[MDEV-18207] ASAN heap-use-after-free in _ma_get_status upon concurrent operations with sequence Created: 2019-01-10  Updated: 2019-06-25  Resolved: 2019-06-25

Status: Closed
Project: MariaDB Server
Component/s: Sequences, Storage Engine - Aria
Affects Version/s: 10.3, 10.4
Fix Version/s: 10.2.25, 10.3.16, 10.4.6

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Vladislav Lesin
Resolution: Fixed Votes: 0
Labels: None


 Description   

Note: it always fails for me on 10.3 ASAN build with the configured 100 loops (usually within first few), but it can vary on different machines and builds. Modify $run in the first line if needed.

--let $run= 100
 
 
 
CREATE SEQUENCE s1 ENGINE=Aria;
 
 
 
while ($run)
 
{
 
  --connection default
 
  SELECT NEXTVAL(s1) UNION SELECT NEXTVAL(s1);
 
  LOCK TABLE s1 READ;
 
 
 
  --connect (con1,localhost,root,,test)
 
  --send
 
    SELECT NEXTVAL(s1) ;
 
 
 
  --connect (con2,localhost,root,,test)
 
  SELECT * FROM s1;
 
 
 
  --connect (con3,localhost,root,,test)
 
  --send
 
    FLUSH TABLES;
 
 
 
  --disconnect con2
 
  --disconnect con1
 
  --disconnect con3
 
 
 
  --connection default
 
  UNLOCK TABLES;
 
 
 
  --dec $run
 
}
 
 
 
DROP SEQUENCE s1;

10.3 d27bea9e9a ASAN

 
==28605==ERROR: AddressSanitizer: heap-use-after-free on address 0x6290001182b0 at pc 0x55fd1c701b9e bp 0x7f88f8fdc500 sp 0x7f88f8fdc4f8
 
READ of size 8 at 0x6290001182b0 thread T6
 
    #0 0x55fd1c701b9d in _ma_get_status /data/src/10.3/storage/maria/ma_state.c:293
 
    #1 0x55fd1d33debb in wait_for_lock /data/src/10.3/mysys/thr_lock.c:638
 
    #2 0x55fd1d33fcad in thr_lock /data/src/10.3/mysys/thr_lock.c:1014
 
    #3 0x55fd1d34163b in thr_multi_lock /data/src/10.3/mysys/thr_lock.c:1295
 
    #4 0x55fd1c4f1189 in mysql_lock_tables(THD*, st_mysql_lock*, unsigned int) /data/src/10.3/sql/lock.cc:355
 
    #5 0x55fd1c4f0c75 in mysql_lock_tables(THD*, TABLE**, unsigned int, unsigned int) /data/src/10.3/sql/lock.cc:304
 
    #6 0x55fd1b9cfbe7 in lock_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /data/src/10.3/sql/sql_base.cc:5261
 
    #7 0x55fd1b9ce307 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:5005
 
    #8 0x55fd1b93f488 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:502
 
    #9 0x55fd1bb28735 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6469
 
    #10 0x55fd1bb17579 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3769
 
    #11 0x55fd1bb31fa0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8092
 
    #12 0x55fd1bb0c078 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1851
 
    #13 0x55fd1bb09100 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
 
    #14 0x55fd1be7b364 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
 
    #15 0x55fd1be7ad70 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #16 0x55fd1c9ad0f7 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
 
    #17 0x7f8905a91493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
    #18 0x7f8903e7793e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
 
 
 
0x6290001182b0 is located 176 bytes inside of 18396-byte region [0x629000118200,0x62900011c9dc)
 
freed by thread T5 here:
 
    #0 0x7f8905cfb527 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54527)
 
    #1 0x55fd1d359b22 in free_memory /data/src/10.3/mysys/safemalloc.c:279
 
    #2 0x55fd1d359128 in sf_free /data/src/10.3/mysys/safemalloc.c:197
 
    #3 0x55fd1d329b22 in my_free /data/src/10.3/mysys/my_malloc.c:222
 
    #4 0x55fd1c89ed6e in maria_close /data/src/10.3/storage/maria/ma_close.c:269
 
    #5 0x55fd1c7300d9 in ha_maria::close() /data/src/10.3/storage/maria/ha_maria.cc:1275
 
    #6 0x55fd1d2b793b in ha_sequence::close() /data/src/10.3/sql/ha_sequence.h:135
 
    #7 0x55fd1c238160 in handler::ha_close() /data/src/10.3/sql/handler.cc:2751
 
    #8 0x55fd1bdc2370 in closefrm(TABLE*) /data/src/10.3/sql/table.cc:3580
 
    #9 0x55fd1c026a4c in intern_close_table /data/src/10.3/sql/table_cache.cc:222
 
    #10 0x55fd1c026cb2 in tc_remove_table /data/src/10.3/sql/table_cache.cc:260
 
    #11 0x55fd1c027f8e in tc_release_table(TABLE*) /data/src/10.3/sql/table_cache.cc:474
 
    #12 0x55fd1b9bb389 in close_thread_table(THD*, TABLE**) /data/src/10.3/sql/sql_base.cc:912
 
    #13 0x55fd1b9baaa8 in close_thread_tables(THD*) /data/src/10.3/sql/sql_base.cc:854
 
    #14 0x55fd1b9c195f in Locked_tables_list::unlock_locked_tables(THD*) /data/src/10.3/sql/sql_base.cc:2273
 
    #15 0x55fd1bb1f6db in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:5168
 
    #16 0x55fd1bb31fa0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8092
 
    #17 0x55fd1bb0c078 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1851
 
    #18 0x55fd1bb09100 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
 
    #19 0x55fd1be7b364 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
 
    #20 0x55fd1be7ad70 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #21 0x55fd1c9ad0f7 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
 
    #22 0x7f8905a91493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
 
 
previously allocated by thread T5 here:
 
    #0 0x7f8905cfb73f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5473f)
 
    #1 0x55fd1d358898 in sf_malloc /data/src/10.3/mysys/safemalloc.c:118
 
    #2 0x55fd1d329215 in my_malloc /data/src/10.3/mysys/my_malloc.c:101
 
    #3 0x55fd1d306e6a in my_multi_malloc /data/src/10.3/mysys/mulalloc.c:51
 
    #4 0x55fd1c7cd6ad in maria_clone_internal /data/src/10.3/storage/maria/ma_open.c:117
 
    #5 0x55fd1c7d6b87 in maria_open /data/src/10.3/storage/maria/ma_open.c:1056
 
    #6 0x55fd1c72f22c in ha_maria::open(char const*, int, unsigned int) /data/src/10.3/storage/maria/ha_maria.cc:1201
 
    #7 0x55fd1d2b4164 in ha_sequence::open(char const*, int, unsigned int) /data/src/10.3/sql/ha_sequence.cc:84
 
    #8 0x55fd1c237266 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /data/src/10.3/sql/handler.cc:2685
 
    #9 0x55fd1bdc14ae in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /data/src/10.3/sql/table.cc:3482
 
    #10 0x55fd1b9bf946 in open_table(THD*, TABLE_LIST*, Open_table_context*) /data/src/10.3/sql/sql_base.cc:1975
 
    #11 0x55fd1b9c7022 in open_and_process_table /data/src/10.3/sql/sql_base.cc:3596
 
    #12 0x55fd1b9c9a03 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4121
 
    #13 0x55fd1b9ce21b in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /data/src/10.3/sql/sql_base.cc:4996
 
    #14 0x55fd1b93f488 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /data/src/10.3/sql/sql_base.h:502
 
    #15 0x55fd1bb28735 in execute_sqlcom_select /data/src/10.3/sql/sql_parse.cc:6469
 
    #16 0x55fd1bb17579 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:3769
 
    #17 0x55fd1bb31fa0 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8092
 
    #18 0x55fd1bb0c078 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1851
 
    #19 0x55fd1bb09100 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1396
 
    #20 0x55fd1be7b364 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
 
    #21 0x55fd1be7ad70 in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #22 0x55fd1c9ad0f7 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
 
    #23 0x7f8905a91493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
 
 
Thread T6 created by T0 here:
 
    #0 0x7f8905ccabba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
 
    #1 0x55fd1c9ad6bf in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
 
    #2 0x55fd1b873d68 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
 
    #3 0x55fd1b889efa in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6572
 
    #4 0x55fd1b88a5ff in create_new_thread /data/src/10.3/sql/mysqld.cc:6642
 
    #5 0x55fd1b88b616 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6917
 
    #6 0x55fd1b8893b7 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6194
 
    #7 0x55fd1b871def in main /data/src/10.3/sql/main.cc:25
 
    #8 0x7f8903daf2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
 
 
 
Thread T5 created by T0 here:
 
    #0 0x7f8905ccabba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
 
    #1 0x55fd1c9ad6bf in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
 
    #2 0x55fd1b873d68 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
 
    #3 0x55fd1b889efa in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6572
 
    #4 0x55fd1b88a5ff in create_new_thread /data/src/10.3/sql/mysqld.cc:6642
 
    #5 0x55fd1b88b616 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6917
 
    #6 0x55fd1b8893b7 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6194
 
    #7 0x55fd1b871def in main /data/src/10.3/sql/main.cc:25
 
    #8 0x7f8903daf2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /data/src/10.3/storage/maria/ma_state.c:293 _ma_get_status
 
Shadow bytes around the buggy address:
 
  0x0c528001b000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c528001b010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c528001b020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c528001b030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c528001b040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c528001b050: fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd
 
  0x0c528001b060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c528001b070: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c528001b080: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c528001b090: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c528001b0a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Contiguous container OOB:fc
 
  ASan internal:           fe
 
==28605==ABORTING

Couldn't reproduce on 10.4, although it doesn't necessarily mean the problem doesn't exist.
The test case is not applicable to 10.2, cannot check it.
Didn't get a failure by switching from Aria to MyISAM.

 Comments   
Comment by Alice Sherepa [ 2019-02-08 ]

Similar one on 10.4 e80bcd7f64fc8ff6f46:

    #0 0x55c8a7fa7ef1 in _ma_get_status /10.4/storage/maria/ma_state.c:294
 
    #1 0x55c8a8b9c305 in thr_lock /10.4/mysys/thr_lock.c:839
 
    #2 0x55c8a8b9e8cd in thr_multi_lock /10.4/mysys/thr_lock.c:1295
 
    #3 0x55c8a7d8455b in mysql_lock_tables(THD*, st_mysql_lock*, unsigned int) /10.4/sql/lock.cc:353
 
    #4 0x55c8a7d8413b in mysql_lock_tables(THD*, TABLE**, unsigned int, unsigned int) /10.4/sql/lock.cc:305
 
    #5 0x55c8a7236be5 in lock_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /10.4/sql/sql_base.cc:5406
 
    #6 0x55c8a759ea64 in simple_rename_or_index_change /10.4/sql/sql_table.cc:8932
 
    #7 0x55c8a75a0e38 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /10.4/sql/sql_table.cc:9376
 
    #8 0x55c8a76e48e4 in Sql_cmd_alter_table::execute(THD*) /10.4/sql/sql_alter.cc:499
 
    #9 0x55c8a73977cb in mysql_execute_command(THD*) /10.4/sql/sql_parse.cc:6309
 
    #10 0x55c8a73a2013 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.4/sql/sql_parse.cc:8120
 
    #11 0x55c8a737aca8 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.4/sql/sql_parse.cc:1806
 
    #12 0x55c8a7377e12 in do_command(THD*) /10.4/sql/sql_parse.cc:1356
 
    #13 0x55c8a76d594f in do_handle_one_connection(CONNECT*) /10.4/sql/sql_connect.cc:1399
 
    #14 0x55c8a76d5319 in handle_one_connection /10.4/sql/sql_connect.cc:1302
 
    #15 0x7f630eb986b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
 
    #16 0x7f630de2941c in clone (/lib/x86_64-linux-gnu/libc.so.6+0x10741c)

Comment by Vladislav Lesin [ 2019-05-08 ]

The test can be simplified a little bit:

--let $run= 100
 
CREATE SEQUENCE s1 ENGINE=Aria;
 
 
 
while ($run)
 
{
 
  --connection default
 
  SELECT NEXTVAL(s1) UNION SELECT NEXTVAL(s1);
 
  LOCK TABLE s1 READ;
 
 
 
  --connect (con1,localhost,root,,test)
 
  --send
 
    SELECT NEXTVAL(s1) ;
 
 
 
  --connect (con3,localhost,root,,test)
 
  --send
 
    FLUSH TABLES;
 
 
 
  --disconnect con1
 
  --disconnect con3
 
 
 
  --connection default
 
  UNLOCK TABLES;
 
 
 
  --dec $run
 
}
 
 
 
DROP SEQUENCE s1;

Comment by Vladislav Lesin [ 2019-05-21 ]

When "UNION" statement is executed, two instances of ha_maria are created, the instance per each SELECT in UNION. And ha_maria->file->state of the second instance points to the ha_maria->file->state_save of the first instance. The following code does this:

(gdb) l
 
373
 
374
 
375     void _ma_copy_status(void* to, void *from)
 
376     {
 
377       ((MARIA_HA*) to)->state= &((MARIA_HA*) from)->state_save;
 
378     }
 
379
 
380
 
381     void _ma_reset_update_flag(void *param,
 
382                                my_bool concurrent_insert __attribute__((unused)))
 
(gdb) bt
 
#0  _ma_copy_status (to=0x6290000e1270, from=0x6290000e6270) at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_state.c:378
 
#1  0x0000555557c8b6ad in thr_multi_lock (data=0x62b000001b78, count=2, owner=0x62a000049d80, lock_wait_timeout=86400) at /home/unencrypted/work/git/mariadb-server/mysys/thr_lock.c:1330
 
#2  0x0000555556e97b6a in mysql_lock_tables (thd=0x62a000048270, sql_lock=0x62b000001b48, flags=0) at /home/unencrypted/work/git/mariadb-server/sql/lock.cc:347
 
#3  0x0000555556e9774a in mysql_lock_tables (thd=0x62a000048270, tables=0x62b000001b38, count=2, flags=0) at /home/unencrypted/work/git/mariadb-server/sql/lock.cc:299
 
#4  0x00005555563b27bc in lock_tables (thd=0x62a000048270, tables=0x62b000000390, count=2, flags=0) at /home/unencrypted/work/git/mariadb-server/sql/sql_base.cc:5303
 
#5  0x00005555563b0f82 in open_and_lock_tables (thd=0x62a000048270, options=..., tables=0x62b000000390, derived=true, flags=0, prelocking_strategy=0x7fffeb131170)
 
    at /home/unencrypted/work/git/mariadb-server/sql/sql_base.cc:5048
 
#6  0x00005555563287f6 in open_and_lock_tables (thd=0x62a000048270, tables=0x62b000000390, derived=true, flags=0) at /home/unencrypted/work/git/mariadb-server/sql/sql_base.h:513
 
#7  0x00005555565037d3 in execute_sqlcom_select (thd=0x62a000048270, all_tables=0x62b000000390) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:6476
 
#8  0x00005555564f2c83 in mysql_execute_command (thd=0x62a000048270) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:3818
 
#9  0x000055555650cb68 in mysql_parse (thd=0x62a000048270, rawbuf=0x62b000000288 "SELECT NEXTVAL(s1) UNION SELECT NEXTVAL(s1)", length=43, parser_state=0x7fffeb1329a0, is_com_multi=false, 
    is_next_command=false) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:8098
 
#10 0x00005555564e7670 in dispatch_command (command=COM_QUERY, thd=0x62a000048270, packet=0x6290000cd271 "SELECT NEXTVAL(s1) UNION SELECT NEXTVAL(s1)", packet_length=43, is_com_multi=false, 
    is_next_command=false) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:1858
 
#11 0x00005555564e47d4 in do_command (thd=0x62a000048270) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:1404
 
#12 0x000055555683a878 in do_handle_one_connection (connect=0x611000004bb0) at /home/unencrypted/work/git/mariadb-server/sql/sql_connect.cc:1402
 
#13 0x000055555683a255 in handle_one_connection (arg=0x611000004bb0) at /home/unencrypted/work/git/mariadb-server/sql/sql_connect.cc:1308
 
#14 0x0000555557b82845 in pfs_spawn_thread (arg=0x6160000030f0) at /home/unencrypted/work/git/mariadb-server/storage/perfschema/pfs.cc:1862
 
#15 0x00007ffff5b3f6db in start_thread (arg=0x7fffeb134300) at pthread_create.c:463
 
#16 0x00007ffff4f2988f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

When tables are unlocked their ha_maria->file->state are restored in _ma_update_status():

Thread 6 "mysqld" hit Breakpoint 3, _ma_update_status (param=0x6290000e6270) at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_state.c:309
 
309       MARIA_HA *info=(MARIA_HA*) param;
 
(gdb) bt
 
#0  _ma_update_status (param=0x6290000e6270) at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_state.c:309
 
#1  0x00005555577ccb15 in _ma_update_status_with_lock (info=0x6290000e6270) at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_state.c:361
 
#2  0x00005555577c7dcc in maria_lock_database (info=0x6290000e6270, lock_type=2) at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_locking.c:66
 
#3  0x0000555557802ccd in ha_maria::external_lock (this=0x61d0001b1308, thd=0x62a000048270, lock_type=2) at /home/unencrypted/work/git/mariadb-server/storage/maria/ha_maria.cc:2727
 
#4  0x0000555557c06c5e in ha_sequence::external_lock (this=0x61a000029508, thd=0x62a000048270, lock_type=2) at /home/unencrypted/work/git/mariadb-server/sql/ha_sequence.cc:319
 
#5  0x0000555556bfffbf in handler::ha_external_lock (this=0x61a000029508, thd=0x62a000048270, lock_type=2) at /home/unencrypted/work/git/mariadb-server/sql/handler.cc:6345
 
#6  0x0000555556e9a9a4 in unlock_external (thd=0x62a000048270, table=0x62b000001b88, count=2) at /home/unencrypted/work/git/mariadb-server/sql/lock.cc:708
 
#7  0x0000555556e9876d in mysql_unlock_tables (thd=0x62a000048270, sql_lock=0x62b000001b48, free_lock=false) at /home/unencrypted/work/git/mariadb-server/sql/lock.cc:429
 
#8  0x0000555556e985c0 in mysql_unlock_tables (thd=0x62a000048270, sql_lock=0x62b000001b48) at /home/unencrypted/work/git/mariadb-server/sql/lock.cc:415
 
#9  0x000055555639db17 in close_thread_tables (thd=0x62a000048270) at /home/unencrypted/work/git/mariadb-server/sql/sql_base.cc:854
 
#10 0x000055555650274b in mysql_execute_command (thd=0x62a000048270) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:6376
 
#11 0x000055555650cb68 in mysql_parse (thd=0x62a000048270, rawbuf=0x62b000000288 "SELECT NEXTVAL(s1) UNION SELECT NEXTVAL(s1)", length=43, parser_state=0x7fffeb1329a0, is_com_multi=false, 
    is_next_command=false) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:8098
 
#12 0x00005555564e7670 in dispatch_command (command=COM_QUERY, thd=0x62a000048270, packet=0x6290000cd271 "", packet_length=43, is_com_multi=false, is_next_command=false)
 
    at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:1858
 
#13 0x00005555564e47d4 in do_command (thd=0x62a000048270) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:1404
 
#14 0x000055555683a878 in do_handle_one_connection (connect=0x611000004bb0) at /home/unencrypted/work/git/mariadb-server/sql/sql_connect.cc:1402
 
#15 0x000055555683a255 in handle_one_connection (arg=0x611000004bb0) at /home/unencrypted/work/git/mariadb-server/sql/sql_connect.cc:1308
 
#16 0x0000555557b82845 in pfs_spawn_thread (arg=0x6160000030f0) at /home/unencrypted/work/git/mariadb-server/storage/perfschema/pfs.cc:1862
 
#17 0x00007ffff5b3f6db in start_thread (arg=0x7fffeb134300) at pthread_create.c:463
 
#18 0x00007ffff4f2988f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

But _ma_update_status() does not take into account the case when MARIA_HA::state points to the MARIA_HA::state_save of the another MARIA_HA instance, and that is why MARIA_HA::state is not restored for the second ha_maria instance. But the firs MARIA_HA instance is deallocated (see the corresponding stack trace of ASAN output in the issue description), the second MARIA_HA::state of the second instance can point to deallocated memory.

The fix is to restore MARIA_HA state in _ma_update_status() if it points not to the initial share->state.state. The fix is implemented in the following branch https://github.com/vlad-lesin/mariadb-server/tree/10.3-MDEV-18207-ma_get_status-ASAN, and it's currently under testing.

The following picture was useful to analyse the case: https://docs.google.com/presentation/d/1dHmY2NeoAgszrmSXLYHJswWUWhCTS2yOGRrejNKin_s/edit?usp=sharing.

Comment by Vladislav Lesin [ 2019-05-21 ]

Testing: https://buildbot.askmonty.org/buildbot/grid?category=main&branch=bb-10.3-MDEV-18207-ma_get_status-ASAN

Local testing shows two failed tests, which also fail without the fix: main.ft-debug main.func_regexp_pcre.

Comment by Vladislav Lesin [ 2019-05-24 ]

According to Monty's code review notes the fix described above does not look safe because of the following reasons:

1) for log tables _ma_update_status() is called for each write and this might not be correct to change info->state here
2) the code may also break if read only tables are used, as in this case ma_update_status will never be called

The correct fix is to restore the state is ha_maria::external_lock() after maria_lock_database() call. It's important to restore the MARIA_HA::state after maria_lock_database() call because share->state.state can be updated with the following stack trace:

0x00005555577cc7ea in _ma_update_status (param=0x6290000c8270) at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_state.c:334
 
334         share->state.state= *info->state;
 
(gdb) bt
 
#0  0x00005555577cc7ea in _ma_update_status (param=0x6290000c8270) at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_state.c:334
 
#1  0x00005555577ccb15 in _ma_update_status_with_lock (info=0x6290000c8270)
 
    at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_state.c:361
 
#2  0x00005555577c7dcc in maria_lock_database (info=0x6290000c8270, lock_type=2)
 
    at /home/unencrypted/work/git/mariadb-server/storage/maria/ma_locking.c:66
 
#3  0x0000555557802cc5 in ha_maria::external_lock (this=0x61d00019a108, thd=0x62a000048270, lock_type=2)
 
    at /home/unencrypted/work/git/mariadb-server/storage/maria/ha_maria.cc:2729
 
#4  0x0000555557c06d6a in ha_sequence::external_lock (this=0x61a000029b08, thd=0x62a000048270, lock_type=2)
 
    at /home/unencrypted/work/git/mariadb-server/sql/ha_sequence.cc:319
 
#5  0x0000555556bfffbf in handler::ha_external_lock (this=0x61a000029b08, thd=0x62a000048270, lock_type=2)
 
    at /home/unencrypted/work/git/mariadb-server/sql/handler.cc:6345
 
#6  0x0000555556e9a9a4 in unlock_external (thd=0x62a000048270, table=0x62b000002c90, count=1)
 
    at /home/unencrypted/work/git/mariadb-server/sql/lock.cc:708
 
#7  0x0000555556e9876d in mysql_unlock_tables (thd=0x62a000048270, sql_lock=0x62b000002c60, free_lock=false)
 
    at /home/unencrypted/work/git/mariadb-server/sql/lock.cc:429
 
#8  0x0000555556e985c0 in mysql_unlock_tables (thd=0x62a000048270, sql_lock=0x62b000002c60)
 
    at /home/unencrypted/work/git/mariadb-server/sql/lock.cc:415
 
#9  0x000055555639db17 in close_thread_tables (thd=0x62a000048270) at /home/unencrypted/work/git/mariadb-server/sql/sql_base.cc:854
 
#10 0x000055555699833b in sequence_insert (thd=0x62a000048270, lex=0x62a00004c070, org_table_list=0x62b0000004b8)
 
    at /home/unencrypted/work/git/mariadb-server/sql/sql_sequence.cc:363
 
#11 0x00005555566ecfb5 in mysql_create_table_no_lock (thd=0x62a000048270, db=0x62b0000004d0, table_name=0x62b0000004e0, 
    create_info=0x7fffeb131f90, alter_info=0x7fffeb131cf0, is_trans=0x7fffeb131650, create_table_mode=0, table_list=0x62b0000004b8)
 
    at /home/unencrypted/work/git/mariadb-server/sql/sql_table.cc:5090
 
#12 0x00005555566ed853 in mysql_create_table (thd=0x62a000048270, create_table=0x62b0000004b8, create_info=0x7fffeb131f90, 
    alter_info=0x7fffeb131cf0) at /home/unencrypted/work/git/mariadb-server/sql/sql_table.cc:5169
 
#13 0x00005555564f503c in mysql_execute_command (thd=0x62a000048270) at /home/unencrypted/work/git/mariadb-server/sql/sql_parse.cc:4329
 
#14 0x000055555650cb68 in mysql_parse (thd=0x62a000048270, rawbuf=0x62b0000003d0 "CREATE SEQUENCE s1 ENGINE=Aria", length=30,

I have updated the above branch with new fix and it's under testing now.

Generated at Thu Feb 08 08:42:18 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.