[MDEV-41396] SIGSEGV in _ma_unpin_all_pages on INSERT ... PARTITION w/ AUTO_INCREMENT as second key part - Jira

CREATE TABLE t (c1 INT, c2 INT AUTO_INCREMENT, PRIMARY KEY(c1,c2)) ENGINE=Aria PARTITION BY HASH (c1) PARTITIONS 2;

INSERT INTO t VALUES (2,1);

INSERT INTO t PARTITION (p1) VALUES (1,NULL);

--source include/have_partition.inc

CREATE TABLE t (c1 INT, c2 INT AUTO_INCREMENT, PRIMARY KEY(c1,c2)) ENGINE=Aria PARTITION BY HASH (c1) PARTITIONS 2;

INSERT INTO t VALUES (2,1);

INSERT INTO t PARTITION (p1) VALUES (1,NULL);

DROP TABLE t;

CS 10.11.19 8f00e6caca633c783140db86d3a48a96de67cf38 (Optimized, Clang 22.1.8-20260622) Build 18/08/2026
Core was generated by `/test/MD180826-mariadb-10.11.19-linux-x86_64-opt/bin/mariadbd --no-defaults --l'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x000057e5576146d8 in _ma_unpin_all_pages (info=info@entry=0x76c864027298, undo_lsn=undo_lsn@entry=0)at /test/10.11_opt/storage/maria/ma_key_recover.c:73

[Current thread is 1 (LWP 2686763)]
(gdb) bt
#0 0x000057e5576146d8 in _ma_unpin_all_pages (info=info@entry=0x76c864027298, undo_lsn=undo_lsn@entry=0)at /test/10.11_opt/storage/maria/ma_key_recover.c:73
#1 0x000057e557610abd in _ma_search (info=info@entry=0x76c864027298, key=key@entry=0x7ec961677f60, nextflag=nextflag@entry=262432, pos=<optimized out>) at /test/10.11_opt/storage/maria/ma_search.c:99
#2 0x000057e55760ff34 in maria_rkey (info=0x76c864027298, buf=0x76c864022d28 "", inx=0, key_data=<optimized out>, keypart_map=<optimized out>, search_flag=HA_READ_PREFIX_LAST)at /test/10.11_opt/storage/maria/ma_rkey.c:104
#3 0x000057e5575ea13c in ha_maria::get_auto_increment (this=0x76c864021d28, offset=<optimized out>, increment=<optimized out>, nb_desired_values=<optimized out>, first_value=0x7ec961678a18, nb_reserved_values=0x7ec961678a10)at /test/10.11_opt/storage/maria/ha_maria.cc:3446
#4 0x000057e55766067b in ha_partition::get_auto_increment (this=<optimized out>, offset=1, increment=1, nb_desired_values=<optimized out>, first_value=0x7ec961678a80, nb_reserved_values=0x7ec961678a78)at /test/10.11_opt/sql/ha_partition.cc:11059
#5 0x000057e55744a76b in handler::update_auto_increment (this=this@entry=0x76c864021488) at /test/10.11_opt/sql/handler.cc:4218
#6 0x000057e557658a0f in ha_partition::write_row (this=0x76c864021488, buf=0x76c864022d18 "\377\001") at /test/10.11_opt/sql/ha_partition.cc:4663
#7 0x000057e557450ed0 in handler::ha_write_row (this=0x76c864021488, buf=0x76c864022d18 "\377\001") at /test/10.11_opt/sql/handler.cc:7856
#8 0x000057e5571e308e in Write_record::single_insert (this=this@entry=0x7ec961678be8, inserted=inserted@entry=0x7ec961678bb8)at /test/10.11_opt/sql/sql_insert.cc:2326
#9 0x000057e5571e1d67 in Write_record::write_record (this=this@entry=0x7ec961678be8) at /test/10.11_opt/sql/sql_insert.cc:2368
#10 0x000057e5571dfde0 in mysql_insert (thd=thd@entry=0x76c864000c68, table_list=0x76c864010e18, fields=@0x76c864005eb0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x57e55837b380 <end_of_list>, last = 0x76c864005eb0, elements = 0}, <No data fields>}, values_list=@0x76c864005ef8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x76c864011b28, last = 0x76c864011b28, elements = 1}, <No data fields>}, update_fields=@0x76c864005ee0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x57e55837b380 <end_of_list>, last = 0x76c864005ee0, elements = 0}, <No data fields>}, update_values=@0x76c864005ec8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x57e55837b380 <end_of_list>, last = 0x76c864005ec8, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=<optimized out>, result=0x0)at /test/10.11_opt/sql/sql_insert.cc:1216
#11 0x000057e55721ab26 in mysql_execute_command (thd=thd@entry=0x76c864000c68, is_called_from_prepared_stmt=false)at /test/10.11_opt/sql/sql_parse.cc:4656
#12 0x000057e557212c6d in mysql_parse (thd=thd@entry=0x76c864000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7ec961679560)at /test/10.11_opt/sql/sql_parse.cc:8210
#13 0x000057e5572113a0 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x76c864000c68, packet=packet@entry=0x76c864008749 "INSERT INTO t PARTITION (p1) VALUES (1,NULL)", packet_length=packet_length@entry=44, blocking=true)at /test/10.11_opt/sql/sql_parse.cc:1924
#14 0x000057e5572130f0 in do_command (thd=thd@entry=0x76c864000c68, blocking=true) at /test/10.11_opt/sql/sql_parse.cc:1434
#15 0x000057e55732bf8d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x57e56f5f49e8, put_in_cache=true)at /test/10.11_opt/sql/sql_connect.cc:1486
#16 0x000057e55732bdb6 in handle_one_connection (arg=arg@entry=0x57e56f5f49e8)at /test/10.11_opt/sql/sql_connect.cc:1398
#17 0x000057e557664a0e in pfs_spawn_thread (arg=0x57e56f5f4a58)at /test/10.11_opt/storage/perfschema/pfs.cc:2201
#18 0x00007ec96a69cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#19 0x00007ec96a729ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

CS 10.11.19 8f00e6caca633c783140db86d3a48a96de67cf38 (Debug, Clang 22.1.8-20260622) Build 18/08/2026
Core was generated by `/test/MD180826-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd --no-defaults --l'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00005f30c6a20911 in _ma_unpin_all_pages (info=0x6d24d4034868, undo_lsn=0)at /test/10.11_dbg/storage/maria/ma_key_recover.c:73

[Current thread is 1 (LWP 2687010)]
(gdb) bt
#0 0x00005f30c6a20911 in _ma_unpin_all_pages (info=0x6d24d4034868, undo_lsn=0)at /test/10.11_dbg/storage/maria/ma_key_recover.c:73
#1 0x00005f30c6a195f2 in _ma_search (info=0x6d24d4034868, key=0x6d256f10f0d0, nextflag=262432, pos=8192) at /test/10.11_dbg/storage/maria/ma_search.c:99
#2 0x00005f30c6a1850d in maria_rkey (info=0x6d24d4034868, buf=0x6d24d402af88 '\245' <repeats 16 times>, "\350\257\002\324$m", inx=0, key_data=0x6d256f10f1d0 "\001", keypart_map=1, search_flag=HA_READ_PREFIX_LAST)at /test/10.11_dbg/storage/maria/ma_rkey.c:104
#3 0x00005f30c69d8d0e in ha_maria::get_auto_increment (this=0x6d24d4029f88, offset=1, increment=1, nb_desired_values=1, first_value=0x6d256f10fbe0, nb_reserved_values=0x6d256f10fbe8)at /test/10.11_dbg/storage/maria/ha_maria.cc:3446
#4 0x00005f30c6a980a0 in ha_partition::get_auto_increment (this=0x6d24d40296e8, offset=1, increment=1, nb_desired_values=1, first_value=0x6d256f10fcd0, nb_reserved_values=0x6d256f10fcc8)at /test/10.11_dbg/sql/ha_partition.cc:11059
#5 0x00005f30c6774897 in handler::update_auto_increment (this=0x6d24d40296e8)at /test/10.11_dbg/sql/handler.cc:4218
#6 0x00005f30c6a8d41c in ha_partition::write_row (this=0x6d24d40296e8, buf=0x6d24d402af78 "\377\001") at /test/10.11_dbg/sql/ha_partition.cc:4663
#7 0x00005f30c677e066 in handler::ha_write_row (this=0x6d24d40296e8, buf=0x6d24d402af78 "\377\001") at /test/10.11_dbg/sql/handler.cc:7856
#8 0x00005f30c6389112 in Write_record::single_insert (this=0x6d256f1101f0, inserted=0x6d256f10fed0) at /test/10.11_dbg/sql/sql_insert.cc:2326
#9 0x00005f30c6387283 in Write_record::write_record (this=0x6d256f1101f0)at /test/10.11_dbg/sql/sql_insert.cc:2368
#10 0x00005f30c6384d95 in mysql_insert (thd=0x6d24d4000d58, table_list=0x6d24d4013618, fields=@0x6d24d4005f70: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5f30c7ddc9d0 <end_of_list>, last = 0x6d24d4005f70, elements = 0}, <No data fields>}, values_list=@0x6d24d4005fb8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x6d24d4014328, last = 0x6d24d4014328, elements = 1}, <No data fields>}, update_fields=@0x6d24d4005fa0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5f30c7ddc9d0 <end_of_list>, last = 0x6d24d4005fa0, elements = 0}, <No data fields>}, update_values=@0x6d24d4005f88: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5f30c7ddc9d0 <end_of_list>, last = 0x6d24d4005f88, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0)at /test/10.11_dbg/sql/sql_insert.cc:1216
#11 0x00005f30c63dae45 in mysql_execute_command (thd=0x6d24d4000d58, is_called_from_prepared_stmt=false)at /test/10.11_dbg/sql/sql_parse.cc:4656
#12 0x00005f30c63d15b8 in mysql_parse (thd=0x6d24d4000d58, rawbuf=0x6d24d40134c0 "INSERT INTO t PARTITION (p1) VALUES (1,NULL)", length=44, parser_state=0x6d256f111a20)at /test/10.11_dbg/sql/sql_parse.cc:8210
#13 0x00005f30c63cee9a in dispatch_command (command=COM_QUERY, thd=0x6d24d4000d58, packet=0x6d24d400af49 "INSERT INTO t PARTITION (p1) VALUES (1,NULL)", packet_length=44, blocking=true) at /test/10.11_dbg/sql/sql_parse.cc:1924
#14 0x00005f30c63d203a in do_command (thd=0x6d24d4000d58, blocking=true)at /test/10.11_dbg/sql/sql_parse.cc:1434
#15 0x00005f30c658874e in do_handle_one_connection (connect=0x5f30c9de7458, put_in_cache=true) at /test/10.11_dbg/sql/sql_connect.cc:1486
#16 0x00005f30c6588535 in handle_one_connection (arg=0x5f30c9ef38d8)at /test/10.11_dbg/sql/sql_connect.cc:1398
#17 0x00007525acc9cb84 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#18 0x00007525acd29ecc in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.11 dbg 180826 8f00e6caca633c783140db86d3a48a96de67cf38 SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 10.11 opt 180826 8f00e6caca633c783140db86d3a48a96de67cf38 SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 11.4 dbg 180826 1a052f27e374fc9b4cb5b1fd098cf10f0e1381cc SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 11.4 opt 180826 1a052f27e374fc9b4cb5b1fd098cf10f0e1381cc SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 11.8 dbg 180826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 11.8 opt 180826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 12.3 dbg 180826 add63991988734383c5e942de2a19c6c45f511f7 SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 12.3 opt 180826 add63991988734383c5e942de2a19c6c45f511f7 SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 13.0 dbg 180826 a848493c6fe031f23606144420c1ca1e467cbd81 SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 13.0 opt 180826 a848493c6fe031f23606144420c1ca1e467cbd81 SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 13.1 dbg 180826 da18481158c81ca94689702073c3e04aad85a6a3 SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 13.1 opt 051026 87e62ca17270e163a6d41b3fc8d6f4d440f1bb88 SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 13.1 opt 180826 da18481158c81ca94689702073c3e04aad85a6a3 SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
ES 10.6 dbg 180826 fcecb2620f25965723d640decede7c018bcb1dcc SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
ES 10.6 opt 180826 fcecb2620f25965723d640decede7c018bcb1dcc SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
ES 11.4 dbg 180826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
ES 11.4 opt 180826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
ES 11.8 dbg 180826 4694e931d10fecf733c34f83ea2146d31b708eb3 SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
ES 11.8 opt 180826 4694e931d10fecf733c34f83ea2146d31b708eb3 SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
ES 12.3 dbg 180826 f513f503feacabfb219d4a6f965b5f72b86d4db0 SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
ES 12.3 opt 180826 f513f503feacabfb219d4a6f965b5f72b86d4db0 SIGSEGV\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
MS 5.5 dbg 070123 bac287c315b1792e7ae33f91add6a60292f9bae8 No bug found
MS 5.5 opt 070123 bac287c315b1792e7ae33f91add6a60292f9bae8 No bug found
MS 5.6 dbg 070123 dab95781a1244104d6b87020ac2fc4d190ba2946 No bug found
MS 5.6 opt 070123 dab95781a1244104d6b87020ac2fc4d190ba2946 No bug found
MS 5.7 dbg 070525 f7680e98b6bbe3500399fbad465d08a6b75d7a5c No bug found
MS 5.7 opt 070525 f7680e98b6bbe3500399fbad465d08a6b75d7a5c No bug found
MS 8.0 dbg 060224 49ef33f7edadef3ae04665e73d1babd40179a4f1 No bug found
MS 8.0 opt 060224 49ef33f7edadef3ae04665e73d1babd40179a4f1 No bug found
MS 9.1 dbg 211024 61a3a1d8ef15512396b4c2af46e922a19bf2b174 No bug found
MS 9.1 opt 211024 61a3a1d8ef15512396b4c2af46e922a19bf2b174 No bug found

CS 10.11.19 8f00e6caca633c783140db86d3a48a96de67cf38 (Debug, UBASAN, Clang 22.1.8-20260622) Build 19/08/2026
/test/10.11_dbg_san/storage/maria/ma_key_recover.c:73:41: runtime error: member access within null pointer of type 'struct st_ma_transaction'
#0 0x59145da5078a in _ma_unpin_all_pages /test/10.11_dbg_san/storage/maria/ma_key_recover.c:73:41
#1 0x59145da2c04e in _ma_search /test/10.11_dbg_san/storage/maria/ma_search.c:99:3
#2 0x59145dc6c3ee in maria_rkey /test/10.11_dbg_san/storage/maria/ma_rkey.c:104:10
#3 0x59145dbfb132 in ha_maria::get_auto_increment(unsigned long long, unsigned long long, unsigned long long, unsigned long long, unsigned long long) /test/10.11_dbg_san/storage/maria/ha_maria.cc:3446:10
#4 0x59145de12b8a in ha_partition::get_auto_increment(unsigned long long, unsigned long long, unsigned long long, unsigned long long, unsigned long long) /test/10.11_dbg_san/sql/ha_partition.cc:11059:16
#5 0x59145be59f21 in handler::update_auto_increment() /test/10.11_dbg_san/sql/handler.cc:4218:7
#6 0x59145dde0684 in ha_partition::write_row(unsigned char const*) /test/10.11_dbg_san/sql/ha_partition.cc:4663:25
#7 0x59145be86fc6 in handler::ha_write_row(unsigned char const*) /test/10.11_dbg_san/sql/handler.cc:7856:32
#8 0x59145cbd4842 in Write_record::single_insert(unsigned long long*) /test/10.11_dbg_san/sql/sql_insert.cc:2326:27
#9 0x59145cbc7c2d in Write_record::write_record() /test/10.11_dbg_san/sql/sql_insert.cc:2368:10
#10 0x59145cbbc034 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/10.11_dbg_san/sql/sql_insert.cc:1216:22
#11 0x59145ccf8f80 in mysql_execute_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:4656:10
#12 0x59145cccd51f in mysql_parse(THD, char, unsigned int, Parser_state*) /test/10.11_dbg_san/sql/sql_parse.cc:8210:18
#13 0x59145ccc541b in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1924:7
#14 0x59145cccf996 in do_command(THD*, bool) /test/10.11_dbg_san/sql/sql_parse.cc:1434:17
#15 0x59145d49647c in do_handle_one_connection(CONNECT*, bool) /test/10.11_dbg_san/sql/sql_connect.cc:1486:11
#16 0x59145d495fa9 in handle_one_connection /test/10.11_dbg_san/sql/sql_connect.cc:1398:5
#17 0x7e7a24348e16 in asan_thread_start(void*) /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:246:28
#18 0x7e7a23a9cb83 in start_thread nptl/pthread_create.c:447:8
#19 0x7e7a23b29ecb in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: null-pointer-use /test/10.11_dbg_san/storage/maria/ma_key_recover.c:73:41

CS 10.11.19 8f00e6caca633c783140db86d3a48a96de67cf38 (Optimized, UBASAN, Clang 22.1.8-20260622) Build 19/08/2026
/test/10.11_opt_san/storage/maria/ma_key_recover.c:73:41: runtime error: member access within null pointer of type 'struct st_ma_transaction'
#0 0x5e22a42205a7 in _ma_unpin_all_pages /test/10.11_opt_san/storage/maria/ma_key_recover.c:73:41
#1 0x5e22a41fcad4 in _ma_search /test/10.11_opt_san/storage/maria/ma_search.c:99:3
#2 0x5e22a43f1498 in maria_rkey /test/10.11_opt_san/storage/maria/ma_rkey.c:104:10
#3 0x5e22a437f052 in ha_maria::get_auto_increment(unsigned long long, unsigned long long, unsigned long long, unsigned long long, unsigned long long) /test/10.11_opt_san/storage/maria/ha_maria.cc:3446:10
#4 0x5e22a457b6ed in ha_partition::get_auto_increment(unsigned long long, unsigned long long, unsigned long long, unsigned long long, unsigned long long) /test/10.11_opt_san/sql/ha_partition.cc:11059:16
#5 0x5e22a27ac444 in handler::update_auto_increment() /test/10.11_opt_san/sql/handler.cc:4218:7
#6 0x5e22a454b6c1 in ha_partition::write_row(unsigned char const*) /test/10.11_opt_san/sql/ha_partition.cc:4663:25
#7 0x5e22a27d32b9 in handler::ha_write_row(unsigned char const*) /test/10.11_opt_san/sql/handler.cc:7856:32
#8 0x5e22a344a55f in Write_record::single_insert(unsigned long long*) /test/10.11_opt_san/sql/sql_insert.cc:2326:27
#9 0x5e22a343e9ad in Write_record::write_record() /test/10.11_opt_san/sql/sql_insert.cc:2368:10
#10 0x5e22a34315b6 in mysql_insert(THD, TABLE_LIST, List<Item>&, List<List<Item>>&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/10.11_opt_san/sql/sql_insert.cc:1216:22
#11 0x5e22a355942f in mysql_execute_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:4656:10
#12 0x5e22a353461b in mysql_parse(THD, char, unsigned int, Parser_state*) /test/10.11_opt_san/sql/sql_parse.cc:8210:18
#13 0x5e22a352c6a5 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/10.11_opt_san/sql/sql_parse.cc:1924:7
#14 0x5e22a353654f in do_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:1434:17
#15 0x5e22a3c8d44c in do_handle_one_connection(CONNECT*, bool) /test/10.11_opt_san/sql/sql_connect.cc:1486:11
#16 0x5e22a3c8cee1 in handle_one_connection /test/10.11_opt_san/sql/sql_connect.cc:1398:5
#17 0x5e22a4592289 in pfs_spawn_thread /test/10.11_opt_san/storage/perfschema/pfs.cc:2201:3
#18 0x773068b48e16 in asan_thread_start(void*) /test/llvm-build/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:246:28
#19 0x77306809cb83 in start_thread nptl/pthread_create.c:447:8
#20 0x773068129ecb in clone3 misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

SUMMARY: UndefinedBehaviorSanitizer: null-pointer-use /test/10.11_opt_san/storage/maria/ma_key_recover.c:73:41

Compiled with a recent version of Clang and LLVM. Ubuntu instructions for Clang/LLVM 18:

  # Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref  dpkg --list | grep -iE 'clang|llvm'  and use  apt purge  and  dpkg --purge  to remove the packages), before installing Clang/LLVM 18

     sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev lld-18

Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-O1 -march=native -mtune=native'" and:

    -DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON

Set before execution:

    export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1   # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter

SAN Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.11 dbg 190826 8f00e6caca633c783140db86d3a48a96de67cf38 UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 10.11 opt 190826 8f00e6caca633c783140db86d3a48a96de67cf38 UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 11.4 dbg 190826 1a052f27e374fc9b4cb5b1fd098cf10f0e1381cc UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 11.4 opt 190826 1a052f27e374fc9b4cb5b1fd098cf10f0e1381cc UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 11.8 dbg 190826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 11.8 opt 190826 d26f9ab217a7fcf9d4eccc62c01020ff275ff42e UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 12.3 dbg 180826 add63991988734383c5e942de2a19c6c45f511f7 UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 12.3 opt 180826 add63991988734383c5e942de2a19c6c45f511f7 UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 13.0 dbg 180826 a848493c6fe031f23606144420c1ca1e467cbd81 UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 13.0 opt 180826 a848493c6fe031f23606144420c1ca1e467cbd81 UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 13.1 dbg 180826 da18481158c81ca94689702073c3e04aad85a6a3 UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
CS 13.1 opt 180826 da18481158c81ca94689702073c3e04aad85a6a3 UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
ES 10.6 dbg 190826 fcecb2620f25965723d640decede7c018bcb1dcc UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
ES 10.6 opt 190826 fcecb2620f25965723d640decede7c018bcb1dcc UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
ES 11.4 dbg 190826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
ES 11.4 opt 190826 3b34189bfe675c18c4ced3ef531d016ea74c76f4 UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
ES 11.8 dbg 190826 4694e931d10fecf733c34f83ea2146d31b708eb3 UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
ES 11.8 opt 190826 4694e931d10fecf733c34f83ea2146d31b708eb3 UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
ES 12.3 dbg 180826 f513f503feacabfb219d4a6f965b5f72b86d4db0 UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment
ES 12.3 opt 180826 f513f503feacabfb219d4a6f965b5f72b86d4db0 UBSAN\|member access within null pointer of type 'struct st_ma_transaction'\|storage/maria/ma_key_recover.c\|_ma_unpin_all_pages\|_ma_search\|maria_rkey\|ha_maria::get_auto_increment

SIGSEGV in _ma_unpin_all_pages on INSERT ... PARTITION w/ AUTO_INCREMENT as second key part

Details

Description

Attachments

Issue Links

Activity

People

Dates

Time Tracking

Git Integration