#3 0x5579c9380990 in free_root /data/bld/10.11-asan/mysys/my_alloc.c:517
#4 0x5579c78e925c in closefrm(TABLE*) /data/bld/10.11-asan/sql/table.cc:4710
#5 0x5579c7c52f41 in intern_close_table /data/bld/10.11-asan/sql/table_cache.cc:230
#6 0x5579c7c5b2f3 in TDC_element::flush_unused(bool) /data/bld/10.11-asan/sql/table_cache.cc:1318
#7 0x5579c7c5af80 in TDC_element::flush(THD*, bool) /data/bld/10.11-asan/sql/table_cache.cc:1283
#8 0x5579c7350d53 in wait_while_table_is_used(THD, TABLE, ha_extra_function) /data/bld/10.11-asan/sql/sql_base.cc:1410
#9 0x5579c780713d in mysql_inplace_alter_table /data/bld/10.11-asan/sql/sql_table.cc:8079
#10 0x5579c782056b in mysql_alter_table(THD, st_mysql_const_lex_string const, st_mysql_const_lex_string const, Table_specification_st, TABLE_LIST, Recreate_info, Alter_info, unsigned int, st_order, bool, bool) /data/bld/10.11-asan/sql/sql_table.cc:11348
#11 0x5579c79eb839 in Sql_cmd_alter_table::execute(THD*) /data/bld/10.11-asan/sql/sql_alter.cc:688
#12 0x5579c75219a4 in mysql_execute_command(THD*, bool) /data/bld/10.11-asan/sql/sql_parse.cc:6167
#13 0x5579c752e799 in mysql_parse(THD, char, unsigned int, Parser_state*) /data/bld/10.11-asan/sql/sql_parse.cc:8188
#14 0x5579c7503dd1 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /data/bld/10.11-asan/sql/sql_parse.cc:1905
#15 0x5579c7500afe in do_command(THD*, bool) /data/bld/10.11-asan/sql/sql_parse.cc:1418
#16 0x5579c79cc720 in do_handle_one_connection(CONNECT*, bool) /data/bld/10.11-asan/sql/sql_connect.cc:1386
#17 0x5579c79cc27f in handle_one_connection /data/bld/10.11-asan/sql/sql_connect.cc:1298
#18 0x5579c85fe733 in pfs_spawn_thread /data/bld/10.11-asan/storage/perfschema/pfs.cc:2201
#19 0x7f23ccea81c3 in start_thread nptl/pthread_create.c:442

previously allocated by thread T12 here:
#0 0x7f23cdab89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x5579c93aa958 in my_malloc /data/bld/10.11-asan/mysys/my_malloc.c:92
#2 0x5579c937dea1 in root_alloc /data/bld/10.11-asan/mysys/my_alloc.c:66
#3 0x5579c937e6cc in init_alloc_root /data/bld/10.11-asan/mysys/my_alloc.c:178
#4 0x5579c791fbd6 in init_sql_alloc(unsigned int, st_mem_root*, unsigned int, unsigned int, unsigned long) /data/bld/10.11-asan/sql/thr_malloc.cc:64
#5 0x5579c78e4f35 in open_table_from_share(THD, TABLE_SHARE, st_mysql_const_lex_string const, unsigned int, unsigned int, unsigned int, TABLE, bool, List<String>*) /data/bld/10.11-asan/sql/table.cc:4196
#6 0x5579c7355207 in open_table(THD, TABLE_LIST, Open_table_context*) /data/bld/10.11-asan/sql/sql_base.cc:2233
#7 0x5579c73603d0 in open_and_process_table /data/bld/10.11-asan/sql/sql_base.cc:4166
#8 0x5579c7362f27 in open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*) /data/bld/10.11-asan/sql/sql_base.cc:4654
#9 0x5579c7367e67 in open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*) /data/bld/10.11-asan/sql/sql_base.cc:5628
#10 0x5579c72bcfc9 in open_and_lock_tables(THD, TABLE_LIST, bool, unsigned int) /data/bld/10.11-asan/sql/sql_base.h:517
#11 0x5579c7446384 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /data/bld/10.11-asan/sql/sql_insert.cc:774
#12 0x5579c7515e98 in mysql_execute_command(THD*, bool) /data/bld/10.11-asan/sql/sql_parse.cc:4632
#13 0x5579c752e799 in mysql_parse(THD, char, unsigned int, Parser_state*) /data/bld/10.11-asan/sql/sql_parse.cc:8188
#14 0x5579c7503dd1 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /data/bld/10.11-asan/sql/sql_parse.cc:1905
#15 0x5579c7500afe in do_command(THD*, bool) /data/bld/10.11-asan/sql/sql_parse.cc:1418
#16 0x5579c79cc720 in do_handle_one_connection(CONNECT*, bool) /data/bld/10.11-asan/sql/sql_connect.cc:1386
#17 0x5579c79cc27f in handle_one_connection /data/bld/10.11-asan/sql/sql_connect.cc:1298
#18 0x5579c85fe733 in pfs_spawn_thread /data/bld/10.11-asan/storage/perfschema/pfs.cc:2201
#19 0x7f23ccea81c3 in start_thread nptl/pthread_create.c:442

Thread T12 created by T0 here:
#0 0x7f23cda49726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
#1 0x5579c85fa46e in my_thread_create /data/bld/10.11-asan/storage/perfschema/my_thread.h:52
#2 0x5579c85feb22 in pfs_spawn_thread_v1 /data/bld/10.11-asan/storage/perfschema/pfs.cc:2252
#3 0x5579c71267e0 in inline_mysql_thread_create /data/bld/10.11-asan/include/mysql/psi/mysql_thread.h:1139
#4 0x5579c713e24c in create_thread_to_handle_connection(CONNECT*) /data/bld/10.11-asan/sql/mysqld.cc:6139
#5 0x5579c713e85d in create_new_thread(CONNECT*) /data/bld/10.11-asan/sql/mysqld.cc:6198
#6 0x5579c713eb48 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/10.11-asan/sql/mysqld.cc:6260
#7 0x5579c713f7d0 in handle_connections_sockets() /data/bld/10.11-asan/sql/mysqld.cc:6383
#8 0x5579c713c59d in run_main_loop /data/bld/10.11-asan/sql/mysqld.cc:5639
#9 0x5579c713db1b in mysqld_main(int, char**) /data/bld/10.11-asan/sql/mysqld.cc:6040
#10 0x5579c7125aa8 in main /data/bld/10.11-asan/sql/main.cc:34
#11 0x7f23cce46249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Thread T13 created by T0 here:
#0 0x7f23cda49726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
#1 0x5579c85fa46e in my_thread_create /data/bld/10.11-asan/storage/perfschema/my_thread.h:52
#2 0x5579c85feb22 in pfs_spawn_thread_v1 /data/bld/10.11-asan/storage/perfschema/pfs.cc:2252
#3 0x5579c71267e0 in inline_mysql_thread_create /data/bld/10.11-asan/include/mysql/psi/mysql_thread.h:1139
#4 0x5579c713e24c in create_thread_to_handle_connection(CONNECT*) /data/bld/10.11-asan/sql/mysqld.cc:6139
#5 0x5579c713e85d in create_new_thread(CONNECT*) /data/bld/10.11-asan/sql/mysqld.cc:6198
#6 0x5579c713eb48 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/10.11-asan/sql/mysqld.cc:6260
#7 0x5579c713f7d0 in handle_connections_sockets() /data/bld/10.11-asan/sql/mysqld.cc:6383
#8 0x5579c713c59d in run_main_loop /data/bld/10.11-asan/sql/mysqld.cc:5639
#9 0x5579c713db1b in mysqld_main(int, char**) /data/bld/10.11-asan/sql/mysqld.cc:6040
#10 0x5579c7125aa8 in main /data/bld/10.11-asan/sql/main.cc:34
#11 0x7f23cce46249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:466 in __interceptor_strcmp
Shadow bytes around the buggy address:
0x0c4a800b9e00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800b9e10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800b9e20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800b9e30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800b9e40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c4a800b9e50: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800b9e60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800b9e70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800b9e80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800b9e90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c4a800b9ea0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==3022158==ABORTING
250418 21:33:51 [ERROR] /share8t/bld/10.11-asan/sql/mariadbd got signal 6 ;
Sorry, we probably made a mistake, and this is a bug.

Your assistance in bug reporting will enable us to fix this for the next release.
To report this bug, see https://mariadb.com/kb/en/reporting-bugs about how to report
a bug on https://jira.mariadb.org/.

Please include the information from the server start above, to the end of the
information below.

Server version: 10.11.12-MariaDB-debug-log source revision: 07b442aa688835610e1a3174154dc53cf273744a

The information page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mariadbd/
contains instructions to obtain a better version of the backtrace below.
Following these instructions will help MariaDB developers provide a fix quicker.

Attempting backtrace. Include this in the bug report.
(note: Retrieving this information may fail)

Thread pointer: 0x62c000230218
stack_bottom = 0x7f23bb789000 thread_stack 0xb00000
sanitizer_common/sanitizer_common_interceptors.inc:4277(__interceptor_backtrace.part.0)[0x7f23cda51f31]
mysys/stacktrace.c:215(my_print_stacktrace)[0x5579c93bb965]
sql/signal_handler.cc:230(handle_fatal_signal)[0x5579c7e0b2e2]
libc_sigaction.c:0(__restore_rt)[0x7f23cce5b050]
nptl/pthread_kill.c:44(__pthread_kill_implementation)[0x7f23ccea9ebc]
posix/raise.c:27(__GI_raise)[0x7f23cce5afb2]
stdlib/abort.c:81(__GI_abort)[0x7f23cce45472]
sanitizer_common/sanitizer_posix_libcdep.cpp:137(__sanitizer::Abort())[0x7f23cdad650f]
sanitizer_common/sanitizer_termination.cpp:59(__sanitizer::Die())[0x7f23cdae2ba1]
asan/asan_report.cpp:190(__asan::ScopedInErrorReport::~ScopedInErrorReport())[0x7f23cdac1f5e]
asan/asan_report.cpp:479(__asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool))[0x7f23cdac14c6]
sanitizer_common/sanitizer_common_interceptors.inc:466(__interceptor_strcmp.part.0)[0x7f23cdaa85bd]
sql/sql_base.cc:203(get_table_def_key(TABLE_LIST const, char const*))[0x5579c734a08c]
sql/sql_base.cc:1942(open_table(THD, TABLE_LIST, Open_table_context*))[0x5579c73532ce]
sql/sql_base.cc:4166(open_and_process_table(THD, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy, bool, Open_table_context*))[0x5579c73603d1]
sql/sql_base.cc:4654(open_tables(THD, DDL_options_st const&, TABLE_LIST, unsigned int, unsigned int, Prelocking_strategy*))[0x5579c7362f28]
sql/sql_base.cc:5628(open_and_lock_tables(THD, DDL_options_st const&, TABLE_LIST, bool, unsigned int, Prelocking_strategy*))[0x5579c7367e68]
sql/sql_base.h:517(open_and_lock_tables(THD, TABLE_LIST, bool, unsigned int))[0x5579c72bcfca]
sql/sql_insert.cc:774(mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*))[0x5579c7446385]
sql/sql_parse.cc:4632(mysql_execute_command(THD*, bool))[0x5579c7515e99]
sql/sql_parse.cc:8188(mysql_parse(THD, char, unsigned int, Parser_state*))[0x5579c752e79a]
sql/sql_parse.cc:1907(dispatch_command(enum_server_command, THD, char, unsigned int, bool))[0x5579c7503dd2]
sql/sql_parse.cc:1418(do_command(THD*, bool))[0x5579c7500aff]
sql/sql_connect.cc:1386(do_handle_one_connection(CONNECT*, bool))[0x5579c79cc721]
sql/sql_connect.cc:1300(handle_one_connection)[0x5579c79cc280]
perfschema/pfs.cc:2203(pfs_spawn_thread)[0x5579c85fe734]
nptl/pthread_create.c:442(start_thread)[0x7f23ccea81c4]
x86_64/clone3.S:83(clone3)[0x7f23ccf2885c]

Connection ID (thread ID): 10
Status: NOT_KILLED
Query (0x62d0002bc438): INSERT INTO t VALUES (3)

Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,engine_condition_pushdown=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off,hash_join_cardinality=off,cset_narrowing=off

Writing a core file...
Working directory at /dev/shm/var_auto_uHRP/mysqld.1/data
Resource Limits (excludes unlimited resources):
Limit Soft Limit Hard Limit Units
Max stack size 8388608 unlimited bytes
Max processes 514196 514196 processes
Max open files 1024 1024 files
Max locked memory 16854077440 16854077440 bytes
Max pending signals 514196 514196 signals
Max msgqueue size 819200 819200 bytes
Max nice priority 0 0
Max realtime priority 0 0
Core pattern: core

Kernel version: Linux version 6.1.0-27-amd64 (debian-kernel@lists.debian.org) (gcc-12 (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40) #1 SMP PREEMPT_DYNAMIC Debian 6.1.115-1 (2024-11-01)

Attachments

Activity

People

Assignee:: Oleksandr Byelkin

Reporter:: Elena Stepanova

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2025-04-18 18:35

Updated:: 2025-04-18 18:35

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.