[MDEV-16826] [draft]different crashes Created: 2018-07-25  Updated: 2020-07-20

Status: Open
Project: MariaDB Server
Component/s: None
Affects Version/s: 10.3
Fix Version/s: None

Type: Bug Priority: Major
Reporter: Alice Sherepa Assignee: Alice Sherepa
Resolution: Unresolved Votes: 0
Labels: None

Attachments: File 12_12_18.7z    
Issue Links:
Relates
relates to MDEV-23222 MDEV-23222 SIGSEG in maria_create() b... Closed

 Description   

10.4 8cf7e3459d7309ce122824146260c4aecfa6ca77

=================================================================
 
==16360==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000165dd8 at pc 0x560cdd689c16 bp 0x7f3a43ed3ac0 sp 0x7f3a43ed3ab0
 
READ of size 4 at 0x615000165dd8 thread T32
 
    #0 0x560cdd689c15 in sf_malloc_usable_size /git/10.4/mysys/safemalloc.c:215
 
    #1 0x560cdd65bedf in my_free /git/10.4/mysys/my_malloc.c:212
 
    #2 0x560cdca9d80c in maria_create /git/10.4/storage/maria/ma_create.c:1275
 
    #3 0x560cdcabae7f in ha_maria::create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/storage/maria/ha_maria.cc:3227
 
    #4 0x560cdc5d2899 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/sql/handler.cc:4630
 
    #5 0x560cdc5d56b8 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /git/10.4/sql/handler.cc:5004
 
    #6 0x560cdc195c9b in rea_create_table(THD*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, HA_CREATE_INFO*, handler*, bool) /git/10.4/sql/unireg.cc:514
 
    #7 0x560cdc0b5693 in create_table_impl /git/10.4/sql/sql_table.cc:4952
 
    #8 0x560cdc0b6190 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /git/10.4/sql/sql_table.cc:5074
 
    #9 0x560cdc0b6bb5 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /git/10.4/sql/sql_table.cc:5163
 
    #10 0x560cdbebc792 in mysql_execute_command(THD*) /git/10.4/sql/sql_parse.cc:4282
 
    #11 0x560cdbed4443 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.4/sql/sql_parse.cc:8103
 
    #12 0x560cdbeaf265 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.4/sql/sql_parse.cc:1850
 
    #13 0x560cdbeac3fd in do_command(THD*) /git/10.4/sql/sql_parse.cc:1395
 
    #14 0x560cdc2034da in do_handle_one_connection(CONNECT*) /git/10.4/sql/sql_connect.cc:1402
 
    #15 0x560cdc202eb7 in handle_one_connection /git/10.4/sql/sql_connect.cc:1308
 
    #16 0x7f3a72f466b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
 
    #17 0x7f3a723db41c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)
 
 
 
0x615000165dd8 is located 88 bytes inside of 500-byte region [0x615000165d80,0x615000165f74)
 
freed by thread T32 here:
 
    #0 0x7f3a741a52ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
 
    #1 0x560cdd68a494 in free_memory /git/10.4/mysys/safemalloc.c:279
 
    #2 0x560cdd689b1e in sf_free /git/10.4/mysys/safemalloc.c:197
 
    #3 0x560cdd65bf15 in my_free /git/10.4/mysys/my_malloc.c:221
 
    #4 0x560cdca9cffd in maria_create /git/10.4/storage/maria/ma_create.c:1171
 
    #5 0x560cdcabae7f in ha_maria::create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/storage/maria/ha_maria.cc:3227
 
    #6 0x560cdc5d2899 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/sql/handler.cc:4630
 
    #7 0x560cdc5d56b8 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /git/10.4/sql/handler.cc:5004
 
    #8 0x560cdc195c9b in rea_create_table(THD*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, HA_CREATE_INFO*, handler*, bool) /git/10.4/sql/unireg.cc:514
 
    #9 0x560cdc0b5693 in create_table_impl /git/10.4/sql/sql_table.cc:4952
 
    #10 0x560cdc0b6190 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /git/10.4/sql/sql_table.cc:5074
 
    #11 0x560cdc0b6bb5 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /git/10.4/sql/sql_table.cc:5163
 
    #12 0x560cdbebc792 in mysql_execute_command(THD*) /git/10.4/sql/sql_parse.cc:4282
 
    #13 0x560cdbed4443 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.4/sql/sql_parse.cc:8103
 
    #14 0x560cdbeaf265 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.4/sql/sql_parse.cc:1850
 
    #15 0x560cdbeac3fd in do_command(THD*) /git/10.4/sql/sql_parse.cc:1395
 
    #16 0x560cdc2034da in do_handle_one_connection(CONNECT*) /git/10.4/sql/sql_connect.cc:1402
 
    #17 0x560cdc202eb7 in handle_one_connection /git/10.4/sql/sql_connect.cc:1308
 
    #18 0x7f3a72f466b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
 
 
 
previously allocated by thread T32 here:
 
    #0 0x7f3a741a5602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
 
    #1 0x560cdd6894ef in sf_malloc /git/10.4/mysys/safemalloc.c:118
 
    #2 0x560cdd65b692 in my_malloc /git/10.4/mysys/my_malloc.c:101
 
    #3 0x560cdca9cb9b in maria_create /git/10.4/storage/maria/ma_create.c:1091
 
    #4 0x560cdcabae7f in ha_maria::create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/storage/maria/ha_maria.cc:3227
 
    #5 0x560cdc5d2899 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /git/10.4/sql/handler.cc:4630
 
    #6 0x560cdc5d56b8 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /git/10.4/sql/handler.cc:5004
 
    #7 0x560cdc195c9b in rea_create_table(THD*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, HA_CREATE_INFO*, handler*, bool) /git/10.4/sql/unireg.cc:514
 
    #8 0x560cdc0b5693 in create_table_impl /git/10.4/sql/sql_table.cc:4952
 
    #9 0x560cdc0b6190 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /git/10.4/sql/sql_table.cc:5074
 
    #10 0x560cdc0b6bb5 in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /git/10.4/sql/sql_table.cc:5163
 
    #11 0x560cdbebc792 in mysql_execute_command(THD*) /git/10.4/sql/sql_parse.cc:4282
 
    #12 0x560cdbed4443 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /git/10.4/sql/sql_parse.cc:8103
 
    #13 0x560cdbeaf265 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /git/10.4/sql/sql_parse.cc:1850
 
    #14 0x560cdbeac3fd in do_command(THD*) /git/10.4/sql/sql_parse.cc:1395
 
    #15 0x560cdc2034da in do_handle_one_connection(CONNECT*) /git/10.4/sql/sql_connect.cc:1402
 
    #16 0x560cdc202eb7 in handle_one_connection /git/10.4/sql/sql_connect.cc:1308
 
    #17 0x7f3a72f466b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
 
 
 
Thread T32 created by T0 here:
 
    #0 0x7f3a74143253 in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x36253)
 
    #1 0x560cdd6b4c01 in spawn_thread_noop /git/10.4/mysys/psi_noop.c:187
 
    #2 0x560cdbc1fe74 in inline_mysql_thread_create /git/10.4/include/mysql/psi/mysql_thread.h:1268
 
    #3 0x560cdbc3505c in create_thread_to_handle_connection(CONNECT*) /git/10.4/sql/mysqld.cc:6333
 
    #4 0x560cdbc3575c in create_new_thread(CONNECT*) /git/10.4/sql/mysqld.cc:6403
 
    #5 0x560cdbc35ae7 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /git/10.4/sql/mysqld.cc:6520
 
    #6 0x560cdbc36764 in handle_connections_sockets() /git/10.4/sql/mysqld.cc:6685
 
    #7 0x560cdbc3451c in mysqld_main(int, char**) /git/10.4/sql/mysqld.cc:5955
 
    #8 0x560cdbc1e59f in main /git/10.4/sql/main.cc:25
 
    #9 0x7f3a722f482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /git/10.4/mysys/safemalloc.c:215 sf_malloc_usable_size
 
Shadow bytes around the buggy address:
 
  0x0c2a80024b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c2a80024b70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c2a80024b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c2a80024b90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c2a80024ba0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
=>0x0c2a80024bb0: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
 
  0x0c2a80024bc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c2a80024bd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c2a80024be0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
 
  0x0c2a80024bf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c2a80024c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
==16360==ABORTING



 Comments   
Comment by Alice Sherepa [ 2019-02-01 ]

10.4 923415ffdb4ce2ef

 
 [Warning] /10.4/sql/mysqld: Forcing close of thread 22  user: 'rqg'
 
mysqld: /10.4/include/mysql/psi/mysql_socket.h:738: inline_mysql_socket_send: Assertion `mysql_socket.fd != -1' failed.
 
[ERROR] mysqld got signal 6 ;
 
 
 
stdlib/abort.c:91(__GI_abort)[0x7fc5d41f2bd7]
 
assert/assert.c:92(__assert_fail_base)[0x7fc5d41f2c82]
 
/home/alice/git/10.4/sql/mysqld(+0x2a76df7)[0x55d57f05edf7]
 
psi/mysql_socket.h:740(inline_mysql_socket_send)[0x55d57f061057]
 
vio/viosocket.c:296(vio_write)[0x55d57e1befc3]
 
sql/net_serv.cc:681(net_real_write)[0x55d57e1bd96a]
 
sql/net_serv.cc:384(net_flush)[0x55d57d4d98b3]
 
sql/protocol.cc:289(net_send_ok(THD*, unsigned int, unsigned int, unsigned long long, unsigned long long, char const*, bool, bool))[0x55d57d4db393]
 
sql/protocol.cc:632(Protocol::send_ok(unsigned int, unsigned int, unsigned long long, unsigned long long, char const*, bool))[0x55d57d4db128]
 
sql/protocol.cc:600(Protocol::end_statement())[0x55d57d73ce84]
 
sql/sql_parse.cc:2398(dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool))[0x55d57d736ccd]
 
sql/sql_parse.cc:1356(do_command(THD*))[0x55d57da94321]
 
sql/sql_connect.cc:1398(do_handle_one_connection(CONNECT*))[0x55d57da93ceb]
 
/lib/x86_64-linux-gnu/libpthread.so.0(+0x76ba)[0x7fc5d503b6ba]
 
/lib/x86_64-linux-gnu/libc.so.6(clone+0x6d)[0x7fc5d42cc41d]
 
 
 
Query (0x62b000188288): SET STATEMENT system_versioning_alter_history=KEEP FOR ALTER TABLE `E` ADD PARTITION IF NOT EXISTS (PARTITION ver_p6 HISTORY) 


perl ./runall-new.pl --grammar=conf/optimizer/updateable_views.yy --mysqld=--init-file=/home/alice/git/randgen/conf/optimizer/updateable_views.init --no-mask --queries=100M --duration=400 --threads=6 --seed=1548935276 --views --vcols --reporters=Backtrace,ErrorLog,Deadlock --validators=TransformerNoComparator --transformers=ExecuteAsCTE,ExecuteAsDeleteReturning,ExecuteAsExcept,ExecuteAsExecuteImmediate,ExecuteAsInsertSelect,ExecuteAsIntersect,ExecuteAsUnion,ExecuteAsUpdateDelete,ExecuteAsView,ExecuteAsPreparedTwice,ExecuteAsSPTwice --redefine=conf/mariadb/general-workarounds.yy --redefine=conf/mariadb/alter_table.yy --redefine=conf/mariadb/bulk_insert.yy --redefine=conf/mariadb/event.yy --redefine=conf/mariadb/instant_add.yy --redefine=conf/mariadb/sequences.yy --redefine=conf/mariadb/sp.yy --redefine=conf/mariadb/versioning.yy --mysqld=--log_output=FILE --mysqld=--log-bin --mysqld=--log_bin_trust_function_creators=1 --mysqld=--loose-max-statement-time=30 --mysqld=--loose-debug_assert_on_not_freed_memory=0 --mysqld=--lock-wait-timeout=10 --mysqld=--join_cache_level=8 --mysqld=--innodb-lock-wait-timeout=5 --engine=Aria --mysqld=--default-storage-engine=Aria --mtr-build-thread=306 --basedir=/git/10.4 --vardir=/1

Comment by Roel Van de Paar [ 2020-07-20 ]

The crash listed in the main description looks like this one; MDEV-23222

Generated at Thu Feb 08 08:31:51 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.