[MDEV-16123] ASAN heap-use-after-free handler::ha_index_or_rnd_end Created: 2018-05-09  Updated: 2018-05-24  Resolved: 2018-05-23

Status: Closed
Project: MariaDB Server
Component/s: Data Definition - Alter Table
Affects Version/s: 10.0, 10.1, 10.3.6, 10.2
Fix Version/s: 10.0.36, 10.1.34, 10.2.16, 10.3.8

Type: Bug Priority: Major
Reporter: Matthias Leich Assignee: Michael Widenius
Resolution: Fixed Votes: 0
Labels: None
Environment:

Ubuntu 17.04 but I assume this is not important.


 Description   

Source 10.3 commit 005d53f6d59fe8e1e118c63b9af57fea2a31f4f2.
The build with ASAN claims to be a 10.3.6-MariaDB-debug-log.
RQG test (sorry the call was generated by a tool and looks ugly)

runall-new.pl --grammar=conf/mariadb/oltp-transactional.yy --gendata=conf/mariadb/oltp.zz --no-mask --queries=10M --duration=350 --threads=2 --threads=4 --threads=8 --threads=16 --threads=32 --seed=1 --seed=3 --seed=6 --seed=12 --seed=24 --views --validators=none --redefine=conf/mariadb/general-workarounds.yy --redefine=conf/mariadb/alter_table.yy --redefine=conf/mariadb/bulk_insert.yy --redefine=conf/mariadb/xa.yy --redefine=conf/mariadb/versioning.yy --redefine=conf/mariadb/sequences.yy --mysqld=--log_output=FILE --mysqld=--log-bin --mysqld=--log_bin_trust_function_creators=1 --mysqld=--loose-max-statement-time=30 --mysqld=--loose-debug_assert_on_not_freed_memory=0 --reporters=Backtrace,ErrorLog,Deadlock --engine=InnoDB --mysqld=--innodb-buffer-pool-size=256M --mysqld=--innodb_use_native_aio=0 --mtr-build-thread=318 ....


=306592==ERROR: AddressSanitizer: heap-use-after-free on address 0x61c00011aa38 at pc 0x560b2282e75f bp 0x7fb7e83ad4a0 sp 0x7fb7e83ad490
 
READ of size 4 at 0x61c00011aa38 thread T42
 
    #0 0x560b2282e75e in handler::ha_index_or_rnd_end() /work_m/MariaDB/sql/handler.h:3082
 
    #1 0x560b22a95c54 in Stat_table_write_iter::cleanup() (/mnt/r0/mleich/MariaDB/bld_asan/sql/mysqld+0x11a5c54)
 
    #2 0x560b22a95c8f in Stat_table_write_iter::~Stat_table_write_iter() (/mnt/r0/mleich/MariaDB/bld_asan/sql/mysqld+0x11a5c8f)
 
    #3 0x560b22a8bd3d in rename_table_in_stat_tables(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*) /work_m/MariaDB/sql/sql_statistics.cc:3543
 
    #4 0x560b22928954 in do_rename /work_m/MariaDB/sql/sql_rename.cc:300
 
    #5 0x560b22928fee in rename_tables /work_m/MariaDB/sql/sql_rename.cc:388
 
    #6 0x560b22927d68 in mysql_rename_tables(THD*, TABLE_LIST*, bool) /work_m/MariaDB/sql/sql_rename.cc:155
 
    #7 0x560b228c3e96 in mysql_execute_command(THD*) /work_m/MariaDB/sql/sql_parse.cc:4448
 
    #8 0x560b228dac41 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /work_m/MariaDB/sql/sql_parse.cc:8013
 
    #9 0x560b228b59a5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /work_m/MariaDB/sql/sql_parse.cc:1842
 
    #10 0x560b228b2a0a in do_command(THD*) /work_m/MariaDB/sql/sql_parse.cc:1386
 
    #11 0x560b22c0d73f in do_handle_one_connection(CONNECT*) /work_m/MariaDB/sql/sql_connect.cc:1402
 
    #12 0x560b22c0d124 in handle_one_connection /work_m/MariaDB/sql/sql_connect.cc:1308
 
    #13 0x7fb81efba6d9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76d9)
 
    #14 0x7fb81e44cd7e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x108d7e)

Please change the priority if requited.

 Comments   
Comment by Matthias Leich [ 2018-05-09 ]

Hi Sanja. Please show up in case you want to make experiments with whatever patches.
The problem replays usually in a few minutes in my RQG environment.

Comment by Elena Stepanova [ 2018-05-09 ]

It appears to be the same as MDEV-13828 (see my last comment in there, of 2017-12-25).

Comment by Oleksandr Byelkin [ 2018-05-09 ]

I can not say something with no test suite.

Comment by Matthias Leich [ 2018-05-09 ]

I assume that Elena is right that my Bug is https://jira.mariadb.org/browse/MDEV-13828.
The MTR testcase mentioned there
CREATE TABLE t1 (i int);
--connect (con1,localhost,root,,test)
--send
RENAME TABLE t1 TO t2;
--connection default
FLUSH TABLES;
--connection con1
--reap
--disconnect con1
--connection default
DROP TABLE IF EXISTS t1, t2;
reproduces the problem (ASAN output + stacktrace).

Comment by Matthias Leich [ 2018-05-09 ]

Regarding the replay test based on RQG.
The environment used by me gets created by:
git clone https://github.com/mleich1/rqg RQG_mleich1 # IMHO it is quite unlikely that my version of RQG
cd RQG_mleich1 # (fork of Elena's RQG) has an impact on the test
git checkout experimental

  1. IMHO it is quite unlikely that my version of RQG (fork of Elena's RQG) has an impact on the test outcome.
  2. In case Elena's RQG is used than please pick also the branch 'experimental'.
    Compile MariaDB with "-DWITH_ASAN:BOOL=ON".
    export ASAN_OPTIONS=abort_on_error=1 # Abort but no core file
    ... start the test ...
Comment by Oleksandr Byelkin [ 2018-05-17 ]

Bug which mentioned as duplicate is for 10.0 and up

Comment by Michael Widenius [ 2018-05-23 ]

With 10.3, easiest to use BUILD/compile-pentium64-asan-max to build.

Anyway, I was able to reproduce the bug with ASAN and now working on it

Comment by Michael Widenius [ 2018-05-23 ]

Bug was that there where code in destructor that used files that where closed earlier.
Fixed by removing all code from the destructor

Comment by Michael Widenius [ 2018-05-23 ]

Problem was that destructor called methods for closed table.
Fixed by removing code in destructor.

Generated at Thu Feb 08 08:26:33 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.