[MDEV-38569] Memory and table corruption on CREATE TABLE - Jira

XML

Word

Printable

Details

Type: Bug
Status: Open (View Workflow)
Priority: Critical
Resolution: Unresolved
Affects Version/s: 10.6, 10.11, 11.4, 11.8, 12.2, 12.3
Fix Version/s: 10.6, 10.11, 11.4, 11.8, 12.2
Component/s: Character Sets, Data Definition - Create Table
Labels:
- ASAN
- use-after-poison

Bug Category:
Can result in data loss

Description

SET collation_connection=ucs2_general_ci;

CREATE TEMPORARY TABLE t2 (c1 DOUBLE PRIMARY KEY,c2 ENUM('aaaaaaaaaaaaaaaaaaaaaaaaaaaa','bbbbbbbbbbbbbbbbbbbbbbbbbbbbb','cccccccccccccccccccccccccccc') CHARACTER SET 'Binary' COLLATE 'Binary',c3 SET('aaaaaaaaaaaaaaaaaaaaaaaaaaaa','bbbbbbbbbbbbbbbbbbbbbbbbbbbbb','cccccccccccccccccccccccccccc'));

Leads to:

CS 12.2.0 fd15fd2765b53d0c070dd01d86fb231024b8f284 (Debug, Clang 21.1.3-20250923) Build 10/11/2025
12.2.0-dbg>SET collation_connection=ucs2_general_ci;
Query OK, 0 rows affected (0.001 sec)

12.2.0-dbg>CREATE TEMPORARY TABLE t2 (c1 DOUBLE PRIMARY KEY,c2 ENUM('aaaaaaaaaaaaaaaaaaaaaaaaaaaa','bbbbbbbbbbbbbbbbbbbbbbbbbbbbb','cccccccccccccccccccccccccccc') CHARACTER SET 'Binary' COLLATE 'Binary',c3 SET('aaaaaaaaaaaaaaaaaaaaaaaaaaaa','bbbbbbbbbbbbbbbbbbbbbbbbbbbbb','cccccccccccccccccccccccccccc'));
ERROR 1033 (HY000): Incorrect information in file: '/test/MD101125-mariadb-12.2.0-linux-x86_64-dbg/tmp/#sql-temptable-1b5ae-4-0.frm'

And:

CS 12.2.0 fd15fd2765b53d0c070dd01d86fb231024b8f284 (Debug, UBASAN, Clang 21.1.3-20250923) Build 10/11/2025
==115704==ERROR: AddressSanitizer: use-after-poison on address 0x749e53cefb90 at pc 0x5c011583c0ac bp 0x724d804ff940 sp 0x724d804ff938
WRITE of size 8 at 0x749e53cefb90 thread T11
#0 0x5c011583c0ab in fix_type_pointers(char const*, unsigned int, st_typelib, unsigned int, char, unsigned long) /test/12.2_dbg_san/sql/table.cc:5064:36
#1 0x5c0115819b3b in TABLE_SHARE::init_from_binary_frm_image(THD, bool, unsigned char const, unsigned long, unsigned char const*, unsigned long) /test/12.2_dbg_san/sql/table.cc:2372:7
#2 0x5c011428353f in ha_create_table(THD, char const, char const, char const, HA_CREATE_INFO, st_mysql_const_unsigned_lex_string, bool) /test/12.2_dbg_san/sql/handler.cc:6481:15
#3 0x5c01156c0830 in create_table_impl(THD, st_ddl_log_state, st_ddl_log_state, Lex_ident_db const&, Lex_ident_table const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, DDL_options_st, HA_CREATE_INFO, Alter_info, int, bool, st_key*, unsigned int, st_mysql_const_unsigned_lex_string*) /test/12.2_dbg_san/sql/sql_table.cc:4950:11
#4 0x5c01156bd428 in mysql_create_table_no_lock(THD, st_ddl_log_state, st_ddl_log_state, Table_specification_st, Alter_info, bool, int, TABLE_LIST*) /test/12.2_dbg_san/sql/sql_table.cc:5052:8
#5 0x5c0115731bc6 in mysql_create_table(THD, TABLE_LIST, Table_specification_st, Alter_info) /test/12.2_dbg_san/sql/sql_table.cc:5298:7
#6 0x5c011572b1d8 in Sql_cmd_create_table_like::execute(THD*) /test/12.2_dbg_san/sql/sql_table.cc:13793:12
#7 0x5c01151eb053 in mysql_execute_command(THD*, bool) /test/12.2_dbg_san/sql/sql_parse.cc:5861:26
#8 0x5c01151ce1e8 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/12.2_dbg_san/sql/sql_parse.cc:7888:18
#9 0x5c01151c79a3 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/12.2_dbg_san/sql/sql_parse.cc:1878:7
#10 0x5c01151d062a in do_command(THD*, bool) /test/12.2_dbg_san/sql/sql_parse.cc:1417:17
#11 0x5c01159ddb3c in do_handle_one_connection(CONNECT*, bool) /test/12.2_dbg_san/sql/sql_connect.cc:1503:11
#12 0x5c01159dd645 in handle_one_connection /test/12.2_dbg_san/sql/sql_connect.cc:1415:5
#13 0x5c011412cb4a in asan_thread_start(void*) crtstuff.c
#14 0x764e54c9ca93 in start_thread nptl/pthread_create.c:447:8
#15 0x764e54d29c3b in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

0x749e53cefb90 is located 656 bytes inside of 8184-byte region [0x749e53cef900,0x749e53cf18f8)
allocated by thread T11 here:
#0 0x5c011412f2c8 in malloc (/test/UBASAN_MD101125-mariadb-12.2.0-linux-x86_64-dbg/bin/mariadbd+0x3c982c8) (BuildId: 7b0cb8241b81c77e02045f0095ce4e038036f58e)
#1 0x5c01173983a6 in my_malloc /test/12.2_dbg_san/mysys/my_malloc.c:93:29
#2 0x5c011734b3b3 in alloc_root /test/12.2_dbg_san/mysys/my_alloc.c:336:29
#3 0x5c01173513cf in memdup_root /test/12.2_dbg_san/mysys/my_alloc.c:690:12
#4 0x5c0115815004 in TABLE_SHARE::init_from_binary_frm_image(THD, bool, unsigned char const, unsigned long, unsigned char const*, unsigned long) /test/12.2_dbg_san/sql/table.cc:1924:33
#5 0x5c011428353f in ha_create_table(THD, char const, char const, char const, HA_CREATE_INFO, st_mysql_const_unsigned_lex_string, bool) /test/12.2_dbg_san/sql/handler.cc:6481:15
#6 0x5c01156c0830 in create_table_impl(THD, st_ddl_log_state, st_ddl_log_state, Lex_ident_db const&, Lex_ident_table const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, st_mysql_const_lex_string const&, DDL_options_st, HA_CREATE_INFO, Alter_info, int, bool, st_key*, unsigned int, st_mysql_const_unsigned_lex_string*) /test/12.2_dbg_san/sql/sql_table.cc:4950:11
#7 0x5c01156bd428 in mysql_create_table_no_lock(THD, st_ddl_log_state, st_ddl_log_state, Table_specification_st, Alter_info, bool, int, TABLE_LIST*) /test/12.2_dbg_san/sql/sql_table.cc:5052:8
#8 0x5c0115731bc6 in mysql_create_table(THD, TABLE_LIST, Table_specification_st, Alter_info) /test/12.2_dbg_san/sql/sql_table.cc:5298:7
#9 0x5c011572b1d8 in Sql_cmd_create_table_like::execute(THD*) /test/12.2_dbg_san/sql/sql_table.cc:13793:12
#10 0x5c01151eb053 in mysql_execute_command(THD*, bool) /test/12.2_dbg_san/sql/sql_parse.cc:5861:26
#11 0x5c01151ce1e8 in mysql_parse(THD, char, unsigned int, Parser_state*) /test/12.2_dbg_san/sql/sql_parse.cc:7888:18
#12 0x5c01151c79a3 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/12.2_dbg_san/sql/sql_parse.cc:1878:7
#13 0x5c01151d062a in do_command(THD*, bool) /test/12.2_dbg_san/sql/sql_parse.cc:1417:17
#14 0x5c01159ddb3c in do_handle_one_connection(CONNECT*, bool) /test/12.2_dbg_san/sql/sql_connect.cc:1503:11
#15 0x5c01159dd645 in handle_one_connection /test/12.2_dbg_san/sql/sql_connect.cc:1415:5
#16 0x5c011412cb4a in asan_thread_start(void*) crtstuff.c

Thread T11 created by T0 here:
#0 0x5c0114113245 in pthread_create (/test/UBASAN_MD101125-mariadb-12.2.0-linux-x86_64-dbg/bin/mariadbd+0x3c7c245) (BuildId: 7b0cb8241b81c77e02045f0095ce4e038036f58e)
#1 0x5c0114186b8c in create_thread_to_handle_connection(CONNECT*) /test/12.2_dbg_san/sql/mysqld.cc:6273:19
#2 0x5c0114187c15 in handle_connections_sockets() /test/12.2_dbg_san/sql/mysqld.cc:6509:9
#3 0x5c011418619a in run_main_loop() /test/12.2_dbg_san/sql/mysqld.cc:5751:3
#4 0x5c011417bb3e in mysqld_main(int, char**) /test/12.2_dbg_san/sql/mysqld.cc:6174:3
#5 0x764e54c2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#6 0x764e54c2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#7 0x5c0114089b54 in _start (/test/UBASAN_MD101125-mariadb-12.2.0-linux-x86_64-dbg/bin/mariadbd+0x3bf2b54) (BuildId: 7b0cb8241b81c77e02045f0095ce4e038036f58e)

SUMMARY: AddressSanitizer: use-after-poison /test/12.2_dbg_san/sql/table.cc:5064:36 in fix_type_pointers(char const*, unsigned int, st_typelib, unsigned int, char, unsigned long)
Shadow bytes around the buggy address:
0x749e53cef900: 00 00 00 00 00 00 f7 00 00 f7 01 f7 00 00 00 00
0x749e53cef980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x749e53cefa00: 00 00 00 00 00 00 00 00 00 02 f7 00 f7 00 03 f7
0x749e53cefa80: 01 f7 00 00 00 00 f7 00 00 00 00 00 00 00 00 00
0x749e53cefb00: 00 f7 f7 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x749e53cefb80: 00 00[f7]00 00 00 00 00 00 00 00 00 00 00 00 00
0x749e53cefc00: 00 00 00 f7 00 00 00 00 00 00 00 00 00 00 00 00
0x749e53cefc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x749e53cefd00: 00 00 00 00 00 00 00 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x749e53cefd80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x749e53cefe00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb

NOTE: the stack trace above identifies the code that accessed the poisoned memory.
To identify the code that poisoned the memory, try the experimental setting ASAN_OPTIONS=poison_history_size=<size>.
==115704==ABORTING

Setup:

Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:

  # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18

Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1   # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter

    export ASAN_OPTIONS=quarantine_size_mb=512:atexit=0:detect_invalid_pointer_pairs=3:dump_instruction_bytes=1:abort_on_error=1:allocator_may_return_null=1

SAN Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 101125 759e3523e3d832b174cf0a612704da38b2557b40 ASAN\|use-after-poison\|sql/table.cc\|fix_type_pointers\|TABLE_SHARE::init_from_binary_frm_image\|ha_create_table\|create_table_impl
CS 10.6 opt 101125 759e3523e3d832b174cf0a612704da38b2557b40 MARIADBD_ERROR\|mariadbd: Incorrect information in frm file
CS 10.11 dbg 101125 536cd151f0370216d9ba4c15f40c7037060972a5 ASAN\|use-after-poison\|sql/table.cc\|fix_type_pointers\|TABLE_SHARE::init_from_binary_frm_image\|ha_create_table\|create_table_impl
CS 10.11 opt 101125 536cd151f0370216d9ba4c15f40c7037060972a5 MARIADBD_ERROR\|mariadbd: Incorrect information in frm file
CS 11.4 dbg 101125 a1bb5c94fda453baa99e57e3927eaa7cd3c8bafe ASAN\|use-after-poison\|sql/table.cc\|fix_type_pointers\|TABLE_SHARE::init_from_binary_frm_image\|ha_create_table\|create_table_impl
CS 11.4 opt 101125 a1bb5c94fda453baa99e57e3927eaa7cd3c8bafe MARIADBD_ERROR\|mariadbd: Incorrect information in frm file
CS 11.8 dbg 101125 e0428264d0095472c015eb58c46be68ca1a320ee ASAN\|use-after-poison\|sql/table.cc\|fix_type_pointers\|TABLE_SHARE::init_from_binary_frm_image\|ha_create_table\|create_table_impl
CS 11.8 opt 101125 e0428264d0095472c015eb58c46be68ca1a320ee MARIADBD_ERROR\|mariadbd: Incorrect information in frm file
CS 12.1 dbg 101125 ba00960fdaee67a4efff6866e31f446bf486a1c2 ASAN\|use-after-poison\|sql/table.cc\|fix_type_pointers\|TABLE_SHARE::init_from_binary_frm_image\|ha_create_table\|create_table_impl
CS 12.1 opt 101125 ba00960fdaee67a4efff6866e31f446bf486a1c2 MARIADBD_ERROR\|mariadbd: Incorrect information in frm file
CS 12.2 dbg 101125 fd15fd2765b53d0c070dd01d86fb231024b8f284 ASAN\|use-after-poison\|sql/table.cc\|fix_type_pointers\|TABLE_SHARE::init_from_binary_frm_image\|ha_create_table\|create_table_impl
CS 12.2 opt 101125 fd15fd2765b53d0c070dd01d86fb231024b8f284 MARIADBD_ERROR\|mariadbd: Incorrect information in frm file
CS 12.3 dbg 091225 e85bc659188be021897e8578aec42becfbb58c27 ASAN\|use-after-poison\|sql/table.cc\|fix_type_pointers\|TABLE_SHARE::init_from_binary_frm_image\|ha_create_table\|create_table_impl
CS 12.3 opt 091225 e85bc659188be021897e8578aec42becfbb58c27 MARIADBD_ERROR\|mariadbd: Incorrect information in frm file
ES 10.6 dbg 101125 f0d4d34fb0314b03fddb71fb9dbde372744a8c13 ASAN\|use-after-poison\|sql/table.cc\|fix_type_pointers\|TABLE_SHARE::init_from_binary_frm_image\|ha_create_table\|create_table_impl
ES 10.6 opt 101125 f0d4d34fb0314b03fddb71fb9dbde372744a8c13 MARIADBD_ERROR\|mariadbd: Incorrect information in frm file
ES 11.4 dbg 101125 b81ec4b57a5ddce88b8e2b2d16b64625ffdaa0e6 ASAN\|use-after-poison\|sql/table.cc\|fix_type_pointers\|TABLE_SHARE::init_from_binary_frm_image\|ha_create_table\|create_table_impl
ES 11.4 opt 101125 b81ec4b57a5ddce88b8e2b2d16b64625ffdaa0e6 MARIADBD_ERROR\|mariadbd: Incorrect information in frm file
ES 11.8 dbg 101125 db36e8fb3bcdae26dd0acdcb2b52f7f4eb014df6 ASAN\|use-after-poison\|sql/table.cc\|fix_type_pointers\|TABLE_SHARE::init_from_binary_frm_image\|ha_create_table\|create_table_impl
ES 11.8 opt 101125 db36e8fb3bcdae26dd0acdcb2b52f7f4eb014df6 MARIADBD_ERROR\|mariadbd: Incorrect information in frm file

Attachments

Activity

People

Assignee:: Alexander Barkov

Reporter:: Roel Van de Paar

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 2026-01-16 02:14

Updated:: 2026-01-16 02:19

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.