[MDEV-15114] ASAN heap-use-after-free in mem_heap_dup or dfield_data_is_binary_equal Created: 2018-01-29  Updated: 2023-07-24  Resolved: 2018-06-19

Status: Closed
Project: MariaDB Server
Component/s: Storage Engine - InnoDB, Virtual Columns
Affects Version/s: 10.2, 10.3
Fix Version/s: 10.2.16, 10.3.8

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Michael Widenius
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Blocks
blocks MDEV-31765 Merge new release of InnoDB 5.7.43 to... Closed
Duplicate
is duplicated by MDEV-14391 InnoDB crash, memory corruption Closed
Problem/Incident
causes MDEV-20874 Wrong handling of 'table was dropped'... Stalled
Relates
relates to MDEV-5800 indexes on virtual (not materialized)... Closed
relates to MDEV-14134 gcol.innodb_virtual_debug sporadicall... Closed
relates to MDEV-17890 Server crash on DELETE with YEAR fiel... Closed
relates to MDEV-15330 Server crash or assertion `table->ins... Closed
relates to MDEV-16222 Assertion `0' failed in row_purge_rem... Closed

 Description    

--source include/have_innodb.inc
 
 
 
CREATE TABLE t1 (
 
  pk INT,
 
  c TEXT,
 
  vc LONGTEXT AS (c) VIRTUAL,
 
  i INT,
 
  PRIMARY KEY(pk),
 
  UNIQUE(i),
 
  INDEX(vc(64))
 
) ENGINE=InnoDB;
 
 
 
INSERT INTO t1 (pk,c,i) VALUES (1,REPEAT('foo ',15000),0);
 
REPLACE INTO t1 (pk,c,i) SELECT pk,c,i FROM t1;
 
 
 
# Cleanup
 
DROP TABLE t1;

10.2 30289a271380 ASAN

 
==6536==ERROR: AddressSanitizer: heap-use-after-free on address 0x630000100488 at pc 0x559f3b265c4d bp 0x7f3ca0844200 sp 0x7f3ca08441f8
 
READ of size 60000 at 0x630000100488 thread T27
 
    #0 0x559f3b265c4c in mem_heap_dup(mem_block_info_t*, void const*, unsigned long) /data/src/10.2/storage/innobase/mem/mem0mem.cc:56
 
    #1 0x559f3b40dd82 in dfield_dup /data/src/10.2/storage/innobase/include/data0data.ic:285
 
    #2 0x559f3b417ef4 in row_upd_index_replace_new_col_val /data/src/10.2/storage/innobase/row/row0upd.cc:1287
 
    #3 0x559f3b41847e in row_upd_index_replace_new_col_vals_index_pos(dtuple_t*, dict_index_t*, upd_t const*, unsigned long, mem_block_info_t*) /data/src/10.2/storage/innobase/row/row0upd.cc:1367
 
    #4 0x559f3b54c9a4 in btr_cur_pessimistic_update(unsigned long, btr_cur_t*, unsigned long**, mem_block_info_t**, mem_block_info_t*, big_rec_t**, upd_t*, unsigned long, que_thr_t*, unsigned long, mtr_t*) /data/src/10.2/storage/innobase/btr/btr0cur.cc:4206
 
    #5 0x559f3b32fb72 in row_ins_clust_index_entry_by_modify /data/src/10.2/storage/innobase/row/row0ins.cc:394
 
    #6 0x559f3b3395c3 in row_ins_clust_index_entry_low(unsigned long, unsigned long, dict_index_t*, unsigned long, dtuple_t*, unsigned long, que_thr_t*, bool) /data/src/10.2/storage/innobase/row/row0ins.cc:2688
 
    #7 0x559f3b33b937 in row_ins_clust_index_entry(dict_index_t*, dtuple_t*, que_thr_t*, unsigned long, bool) /data/src/10.2/storage/innobase/row/row0ins.cc:3218
 
    #8 0x559f3b33bdc6 in row_ins_index_entry /data/src/10.2/storage/innobase/row/row0ins.cc:3314
 
    #9 0x559f3b33c805 in row_ins_index_entry_step /data/src/10.2/storage/innobase/row/row0ins.cc:3464
 
    #10 0x559f3b33d0d0 in row_ins /data/src/10.2/storage/innobase/row/row0ins.cc:3606
 
    #11 0x559f3b33e1d1 in row_ins_step(que_thr_t*) /data/src/10.2/storage/innobase/row/row0ins.cc:3843
 
    #12 0x559f3b374a11 in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:1469
 
    #13 0x559f3b1144c4 in ha_innobase::write_row(unsigned char*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:8595
 
    #14 0x559f3a9925b0 in handler::ha_write_row(unsigned char*) /data/src/10.2/sql/handler.cc:6001
 
    #15 0x559f3a33c486 in write_record(THD*, TABLE*, st_copy_info*) /data/src/10.2/sql/sql_insert.cc:1654
 
    #16 0x559f3a34aa3d in select_insert::send_data(List<Item>&) /data/src/10.2/sql/sql_insert.cc:3757
 
    #17 0x559f3a4ac1aa in end_send /data/src/10.2/sql/sql_select.cc:19822
 
    #18 0x559f3a4a4ac8 in evaluate_join_record /data/src/10.2/sql/sql_select.cc:18874
 
    #19 0x559f3a4dbd2c in AGGR_OP::end_send() /data/src/10.2/sql/sql_select.cc:26580
 
    #20 0x559f3a4a2812 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18369
 
    #21 0x559f3a4a2f90 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18605
 
    #22 0x559f3a4a1aaf in do_select /data/src/10.2/sql/sql_select.cc:18200
 
    #23 0x559f3a441f78 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3530
 
    #24 0x559f3a43fc0f in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3325
 
    #25 0x559f3a442ff5 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3725
 
    #26 0x559f3a422eca in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:373
 
    #27 0x559f3a399512 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4518
 
    #28 0x559f3a3af1e0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7891
 
    #29 0x559f3a38a69b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1806
 
    #30 0x559f3a38773f in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1360
 
    #31 0x559f3a6c18d5 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
 
    #32 0x559f3a6c12ea in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
 
    #33 0x559f3b0ca489 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
 
    #34 0x7f3cb12aa493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
    #35 0x7f3caf69093e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
 
 
 
0x630000100488 is located 136 bytes inside of 60136-byte region [0x630000100400,0x63000010eee8)
 
freed by thread T27 here:
 
    #0 0x7f3cb1514527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
 
    #1 0x559f3b267951 in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /data/src/10.2/storage/innobase/mem/mem0mem.cc:440
 
    #2 0x559f3b40d38f in mem_heap_free /data/src/10.2/storage/innobase/include/mem0mem.ic:535
 
    #3 0x559f3b41b50a in row_upd_store_v_row(upd_node_t*, upd_t const*, THD*, TABLE*) /data/src/10.2/storage/innobase/row/row0upd.cc:2166
 
    #4 0x559f3b41ba39 in row_upd_store_row(upd_node_t*, THD*, TABLE*) /data/src/10.2/storage/innobase/row/row0upd.cc:2220
 
    #5 0x559f3b41f843 in row_upd_del_mark_clust_rec /data/src/10.2/storage/innobase/row/row0upd.cc:2960
 
    #6 0x559f3b4206d4 in row_upd_clust_step /data/src/10.2/storage/innobase/row/row0upd.cc:3144
 
    #7 0x559f3b42118b in row_upd /data/src/10.2/storage/innobase/row/row0upd.cc:3261
 
    #8 0x559f3b421ead in row_upd_step(que_thr_t*) /data/src/10.2/storage/innobase/row/row0upd.cc:3407
 
    #9 0x559f3b377436 in row_update_for_mysql(row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:1927
 
    #10 0x559f3b119109 in ha_innobase::delete_row(unsigned char const*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9488
 
    #11 0x559f3a993420 in handler::ha_delete_row(unsigned char const*) /data/src/10.2/sql/handler.cc:6061
 
    #12 0x559f3a33c2a0 in write_record(THD*, TABLE*, st_copy_info*) /data/src/10.2/sql/sql_insert.cc:1892
 
    #13 0x559f3a34aa3d in select_insert::send_data(List<Item>&) /data/src/10.2/sql/sql_insert.cc:3757
 
    #14 0x559f3a4ac1aa in end_send /data/src/10.2/sql/sql_select.cc:19822
 
    #15 0x559f3a4a4ac8 in evaluate_join_record /data/src/10.2/sql/sql_select.cc:18874
 
    #16 0x559f3a4dbd2c in AGGR_OP::end_send() /data/src/10.2/sql/sql_select.cc:26580
 
    #17 0x559f3a4a2812 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18369
 
    #18 0x559f3a4a2f90 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18605
 
    #19 0x559f3a4a1aaf in do_select /data/src/10.2/sql/sql_select.cc:18200
 
    #20 0x559f3a441f78 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3530
 
    #21 0x559f3a43fc0f in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3325
 
    #22 0x559f3a442ff5 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3725
 
    #23 0x559f3a422eca in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:373
 
    #24 0x559f3a399512 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4518
 
    #25 0x559f3a3af1e0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7891
 
    #26 0x559f3a38a69b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1806
 
    #27 0x559f3a38773f in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1360
 
    #28 0x559f3a6c18d5 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
 
    #29 0x559f3a6c12ea in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
 
 
 
previously allocated by thread T27 here:
 
    #0 0x7f3cb151473f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
 
    #1 0x559f3b266fdf in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /data/src/10.2/storage/innobase/mem/mem0mem.cc:296
 
    #2 0x559f3b2676ee in mem_heap_add_block(mem_block_info_t*, unsigned long) /data/src/10.2/storage/innobase/mem/mem0mem.cc:397
 
    #3 0x559f3b533557 in mem_heap_alloc /data/src/10.2/storage/innobase/include/mem0mem.ic:203
 
    #4 0x559f3b559342 in btr_copy_externally_stored_field(unsigned long*, unsigned char const*, page_size_t const&, unsigned long, mem_block_info_t*) /data/src/10.2/storage/innobase/btr/btr0cur.cc:7766
 
    #5 0x559f3b14dd3e in innobase_get_computed_value(dtuple_t const*, dict_v_col_t const*, dict_index_t const*, mem_block_info_t**, mem_block_info_t*, dict_field_t const*, THD*, TABLE*, dict_table_t const*, upd_t*, dict_foreign_t*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:22321
 
    #6 0x559f3b41b495 in row_upd_store_v_row(upd_node_t*, upd_t const*, THD*, TABLE*) /data/src/10.2/storage/innobase/row/row0upd.cc:2159
 
    #7 0x559f3b41ba39 in row_upd_store_row(upd_node_t*, THD*, TABLE*) /data/src/10.2/storage/innobase/row/row0upd.cc:2220
 
    #8 0x559f3b41f843 in row_upd_del_mark_clust_rec /data/src/10.2/storage/innobase/row/row0upd.cc:2960
 
    #9 0x559f3b4206d4 in row_upd_clust_step /data/src/10.2/storage/innobase/row/row0upd.cc:3144
 
    #10 0x559f3b42118b in row_upd /data/src/10.2/storage/innobase/row/row0upd.cc:3261
 
    #11 0x559f3b421ead in row_upd_step(que_thr_t*) /data/src/10.2/storage/innobase/row/row0upd.cc:3407
 
    #12 0x559f3b377436 in row_update_for_mysql(row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:1927
 
    #13 0x559f3b119109 in ha_innobase::delete_row(unsigned char const*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9488
 
    #14 0x559f3a993420 in handler::ha_delete_row(unsigned char const*) /data/src/10.2/sql/handler.cc:6061
 
    #15 0x559f3a33c2a0 in write_record(THD*, TABLE*, st_copy_info*) /data/src/10.2/sql/sql_insert.cc:1892
 
    #16 0x559f3a34aa3d in select_insert::send_data(List<Item>&) /data/src/10.2/sql/sql_insert.cc:3757
 
    #17 0x559f3a4ac1aa in end_send /data/src/10.2/sql/sql_select.cc:19822
 
    #18 0x559f3a4a4ac8 in evaluate_join_record /data/src/10.2/sql/sql_select.cc:18874
 
    #19 0x559f3a4dbd2c in AGGR_OP::end_send() /data/src/10.2/sql/sql_select.cc:26580
 
    #20 0x559f3a4a2812 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18369
 
    #21 0x559f3a4a2f90 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18605
 
    #22 0x559f3a4a1aaf in do_select /data/src/10.2/sql/sql_select.cc:18200
 
    #23 0x559f3a441f78 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3530
 
    #24 0x559f3a43fc0f in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3325
 
    #25 0x559f3a442ff5 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3725
 
    #26 0x559f3a422eca in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:373
 
    #27 0x559f3a399512 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4518
 
    #28 0x559f3a3af1e0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7891
 
    #29 0x559f3a38a69b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1806
 
 
 
Thread T27 created by T0 here:
 
    #0 0x7f3cb14e3bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
 
    #1 0x559f3b0caa51 in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1912
 
    #2 0x559f3a18970f in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1239
 
    #3 0x559f3a19e458 in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6423
 
    #4 0x559f3a19eb5d in create_new_thread /data/src/10.2/sql/mysqld.cc:6493
 
    #5 0x559f3a19fb6e in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6768
 
    #6 0x559f3a19d9a5 in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6042
 
    #7 0x559f3a187c3f in main /data/src/10.2/sql/main.cc:25
 
    #8 0x7f3caf5c82b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.2/storage/innobase/mem/mem0mem.cc:56 mem_heap_dup(mem_block_info_t*, void const*, unsigned long)
 
Shadow bytes around the buggy address:
 
  0x0c6080018040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c6080018050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c6080018060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c6080018070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c6080018080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c6080018090: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c60800180a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c60800180b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c60800180c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c60800180d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c60800180e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Contiguous container OOB:fc
 
  ASan internal:           fe
 
==6536==ABORTING


--source include/have_innodb.inc
 
 
 
CREATE TABLE t1 (
 
  pk INT,
 
  c TEXT,
 
  vc TEXT AS (c) VIRTUAL,
 
  i INT,
 
  PRIMARY KEY(pk),
 
  UNIQUE(i),
 
  INDEX(vc(64))
 
) ENGINE=InnoDB;
 
 
 
INSERT INTO t1 (pk,c,i) VALUES (1,REPEAT('foo ',15000),0);
 
REPLACE INTO t1 (pk,c,i) SELECT pk,c,i FROM t1;
 
 
 
# Cleanup
 
DROP TABLE t1;


==6644==ERROR: AddressSanitizer: heap-use-after-free on address 0x6300000d0488 at pc 0x560b98fd4c4d bp 0x7f15a74bd4f0 sp 0x7f15a74bd4e8
 
READ of size 60000 at 0x6300000d0488 thread T27
 
    #0 0x560b98fd4c4c in mem_heap_dup(mem_block_info_t*, void const*, unsigned long) /data/src/10.2/storage/innobase/mem/mem0mem.cc:56
 
    #1 0x560b990d8c74 in dfield_dup /data/src/10.2/storage/innobase/include/data0data.ic:285
 
    #2 0x560b990df3aa in row_mysql_convert_row_to_innobase /data/src/10.2/storage/innobase/row/row0mysql.cc:676
 
    #3 0x560b990e3848 in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:1450
 
    #4 0x560b98e834c4 in ha_innobase::write_row(unsigned char*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:8595
 
    #5 0x560b987015b0 in handler::ha_write_row(unsigned char*) /data/src/10.2/sql/handler.cc:6001
 
    #6 0x560b980ab486 in write_record(THD*, TABLE*, st_copy_info*) /data/src/10.2/sql/sql_insert.cc:1654
 
    #7 0x560b980b9a3d in select_insert::send_data(List<Item>&) /data/src/10.2/sql/sql_insert.cc:3757
 
    #8 0x560b9821b1aa in end_send /data/src/10.2/sql/sql_select.cc:19822
 
    #9 0x560b98213ac8 in evaluate_join_record /data/src/10.2/sql/sql_select.cc:18874
 
    #10 0x560b9824ad2c in AGGR_OP::end_send() /data/src/10.2/sql/sql_select.cc:26580
 
    #11 0x560b98211812 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18369
 
    #12 0x560b98211f90 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18605
 
    #13 0x560b98210aaf in do_select /data/src/10.2/sql/sql_select.cc:18200
 
    #14 0x560b981b0f78 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3530
 
    #15 0x560b981aec0f in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3325
 
    #16 0x560b981b1ff5 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3725
 
    #17 0x560b98191eca in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:373
 
    #18 0x560b98108512 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4518
 
    #19 0x560b9811e1e0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7891
 
    #20 0x560b980f969b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1806
 
    #21 0x560b980f673f in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1360
 
    #22 0x560b984308d5 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
 
    #23 0x560b984302ea in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
 
    #24 0x560b98e39489 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
 
    #25 0x7f15b7f22493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
    #26 0x7f15b630893e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
 
 
 
0x6300000d0488 is located 136 bytes inside of 60136-byte region [0x6300000d0400,0x6300000deee8)
 
freed by thread T27 here:
 
    #0 0x7f15b818c527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
 
    #1 0x560b98fd6951 in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /data/src/10.2/storage/innobase/mem/mem0mem.cc:440
 
    #2 0x560b9917c38f in mem_heap_free /data/src/10.2/storage/innobase/include/mem0mem.ic:535
 
    #3 0x560b9918a50a in row_upd_store_v_row(upd_node_t*, upd_t const*, THD*, TABLE*) /data/src/10.2/storage/innobase/row/row0upd.cc:2166
 
    #4 0x560b9918aa39 in row_upd_store_row(upd_node_t*, THD*, TABLE*) /data/src/10.2/storage/innobase/row/row0upd.cc:2220
 
    #5 0x560b9918e843 in row_upd_del_mark_clust_rec /data/src/10.2/storage/innobase/row/row0upd.cc:2960
 
    #6 0x560b9918f6d4 in row_upd_clust_step /data/src/10.2/storage/innobase/row/row0upd.cc:3144
 
    #7 0x560b9919018b in row_upd /data/src/10.2/storage/innobase/row/row0upd.cc:3261
 
    #8 0x560b99190ead in row_upd_step(que_thr_t*) /data/src/10.2/storage/innobase/row/row0upd.cc:3407
 
    #9 0x560b990e6436 in row_update_for_mysql(row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:1927
 
    #10 0x560b98e88109 in ha_innobase::delete_row(unsigned char const*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9488
 
    #11 0x560b98702420 in handler::ha_delete_row(unsigned char const*) /data/src/10.2/sql/handler.cc:6061
 
    #12 0x560b980ab2a0 in write_record(THD*, TABLE*, st_copy_info*) /data/src/10.2/sql/sql_insert.cc:1892
 
    #13 0x560b980b9a3d in select_insert::send_data(List<Item>&) /data/src/10.2/sql/sql_insert.cc:3757
 
    #14 0x560b9821b1aa in end_send /data/src/10.2/sql/sql_select.cc:19822
 
    #15 0x560b98213ac8 in evaluate_join_record /data/src/10.2/sql/sql_select.cc:18874
 
    #16 0x560b9824ad2c in AGGR_OP::end_send() /data/src/10.2/sql/sql_select.cc:26580
 
    #17 0x560b98211812 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18369
 
    #18 0x560b98211f90 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18605
 
    #19 0x560b98210aaf in do_select /data/src/10.2/sql/sql_select.cc:18200
 
    #20 0x560b981b0f78 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3530
 
    #21 0x560b981aec0f in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3325
 
    #22 0x560b981b1ff5 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3725
 
    #23 0x560b98191eca in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:373
 
    #24 0x560b98108512 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4518
 
    #25 0x560b9811e1e0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7891
 
    #26 0x560b980f969b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1806
 
    #27 0x560b980f673f in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1360
 
    #28 0x560b984308d5 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
 
    #29 0x560b984302ea in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
 
 
 
previously allocated by thread T27 here:
 
    #0 0x7f15b818c73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
 
    #1 0x560b98fd5fdf in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /data/src/10.2/storage/innobase/mem/mem0mem.cc:296
 
    #2 0x560b98fd66ee in mem_heap_add_block(mem_block_info_t*, unsigned long) /data/src/10.2/storage/innobase/mem/mem0mem.cc:397
 
    #3 0x560b992a2557 in mem_heap_alloc /data/src/10.2/storage/innobase/include/mem0mem.ic:203
 
    #4 0x560b992c8342 in btr_copy_externally_stored_field(unsigned long*, unsigned char const*, page_size_t const&, unsigned long, mem_block_info_t*) /data/src/10.2/storage/innobase/btr/btr0cur.cc:7766
 
    #5 0x560b98ebcd3e in innobase_get_computed_value(dtuple_t const*, dict_v_col_t const*, dict_index_t const*, mem_block_info_t**, mem_block_info_t*, dict_field_t const*, THD*, TABLE*, dict_table_t const*, upd_t*, dict_foreign_t*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:22321
 
    #6 0x560b9918a495 in row_upd_store_v_row(upd_node_t*, upd_t const*, THD*, TABLE*) /data/src/10.2/storage/innobase/row/row0upd.cc:2159
 
    #7 0x560b9918aa39 in row_upd_store_row(upd_node_t*, THD*, TABLE*) /data/src/10.2/storage/innobase/row/row0upd.cc:2220
 
    #8 0x560b9918e843 in row_upd_del_mark_clust_rec /data/src/10.2/storage/innobase/row/row0upd.cc:2960
 
    #9 0x560b9918f6d4 in row_upd_clust_step /data/src/10.2/storage/innobase/row/row0upd.cc:3144
 
    #10 0x560b9919018b in row_upd /data/src/10.2/storage/innobase/row/row0upd.cc:3261
 
    #11 0x560b99190ead in row_upd_step(que_thr_t*) /data/src/10.2/storage/innobase/row/row0upd.cc:3407
 
    #12 0x560b990e6436 in row_update_for_mysql(row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:1927
 
    #13 0x560b98e88109 in ha_innobase::delete_row(unsigned char const*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9488
 
    #14 0x560b98702420 in handler::ha_delete_row(unsigned char const*) /data/src/10.2/sql/handler.cc:6061
 
    #15 0x560b980ab2a0 in write_record(THD*, TABLE*, st_copy_info*) /data/src/10.2/sql/sql_insert.cc:1892
 
    #16 0x560b980b9a3d in select_insert::send_data(List<Item>&) /data/src/10.2/sql/sql_insert.cc:3757
 
    #17 0x560b9821b1aa in end_send /data/src/10.2/sql/sql_select.cc:19822
 
    #18 0x560b98213ac8 in evaluate_join_record /data/src/10.2/sql/sql_select.cc:18874
 
    #19 0x560b9824ad2c in AGGR_OP::end_send() /data/src/10.2/sql/sql_select.cc:26580
 
    #20 0x560b98211812 in sub_select_postjoin_aggr(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18369
 
    #21 0x560b98211f90 in sub_select(JOIN*, st_join_table*, bool) /data/src/10.2/sql/sql_select.cc:18605
 
    #22 0x560b98210aaf in do_select /data/src/10.2/sql/sql_select.cc:18200
 
    #23 0x560b981b0f78 in JOIN::exec_inner() /data/src/10.2/sql/sql_select.cc:3530
 
    #24 0x560b981aec0f in JOIN::exec() /data/src/10.2/sql/sql_select.cc:3325
 
    #25 0x560b981b1ff5 in mysql_select(THD*, TABLE_LIST*, unsigned int, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /data/src/10.2/sql/sql_select.cc:3725
 
    #26 0x560b98191eca in handle_select(THD*, LEX*, select_result*, unsigned long) /data/src/10.2/sql/sql_select.cc:373
 
    #27 0x560b98108512 in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4518
 
    #28 0x560b9811e1e0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7891
 
    #29 0x560b980f969b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1806
 
 
 
Thread T27 created by T0 here:
 
    #0 0x7f15b815bbba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
 
    #1 0x560b98e39a51 in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1912
 
    #2 0x560b97ef870f in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1239
 
    #3 0x560b97f0d458 in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6423
 
    #4 0x560b97f0db5d in create_new_thread /data/src/10.2/sql/mysqld.cc:6493
 
    #5 0x560b97f0eb6e in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6768
 
    #6 0x560b97f0c9a5 in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6042
 
    #7 0x560b97ef6c3f in main /data/src/10.2/sql/main.cc:25
 
    #8 0x7f15b62402b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.2/storage/innobase/mem/mem0mem.cc:56 mem_heap_dup(mem_block_info_t*, void const*, unsigned long)
 
Shadow bytes around the buggy address:
 
  0x0c6080012040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c6080012050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c6080012060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c6080012070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c6080012080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c6080012090: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c60800120a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c60800120b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c60800120c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c60800120d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c60800120e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Contiguous container OOB:fc
 
  ASan internal:           fe
 
==6644==ABORTING


--source include/have_innodb.inc
 
 
 
CREATE TABLE t1 ( 
  pk INT,
 
  c BLOB NOT NULL,
 
  vc BLOB AS (c) VIRTUAL,
 
  i INT,
 
  PRIMARY KEY(pk),
 
  INDEX(vc(64)),
 
  UNIQUE(i)
 
) ENGINE=InnoDB;
 
 
 
INSERT IGNORE INTO t1 (pk,c,i) VALUES (1,REPEAT('foo ',200),0);
 
 
 
SELECT * FROM `t1` INTO OUTFILE 't1.data';
 
LOAD DATA INFILE 't1.data' REPLACE INTO TABLE t1;
 
 
 
# Cleanup
 
DROP TABLE t1;


==9857==ERROR: AddressSanitizer: heap-use-after-free on address 0x6190000e8421 at pc 0x55ee62b73153 bp 0x7f27d71a7f40 sp 0x7f27d71a7f38
 
READ of size 800 at 0x6190000e8421 thread T27
 
    #0 0x55ee62b73152 in dfield_data_is_binary_equal /data/src/10.2/storage/innobase/include/data0data.ic:331
 
    #1 0x55ee62b7c3ab in row_upd_build_difference_binary(dict_index_t*, dtuple_t const*, unsigned char const*, unsigned long const*, bool, trx_t*, mem_block_info_t*, TABLE*) /data/src/10.2/storage/innobase/row/row0upd.cc:1100
 
    #2 0x55ee62a949da in row_ins_clust_index_entry_by_modify /data/src/10.2/storage/innobase/row/row0ins.cc:364
 
    #3 0x55ee62a9e5c3 in row_ins_clust_index_entry_low(unsigned long, unsigned long, dict_index_t*, unsigned long, dtuple_t*, unsigned long, que_thr_t*, bool) /data/src/10.2/storage/innobase/row/row0ins.cc:2688
 
    #4 0x55ee62aa0777 in row_ins_clust_index_entry(dict_index_t*, dtuple_t*, que_thr_t*, unsigned long, bool) /data/src/10.2/storage/innobase/row/row0ins.cc:3202
 
    #5 0x55ee62aa0dc6 in row_ins_index_entry /data/src/10.2/storage/innobase/row/row0ins.cc:3314
 
    #6 0x55ee62aa1805 in row_ins_index_entry_step /data/src/10.2/storage/innobase/row/row0ins.cc:3464
 
    #7 0x55ee62aa20d0 in row_ins /data/src/10.2/storage/innobase/row/row0ins.cc:3606
 
    #8 0x55ee62aa31d1 in row_ins_step(que_thr_t*) /data/src/10.2/storage/innobase/row/row0ins.cc:3843
 
    #9 0x55ee62ad9a11 in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:1469
 
    #10 0x55ee628794c4 in ha_innobase::write_row(unsigned char*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:8595
 
    #11 0x55ee620f75b0 in handler::ha_write_row(unsigned char*) /data/src/10.2/sql/handler.cc:6001
 
    #12 0x55ee61aa1486 in write_record(THD*, TABLE*, st_copy_info*) /data/src/10.2/sql/sql_insert.cc:1654
 
    #13 0x55ee624d8ffe in read_sep_field /data/src/10.2/sql/sql_load.cc:1217
 
    #14 0x55ee624d4e5e in mysql_load(THD*, sql_exchange*, TABLE_LIST*, List<Item>&, List<Item>&, List<Item>&, enum_duplicates, bool, bool) /data/src/10.2/sql/sql_load.cc:612
 
    #15 0x55ee61b0099f in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4809
 
    #16 0x55ee61b141e0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7891
 
    #17 0x55ee61aef69b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1806
 
    #18 0x55ee61aec73f in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1360
 
    #19 0x55ee61e268d5 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
 
    #20 0x55ee61e262ea in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
 
    #21 0x55ee6282f489 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
 
    #22 0x7f27e7c0e493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
    #23 0x7f27e5ff493e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
 
 
 
0x6190000e8421 is located 161 bytes inside of 968-byte region [0x6190000e8380,0x6190000e8748)
 
freed by thread T27 here:
 
    #0 0x7f27e7e78527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
 
    #1 0x55ee629cc951 in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /data/src/10.2/storage/innobase/mem/mem0mem.cc:440
 
    #2 0x55ee62b71f96 in mem_heap_free_heap_top /data/src/10.2/storage/innobase/include/mem0mem.ic:272
 
    #3 0x55ee62b720bd in mem_heap_empty /data/src/10.2/storage/innobase/include/mem0mem.ic:303
 
    #4 0x55ee62b86787 in row_upd /data/src/10.2/storage/innobase/row/row0upd.cc:3310
 
    #5 0x55ee62b86ead in row_upd_step(que_thr_t*) /data/src/10.2/storage/innobase/row/row0upd.cc:3407
 
    #6 0x55ee62adc436 in row_update_for_mysql(row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:1927
 
    #7 0x55ee6287e109 in ha_innobase::delete_row(unsigned char const*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9488
 
    #8 0x55ee620f8420 in handler::ha_delete_row(unsigned char const*) /data/src/10.2/sql/handler.cc:6061
 
    #9 0x55ee61aa12a0 in write_record(THD*, TABLE*, st_copy_info*) /data/src/10.2/sql/sql_insert.cc:1892
 
    #10 0x55ee624d8ffe in read_sep_field /data/src/10.2/sql/sql_load.cc:1217
 
    #11 0x55ee624d4e5e in mysql_load(THD*, sql_exchange*, TABLE_LIST*, List<Item>&, List<Item>&, List<Item>&, enum_duplicates, bool, bool) /data/src/10.2/sql/sql_load.cc:612
 
    #12 0x55ee61b0099f in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4809
 
    #13 0x55ee61b141e0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7891
 
    #14 0x55ee61aef69b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1806
 
    #15 0x55ee61aec73f in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1360
 
    #16 0x55ee61e268d5 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
 
    #17 0x55ee61e262ea in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
 
    #18 0x55ee6282f489 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
 
    #19 0x7f27e7c0e493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
 
 
previously allocated by thread T27 here:
 
    #0 0x7f27e7e7873f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
 
    #1 0x55ee629cbfdf in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /data/src/10.2/storage/innobase/mem/mem0mem.cc:296
 
    #2 0x55ee629cc6ee in mem_heap_add_block(mem_block_info_t*, unsigned long) /data/src/10.2/storage/innobase/mem/mem0mem.cc:397
 
    #3 0x55ee62b1c4af in mem_heap_alloc /data/src/10.2/storage/innobase/include/mem0mem.ic:203
 
    #4 0x55ee62b24827 in row_build_low /data/src/10.2/storage/innobase/row/row0row.cc:425
 
    #5 0x55ee62b2526f in row_build(unsigned long, dict_index_t const*, unsigned char const*, unsigned long const*, dict_table_t const*, dtuple_t const*, unsigned long const*, row_ext_t**, mem_block_info_t*) /data/src/10.2/storage/innobase/row/row0row.cc:604
 
    #6 0x55ee62b8091e in row_upd_store_row(upd_node_t*, THD*, TABLE*) /data/src/10.2/storage/innobase/row/row0upd.cc:2216
 
    #7 0x55ee62b84843 in row_upd_del_mark_clust_rec /data/src/10.2/storage/innobase/row/row0upd.cc:2960
 
    #8 0x55ee62b856d4 in row_upd_clust_step /data/src/10.2/storage/innobase/row/row0upd.cc:3144
 
    #9 0x55ee62b8618b in row_upd /data/src/10.2/storage/innobase/row/row0upd.cc:3261
 
    #10 0x55ee62b86ead in row_upd_step(que_thr_t*) /data/src/10.2/storage/innobase/row/row0upd.cc:3407
 
    #11 0x55ee62adc436 in row_update_for_mysql(row_prebuilt_t*) /data/src/10.2/storage/innobase/row/row0mysql.cc:1927
 
    #12 0x55ee6287e109 in ha_innobase::delete_row(unsigned char const*) /data/src/10.2/storage/innobase/handler/ha_innodb.cc:9488
 
    #13 0x55ee620f8420 in handler::ha_delete_row(unsigned char const*) /data/src/10.2/sql/handler.cc:6061
 
    #14 0x55ee61aa12a0 in write_record(THD*, TABLE*, st_copy_info*) /data/src/10.2/sql/sql_insert.cc:1892
 
    #15 0x55ee624d8ffe in read_sep_field /data/src/10.2/sql/sql_load.cc:1217
 
    #16 0x55ee624d4e5e in mysql_load(THD*, sql_exchange*, TABLE_LIST*, List<Item>&, List<Item>&, List<Item>&, enum_duplicates, bool, bool) /data/src/10.2/sql/sql_load.cc:612
 
    #17 0x55ee61b0099f in mysql_execute_command(THD*) /data/src/10.2/sql/sql_parse.cc:4809
 
    #18 0x55ee61b141e0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.2/sql/sql_parse.cc:7891
 
    #19 0x55ee61aef69b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.2/sql/sql_parse.cc:1806
 
    #20 0x55ee61aec73f in do_command(THD*) /data/src/10.2/sql/sql_parse.cc:1360
 
    #21 0x55ee61e268d5 in do_handle_one_connection(CONNECT*) /data/src/10.2/sql/sql_connect.cc:1335
 
    #22 0x55ee61e262ea in handle_one_connection /data/src/10.2/sql/sql_connect.cc:1241
 
    #23 0x55ee6282f489 in pfs_spawn_thread /data/src/10.2/storage/perfschema/pfs.cc:1862
 
    #24 0x7f27e7c0e493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
 
 
Thread T27 created by T0 here:
 
    #0 0x7f27e7e47bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
 
    #1 0x55ee6282fa51 in spawn_thread_v1 /data/src/10.2/storage/perfschema/pfs.cc:1912
 
    #2 0x55ee618ee70f in inline_mysql_thread_create /data/src/10.2/include/mysql/psi/mysql_thread.h:1239
 
    #3 0x55ee61903458 in create_thread_to_handle_connection(CONNECT*) /data/src/10.2/sql/mysqld.cc:6423
 
    #4 0x55ee61903b5d in create_new_thread /data/src/10.2/sql/mysqld.cc:6493
 
    #5 0x55ee61904b6e in handle_connections_sockets() /data/src/10.2/sql/mysqld.cc:6768
 
    #6 0x55ee619029a5 in mysqld_main(int, char**) /data/src/10.2/sql/mysqld.cc:6042
 
    #7 0x55ee618ecc3f in main /data/src/10.2/sql/main.cc:25
 
    #8 0x7f27e5f2c2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.2/storage/innobase/include/data0data.ic:331 dfield_data_is_binary_equal
 
Shadow bytes around the buggy address:
 
  0x0c3280015030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c3280015040: 00 00 00 04 fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3280015050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3280015060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3280015070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c3280015080: fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3280015090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c32800150a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c32800150b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c32800150c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c32800150d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Contiguous container OOB:fc
 
  ASan internal:           fe
 
==9857==ABORTING



 Comments   
Comment by Elena Stepanova [ 2018-02-01 ]

See also MDEV-14134, might be the same or related.

Comment by Marko Mäkelä [ 2018-02-19 ]

I think that I saw something similar when running

ASAN_OPTIONS=abort_on_error=1,disable_coredump=0 ./mtr --suite=innodb_gis --big-test

quite some time ago. Thank you for the simple test case!

Comment by Thirunarayanan Balathandayuthapani [ 2018-02-19 ]

Analysis:

Test case:

 
 
CREATE TABLE t1 (
 
pk INT,
 
c TEXT,
 
vc LONGTEXT AS (c) VIRTUAL,
 
i INT,
 
PRIMARY KEY(pk),
 
UNIQUE(i),
 
INDEX(vc(64))
 
) ENGINE=InnoDB;
 
INSERT INTO t1 (pk,c,i) VALUES (1,REPEAT('foo ',15000),0);
 
REPLACE INTO t1 (pk,c,i) SELECT pk,c,i FROM t1;

Replace statement tries to insert the value and it fails with duplicate key. After that, it tries to delete the value which was found.

During delete operation, InnoDB tries to get virtual column value using innobase_get_computed_value().
To calculate the virtual column value, InnoDB fetches the base column (in this case, c) and converts the innnodb
row to mysql row format and stores it in table->record[0] 

       mysql_rec = mysql_table->record[0];
 
        ......
 
        data = btr_copy_externally_stored_field(
 
                                &len, data, page_size,
 
                                dfield_get_len(row_field), *local_heap);
 
 
 
     ......
 
     row_sel_field_store_in_mysql_format(
 
              mysql_rec + templ->mysql_col_offset,
 
             templ, index, templ->clust_rec_field_no,
 
              (const byte*)data, len);

During conversion, we store reference for blob.

      case DATA_BLOB:
 
                /* Store a pointer to the BLOB buffer to dest: the BLOB was
 
                already copied to the buffer in row_sel_store_mysql_rec */
 
 
 
                row_mysql_store_blob_ref(dest, templ->mysql_col_len, data,
 
                                         len);
 
                break;

To fetch base column, InnoDB used local heap. So it frees local heap as a part of delete operation.

Once delete operation is done, Insert operation tries to insert the row. But write_row() is being called with
table->records[0] as parameter. Whenever there is a situation to access blob column of table->records[0] record.
ASAN will give heap-use-after-free error.

Comment by Elena Stepanova [ 2018-04-20 ]

Variations that I'm getting on slightly different but very similar test cases:

10.3 d71a8855ee

 
==5113==ERROR: AddressSanitizer: heap-use-after-free on address 0x61700006d3b5 at pc 0x55d0fe6bc87b bp 0x7f4d04adc930 sp 0x7f4d04adc928
 
READ of size 77 at 0x61700006d3b5 thread T27
 
    #0 0x55d0fe6bc87a in rec_convert_dtuple_to_rec_comp /data/src/10.3/storage/innobase/rem/rem0rec.cc:1595
 
    #1 0x55d0fe6bcd3c in rec_convert_dtuple_to_rec_new /data/src/10.3/storage/innobase/rem/rem0rec.cc:1632
 
    #2 0x55d0fe6bcf8b in rec_convert_dtuple_to_rec(unsigned char*, dict_index_t const*, dtuple_t const*, unsigned long) /data/src/10.3/storage/innobase/rem/rem0rec.cc:1660
 
    #3 0x55d0fe9191f2 in page_cur_tuple_insert /data/src/10.3/storage/innobase/include/page0cur.ic:281
 
    #4 0x55d0fe92b7fd in btr_cur_optimistic_insert(unsigned long, btr_cur_t*, unsigned long**, mem_block_info_t**, dtuple_t*, unsigned char**, big_rec_t**, unsigned long, que_thr_t*, mtr_t*) /data/src/10.3/storage/innobase/btr/btr0cur.cc:3269
 
    #5 0x55d0fe704896 in row_ins_clust_index_entry_low(unsigned long, unsigned long, dict_index_t*, unsigned long, dtuple_t*, unsigned long, que_thr_t*, bool) /data/src/10.3/storage/innobase/row/row0ins.cc:2747
 
    #6 0x55d0fe706aaf in row_ins_clust_index_entry(dict_index_t*, dtuple_t*, que_thr_t*, unsigned long, bool) /data/src/10.3/storage/innobase/row/row0ins.cc:3251
 
    #7 0x55d0fe707368 in row_ins_index_entry /data/src/10.3/storage/innobase/row/row0ins.cc:3376
 
    #8 0x55d0fe707e78 in row_ins_index_entry_step /data/src/10.3/storage/innobase/row/row0ins.cc:3526
 
    #9 0x55d0fe708792 in row_ins /data/src/10.3/storage/innobase/row/row0ins.cc:3668
 
    #10 0x55d0fe709d9e in row_ins_step(que_thr_t*) /data/src/10.3/storage/innobase/row/row0ins.cc:3923
 
    #11 0x55d0fe745d8e in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*, ins_mode_t) /data/src/10.3/storage/innobase/row/row0mysql.cc:1452
 
    #12 0x55d0fe4b71b5 in ha_innobase::write_row(unsigned char*) /data/src/10.3/storage/innobase/handler/ha_innodb.cc:8063
 
    #13 0x55d0fdd19dd3 in handler::ha_write_row(unsigned char*) /data/src/10.3/sql/handler.cc:6197
 
    #14 0x55d0fd586b3c in write_record(THD*, TABLE*, st_copy_info*) /data/src/10.3/sql/sql_insert.cc:1695
 
    #15 0x55d0fd5efcea in read_sep_field /data/src/10.3/sql/sql_load.cc:1154
 
    #16 0x55d0fd5ec6e7 in mysql_load(THD*, sql_exchange const*, TABLE_LIST*, List<Item>&, List<Item>&, List<Item>&, enum_duplicates, bool, bool) /data/src/10.3/sql/sql_load.cc:662
 
    #17 0x55d0fd616ceb in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:5124
 
    #18 0x55d0fd628e22 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8001
 
    #19 0x55d0fd6036c8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1846
 
    #20 0x55d0fd60075f in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1391
 
    #21 0x55d0fd96918a in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
 
    #22 0x55d0fd968b9f in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #23 0x55d0fe46cd8d in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
 
    #24 0x7f4d10403493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
    #25 0x7f4d0e7e993e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)


READ of size 16330 at 0x62a0000ae288 thread T27
 
    #0 0x556c3f2c96f5 in mlog_write_string(unsigned char*, unsigned char const*, unsigned long, mtr_t*) /data/src/10.3/storage/innobase/mtr/mtr0log.cc:317
 
    #1 0x556c3f5e55b0 in btr_store_big_rec_extern_fields(btr_pcur_t*, unsigned long*, big_rec_t const*, mtr_t*, blob_op) /data/src/10.3/storage/innobase/btr/btr0cur.cc:7479
 
    #2 0x556c3f3ab61e in row_ins_index_entry_big_rec /data/src/10.3/storage/innobase/row/row0ins.cc:2509
 
    #3 0x556c3f3aca89 in row_ins_clust_index_entry_low(unsigned long, unsigned long, dict_index_t*, unsigned long, dtuple_t*, unsigned long, que_thr_t*, bool) /data/src/10.3/storage/innobase/row/ro
 
w0ins.cc:2786
 
    #4 0x556c3f3aeaaf in row_ins_clust_index_entry(dict_index_t*, dtuple_t*, que_thr_t*, unsigned long, bool) /data/src/10.3/storage/innobase/row/row0ins.cc:3251
 
    #5 0x556c3f3af368 in row_ins_index_entry /data/src/10.3/storage/innobase/row/row0ins.cc:3376
 
    #6 0x556c3f3afe78 in row_ins_index_entry_step /data/src/10.3/storage/innobase/row/row0ins.cc:3526
 
    #7 0x556c3f3b0792 in row_ins /data/src/10.3/storage/innobase/row/row0ins.cc:3668
 
    #8 0x556c3f3b1d9e in row_ins_step(que_thr_t*) /data/src/10.3/storage/innobase/row/row0ins.cc:3923
 
    #9 0x556c3f3edd8e in row_insert_for_mysql(unsigned char const*, row_prebuilt_t*, ins_mode_t) /data/src/10.3/storage/innobase/row/row0mysql.cc:1452
 
    #10 0x556c3f15f1b5 in ha_innobase::write_row(unsigned char*) /data/src/10.3/storage/innobase/handler/ha_innodb.cc:8063
 
    #11 0x556c3e9c1dd3 in handler::ha_write_row(unsigned char*) /data/src/10.3/sql/handler.cc:6197
 
    #12 0x556c3e22eb3c in write_record(THD*, TABLE*, st_copy_info*) /data/src/10.3/sql/sql_insert.cc:1695
 
    #13 0x556c3e297cea in read_sep_field /data/src/10.3/sql/sql_load.cc:1154
 
    #14 0x556c3e2946e7 in mysql_load(THD*, sql_exchange const*, TABLE_LIST*, List<Item>&, List<Item>&, List<Item>&, enum_duplicates, bool, bool) /data/src/10.3/sql/sql_load.cc:662
 
    #15 0x556c3e2beceb in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:5124
 
    #16 0x556c3e2d0e22 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8001
 
    #17 0x556c3e2ab6c8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1846
 
    #18 0x556c3e2a875f in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1391
 
    #19 0x556c3e61118a in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
 
    #20 0x556c3e610b9f in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #21 0x556c3f114d8d in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
 
    #22 0x7f4f4a94d493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
    #23 0x7f4f48d3393e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)

Comment by Thirunarayanan Balathandayuthapani [ 2018-05-08 ]

https://github.com/mysql/mysql-server/commit/f84ffaf8ea85b488cc8d39a1c542d5380b1bdaff

The above commit solves the issue in mysql-5.7

Comment by Michael Widenius [ 2018-06-05 ]

Here is a description of what happens in case of
REPLACE INTO t1 (pk,c,i) SELECT pk,c,i FROM t1;

Inside innodb this will be seen as:

ha_write_row(table->record[0])) (fails)
ha_index_read_idx_map(table->record[1]) trough primary key
ha_delete_row(table->record[1])
ha_write_row(table->record[0]))

The bug happens in ha_delete_row() when it tries to calculate index vc(64).

The calculation happens in innobase_get_computed_value() which has several
problems:

  • It's always doing all calcuations in record[0]
  • It updates all fields in record[0] used by the virtual column
  • It updates the virtual column inside record[0]
  • Data for blobs are stored in an internal InnoDB heap, allocated
    by innobase_get_computed_value() and freed after the operation
    (for delete that is as part of the ha_delete_row() call).

The end result is:

  • Data in record[0] is destroyed.
  • record points in blob 'c' are pointing to the innodb heap that is
    released.
  • The last ha_write_row() will access free data and either give wrong
    result, warning with asan/valgrind or crash.

This same problem can probably also been seen in this scenario:

Thread 1: DELETE from t1 where pk=1

  • This marks the row as deleted
    Thread 2: UPDATE t1 SET pk=1 FROM t1 WHERE pk=2
  • If this is run before the purge the row, this thread
    has to create an undo record of the original deleted pk=1 row.
    During the undo, innobase_get_computed_value() will be called to
    re-create c and vc for the undo log record (as vc is part of the index)
    and it will destory the values in record[0].

Something like the following should show the issue
(One probably needs to check in the debugger what happens,
as the current code may not notice that record[0] is overwritten)

--source include/have_innodb.inc
--source include/have_log_bin.inc
SET binlog_format= row;

CREATE TABLE t1 (
pk INT,
c TEXT,
vc LONGTEXT AS (c) VIRTUAL,
i INT,
PRIMARY KEY(pk),
UNIQUE,
INDEX(vc(64))
) ENGINE=InnoDB;

INSERT INTO t1 (pk,c,i) VALUES (1,REPEAT('foo ',15000),10);
INSERT INTO t1 (pk,c,i) VALUES (2,REPEAT('bar ',15000),11);

--connect (c1,localhost,root,,)
--connection c1
begin;
DELETE from t1 WHERE pk=1;
--connection default
--send update t1 set pk=1 where pk=2
--connection c1
commit;
--connection default
--reap;
select pk, left(c, 10), length(c), i from t1;
drop table t1;

Comment by Marko Mäkelä [ 2018-06-05 ]

Thank you for the update. I have some remarks, not conflicting with your findings:

  • Purge can be prevented by creating a read view, and resumed by closing the read view. The easiest way is to issue START TRANSACTION WITH CONSISTENT SNAPSHOT in a dedicated connection, like the tests innodb.dml_purge (10.3) and gcol.gcol_update do it.
  • To catch unwanted writes to TABLE::record, maybe we could poison the addresses (MEM_NOACCESS) and unpoison right before writes are allowed again. Unfortunately, the poisoning/unpoisoning will discard the Valgrind V bits (indicating which bits are initialized). I used this technique in the transaction Pool poisoning patch, which caught MDEV-16136. Maybe we should restrict this poison/unpoison to ASAN only (not Valgrind), or for Valgrind we should allocate a separate TABLE::record_vbits buffer for copying and restoring the V bits with VALGRIND_GET_VBITS and VALGRIND_SET_VBITS.
  • The InnoDB interface for evaluating indexed virtual columns is poorly designed. Last time I looked, we evaluated the columns one index at a time. If there are multiple indexes on virtual columns that partly depend on the same base columns, we would convert the base column values multiple times. It would be better to compute all virtual columns at once, and store the result in a InnoDB 'table row' tuple, from where they would be copied to the secondary index tuples by row_build_index_entry(). Storing the virtual column value in a separate array attached to the 'clustered index tuple' (dtuple_t::v_fields) is an ugly hack.
  • I think that it was a mistake to omit virtual columns from dict_table_t::cols[]. I would merge dict_table_t::v_cols[] into dict_table_t::cols[] so that we can have a 1:1 mapping between TABLE::field and dict_table_t::cols[} (with any InnoDB-internal hidden columns at the end). However, this is probably too risky for GA releases.
Comment by Michael Widenius [ 2018-06-17 ]

Fixed by using a record on the heap for innobase_get_computed_value()

Pushed into bb-10.3-monty for testing and review

Comment by Marko Mäkelä [ 2018-06-18 ]

Looks OK; I only had some minor comments.

Comment by Michael Widenius [ 2018-06-19 ]

Pushed into 10.2 tree

Generated at Thu Feb 08 08:18:47 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.