[MDEV-17626] Draft: ASAN: heap-buffer-overflow storage/innobase/include/dict0dict.ic:272 in dict_index_is_clust Created: 2018-11-06  Updated: 2018-11-08

Status: Open
Project: MariaDB Server
Component/s: Storage Engine - InnoDB
Affects Version/s: 10.2
Fix Version/s: 10.2

Type: Bug Priority: Major
Reporter: Matthias Leich Assignee: Unassigned
Resolution: Unresolved Votes: 0
Labels: None
Environment:

Ubuntu 17.04 but most probably not important


Attachments: File MDEV-17626.tgz    

 Description   

==32134==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x618000101948 at pc 0x558d94d400c4 bp 0x7f7b129c8020 sp 0x7f7b129c8010
READ of size 4 at 0x618000101948 thread T45
    #0 0x558d94d400c3 in dict_index_is_clust storage/innobase/include/dict0dict.ic:272
    #1 0x558d94d411e8 in dict_index_is_online_ddl storage/innobase/include/dict0dict.ic:1329
    #2 0x558d94d68262 in lock_table_locks_lookup storage/innobase/lock/lock0lock.cc:7010
    #3 0x558d94d686f2 in lock_table_has_locks(dict_table_t const*) storage/innobase/lock/lock0lock.cc:7045
    #4 0x558d94edebcf in row_drop_table_for_mysql(char const*, trx_t*, enum_sql_command, bool, bool) storage/innobase/row/row0mysql.cc:3625
    #5 0x558d94c94eab in ha_innobase::delete_table(char const*, enum_sql_command) (/mnt/r0/mleich/bb-10.2-marko/bld_asan/sql/mysqld+0x18feeab)
    #6 0x558d94c68cfd in ha_innobase::truncate() storage/innobase/handler/ha_innodb.cc:13535
    #7 0x558d9476e873 in handler::ha_truncate() sql/handler.cc:4081
    #8 0x558d94bae426 in Sql_cmd_truncate_table::handler_truncate(THD*, TABLE_LIST*, bool) sql/sql_truncate.cc:245
    #9 0x558d94baf560 in Sql_cmd_truncate_table::truncate_table(THD*, TABLE_LIST*) sql/sql_truncate.cc:442
    #10 0x558d94baf8d7 in Sql_cmd_truncate_table::execute(THD*) sql/sql_truncate.cc:499
    #11 0x558d9419fb82 in mysql_execute_command(THD*) sql/sql_parse.cc:6225
    #12 0x558d941aa61d in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) sql/sql_parse.cc:8012
    #13 0x558d941851d6 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) sql/sql_parse.cc:1824
    #14 0x558d94182277 in do_command(THD*) sql/sql_parse.cc:1377
    #15 0x558d944b563e in do_handle_one_connection(CONNECT*) sql/sql_connect.cc:1335
    #16 0x558d944b5023 in handle_one_connection sql/sql_connect.cc:1241
    #17 0x7f7b4fcb26d9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76d9)
    #18 0x7f7b4f144d7e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x108d7e)
for a TRUNCATE TABLE t1
 
/mnt/r0/mleich/RQG_new/rqg.pl \ 
--grammar=conf/mariadb/table_stress.yy \ 
--gendata=conf/mariadb/table_stress.zz \ 
--gendata_sql=conf/mariadb/table_stress.sql \ 
--mysqld=--loose_innodb_lock_schedule_algorithm=fcfs \ 
--mysqld=--loose_innodb_adaptive_hash_index=OFF \ 
--mysqld=--loose-idle_write_transaction_timeout=0 \ 
--mysqld=--loose-idle_transaction_timeout=0 \ 
--mysqld=--loose-idle_readonly_transaction_timeout=0 \ 
--mysqld=--connect_timeout=60 \ 
--mysqld=--interactive_timeout=28800 \ 
--mysqld=--slave_net_timeout=60 \ 
--mysqld=--net_read_timeout=30 \ 
--mysqld=--net_write_timeout=60 \ 
--mysqld=--loose-table_lock_wait_timeout=50 \ 
--mysqld=--wait_timeout=28800 \ 
--mysqld=--lock-wait-timeout=86400 \ 
--mysqld=--innodb-lock-wait-timeout=50 \ 
--seed=random \ 
--no-mask \ 
--queries=10M \ 
--duration=300 \ 
--views \ 
--validators=none \ 
--redefine=conf/mariadb/general-workarounds.yy \ 
--redefine=conf/mariadb/alter_table.yy \ 
--redefine=conf/mariadb/bulk_insert.yy \ 
--redefine=conf/mariadb/xa.yy \ 
--redefine=conf/mariadb/versioning.yy \ 
--redefine=conf/mariadb/sequences.yy \ 
--mysqld=--log_output=FILE \  
--mysqld=--log-bin \  
--mysqld=--log_bin_trust_function_creators=1 \ 
--mysqld=--loose-max-statement-time=30 \ 
--mysqld=--loose-debug_assert_on_not_freed_memory=0 \ 
--reporters=Backtrace,ErrorLog,Deadlock \ 
--engine=InnoDB \ 
--mysqld=--innodb-buffer-pool-size=256M \ 
--mysqld=--innodb_use_native_aio=0 \ 
--whitelist_statuses='STATUS_SERVER_CRASHED' \ 
--whitelist_patterns="'<signal handler called>','SUMMARY: AddressSanitizer: '" \
--blacklist_statuses='STATUS_OK' \ 
--blacklist_patterns="'Sentence is now longer than .{1,10} symbols. Possible endless loop in grammar. Aborting.','\[ERROR\] InnoDB: preallocating .{1,120} with error 28',' is truncated: expected core file size ',' is not a core dump: File truncated','<signal handler called>.{1,500}ut_dbg_assertion_failed.{1,500}lock_trx_table_locks_remove'" \
--threads=12 \ 
--no-mask \
... certain RQG testing box specific settings

Source tree
HEAD, origin/bb-10.2-marko 0ec656b4b0fd2943950e65c13f8fa01a2b470798 2018-11-05T16:02:37+02:00



 Comments   
Comment by Matthias Leich [ 2018-11-06 ]

MDEV-17626.tgz contains
- rqg.yy , rqg.sql , rqg.zz
  Files required for repeating the RQG test. 
  The crowd of files shown in the description is not required.
- rqg.job
  Part of the  RQG command line
- rqg.log
  Log of my RQG run which showed the problem
 
Only one of 1120 RQG runs with roughly the same setup showed the problem.
This means that the hope to replay the problem is extreme low.

Comment by Matthias Leich [ 2018-11-06 ]

Some comments of Marko when looking into the core etc.
- What catches the eyes is "index->online_status = ONLINE_INDEX_ABORTED_DROPPED".
  This means that an ADD INDEX or rather an ADD UNIQUE INDEX has failed in history.
  We should be able to get the same for a DROP TABLE.
- Also interesting
  (gdb) p *index
$1 = {id = 557, heap = 0x6110006bbec0, name = {
    m_name = 0x61c000230908 "Marv\303\203\302\243o_uidx3"}, 
  table_name = 0x603000138820 "6", table = 0x6170001e2308, space = 476, 
  page = 4, merge_threshold = 50, type = 18, trx_id_offset = 0, 
  n_user_defined_cols = 1, nulls_equal = 0, n_uniq = 1, n_def = 2, 
  n_fields = 2, n_nullable = 1, cached = 1, to_be_dropped = 0, 
  online_status = 3, uncommitted = 1, is_dummy = false, magic_n = 76789786, 
  fields = 0x61c000230918, parser = 0x0, has_new_v_col = false, 
  index_fts_syncing = false, indexes = {prev = 0x0, next = 0x0}, …
and at end : indexes.prev = indexes.next = NULL
There must be a race condition:
(gdb) p table.indexes
$1 = {count = 1, start = 0x6180000fad08, end = 0x6180000fad08, node = &dict_index_t::indexes, init = 51966}
(gdb) p table.indexes.start
$2 = (ut_list_base<dict_index_t, ut_list_node<dict_index_t> dict_index_t::*>::elem_type *) 0x6180000fad08
(gdb) p *table.indexes.start
$3 = {id = 562, heap = 0x6110006d3700, name = {m_name = 0x61c000112908 "GEN_CLUST_INDEX"}, table_name = 0x6170008f5680 "test/#sql-ib495-1965853623", table = 0x617000051708, space = 480, page = 3, 

Generated at Thu Feb 08 08:37:53 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.