Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
11.7.1, 11.8, 12.0(EOL)
-
None
Description
The test case comes without a cleanup, as it's Spider; if it remains Spider-specific after the analysis, it will have to be rewritten anyway, with init/deinit etc.
INSTALL SONAME 'ha_spider'; |
SET spider_same_server_link= ON; |
--eval create server s foreign data wrapper mysql options (host "127.0.0.1", database "test", user "root", port $MASTER_MYPORT);
|
|
|
--echo # Creating DBT3 data...
|
--disable_query_log
|
--source include/dbt3_s001.inc
|
--enable_query_log
|
|
|
CREATE TABLE spider_lineitem LIKE lineitem; |
ALTER TABLE spider_lineitem ENGINE=Spider WRAPPER=mysql REMOTE_TABLE=lineitem REMOTE_SERVER=s; |
ANALYZE TABLE spider_lineitem PERSISTENT FOR ALL; |
|
11.8 9d3af2c8e31ad0fd8ccc240e0b1e25914b2eacbf |
==1091415==ERROR: AddressSanitizer: use-after-poison on address 0x62d0012b8618 at pc 0x55a3aa5894d2 bp 0x7f9f566b4490 sp 0x7f9f566b4488
|
READ of size 8 at 0x62d0012b8618 thread T5
|
#0 0x55a3aa5894d1 in Query_arena::free_items() /data/bld/11.8-asan-ubsan/sql/sql_class.cc:4108
|
#1 0x55a3aa5982b0 in THD::cleanup_after_query() /data/bld/11.8-asan-ubsan/sql/sql_class.cc:2469
|
#2 0x55a3aa8858c7 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/11.8-asan-ubsan/sql/sql_parse.cc:7930
|
#3 0x55a3aa88e39e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/11.8-asan-ubsan/sql/sql_parse.cc:1902
|
#4 0x55a3aa89b2ac in do_command(THD*, bool) /data/bld/11.8-asan-ubsan/sql/sql_parse.cc:1415
|
#5 0x55a3ab0dd363 in do_handle_one_connection(CONNECT*, bool) /data/bld/11.8-asan-ubsan/sql/sql_connect.cc:1415
|
#6 0x55a3ab0de4cc in handle_one_connection /data/bld/11.8-asan-ubsan/sql/sql_connect.cc:1327
|
#7 0x55a3acb7114b in pfs_spawn_thread /data/bld/11.8-asan-ubsan/storage/perfschema/pfs.cc:2198
|
#8 0x7f9f630a81c3 in start_thread nptl/pthread_create.c:442
|
#9 0x7f9f6312885b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
|
|
|
0x62d0012b8618 is located 8728 bytes inside of 32760-byte region [0x62d0012b6400,0x62d0012be3f8)
|
allocated by thread T5 here:
|
#0 0x7f9f638b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
|
#1 0x55a3adde091d in my_malloc /data/bld/11.8-asan-ubsan/mysys/my_malloc.c:93
|
#2 0x55a3addb3b4e in root_alloc /data/bld/11.8-asan-ubsan/mysys/my_alloc.c:66
|
#3 0x55a3addb514c in alloc_root /data/bld/11.8-asan-ubsan/mysys/my_alloc.c:336
|
#4 0x55a3aad243d0 in Index_prefix_calc::Prefix_calc_state* Query_arena::alloc<Index_prefix_calc::Prefix_calc_state>(unsigned long) const /data/bld/11.8-asan-ubsan/sql/sql_class.h:1287
|
#5 0x55a3aad243d0 in Index_prefix_calc::Index_prefix_calc(THD*, TABLE*, st_key*) /data/bld/11.8-asan-ubsan/sql/sql_statistics.cc:1990
|
#6 0x55a3aad02d8f in collect_statistics_for_index /data/bld/11.8-asan-ubsan/sql/sql_statistics.cc:2659
|
#7 0x55a3aad0513b in collect_statistics_for_table(THD*, TABLE*) /data/bld/11.8-asan-ubsan/sql/sql_statistics.cc:2862
|
#8 0x55a3ab14aebc in mysql_admin_table /data/bld/11.8-asan-ubsan/sql/sql_admin.cc:1093
|
#9 0x55a3ab1533ac in Sql_cmd_analyze_table::execute(THD*) /data/bld/11.8-asan-ubsan/sql/sql_admin.cc:1620
|
#10 0x55a3aa880634 in mysql_execute_command(THD*, bool) /data/bld/11.8-asan-ubsan/sql/sql_parse.cc:5886
|
#11 0x55a3aa885088 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/bld/11.8-asan-ubsan/sql/sql_parse.cc:7906
|
#12 0x55a3aa88e39e in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/bld/11.8-asan-ubsan/sql/sql_parse.cc:1902
|
#13 0x55a3aa89b2ac in do_command(THD*, bool) /data/bld/11.8-asan-ubsan/sql/sql_parse.cc:1415
|
#14 0x55a3ab0dd363 in do_handle_one_connection(CONNECT*, bool) /data/bld/11.8-asan-ubsan/sql/sql_connect.cc:1415
|
#15 0x55a3ab0de4cc in handle_one_connection /data/bld/11.8-asan-ubsan/sql/sql_connect.cc:1327
|
#16 0x55a3acb7114b in pfs_spawn_thread /data/bld/11.8-asan-ubsan/storage/perfschema/pfs.cc:2198
|
#17 0x7f9f630a81c3 in start_thread nptl/pthread_create.c:442
|
|
|
Thread T5 created by T0 here:
|
#0 0x7f9f63849726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
|
#1 0x55a3acb6d107 in my_thread_create /data/bld/11.8-asan-ubsan/storage/perfschema/my_thread.h:38
|
#2 0x55a3acb715c8 in pfs_spawn_thread_v1 /data/bld/11.8-asan-ubsan/storage/perfschema/pfs.cc:2249
|
#3 0x55a3aa0e19c9 in inline_mysql_thread_create /data/bld/11.8-asan-ubsan/include/mysql/psi/mysql_thread.h:1139
|
#4 0x55a3aa0e19c9 in create_thread_to_handle_connection(CONNECT*) /data/bld/11.8-asan-ubsan/sql/mysqld.cc:6264
|
#5 0x55a3aa0f4487 in create_new_thread(CONNECT*) /data/bld/11.8-asan-ubsan/sql/mysqld.cc:6326
|
#6 0x55a3aa0f46af in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/bld/11.8-asan-ubsan/sql/mysqld.cc:6388
|
#7 0x55a3aa0f52f0 in handle_connections_sockets() /data/bld/11.8-asan-ubsan/sql/mysqld.cc:6500
|
#8 0x55a3aa0f579c in run_main_loop /data/bld/11.8-asan-ubsan/sql/mysqld.cc:5742
|
#9 0x55a3aa0f6d50 in mysqld_main(int, char**) /data/bld/11.8-asan-ubsan/sql/mysqld.cc:6165
|
#10 0x55a3aa0c7d11 in main /data/bld/11.8-asan-ubsan/sql/main.cc:34
|
#11 0x7f9f63046249 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
|
|
SUMMARY: AddressSanitizer: use-after-poison /data/bld/11.8-asan-ubsan/sql/sql_class.cc:4108 in Query_arena::free_items()
|
Shadow bytes around the buggy address:
|
0x0c5a8024f070: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
0x0c5a8024f080: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
0x0c5a8024f090: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
0x0c5a8024f0a0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
0x0c5a8024f0b0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
=>0x0c5a8024f0c0: f7 f7 f7[f7]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
0x0c5a8024f0d0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
0x0c5a8024f0e0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
0x0c5a8024f0f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
0x0c5a8024f100: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
0x0c5a8024f110: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
Addressable: 00
|
Partially addressable: 01 02 03 04 05 06 07
|
Heap left redzone: fa
|
Freed heap region: fd
|
Stack left redzone: f1
|
Stack mid redzone: f2
|
Stack right redzone: f3
|
Stack after return: f5
|
Stack use after scope: f8
|
Global redzone: f9
|
Global init order: f6
|
Poisoned by user: f7
|
Container overflow: fc
|
Array cookie: ac
|
Intra object redzone: bb
|
ASan internal: fe
|
Left alloca redzone: ca
|
Right alloca redzone: cb
|
==1091415==ABORTING
|
The failure started happening after this commit in 11.7.1:
commit 9f2adffccae1e155647e48f65aa7932fc833f723
|
Author: Sergei Golubchik
|
Date: Thu Sep 26 11:52:05 2024 +0200
|
|
|
memroot improvement: fix savepoint support
|