[MDEV-19194] Server crash or ASAN use-after-poison in fk_prepare_copy_alter_table upon dropping FK Created: 2019-04-05  Updated: 2023-04-27

Status: Confirmed
Project: MariaDB Server
Component/s: Data Definition - Alter Table
Affects Version/s: 10.0, 10.1, 10.2, 10.3, 10.4, 10.5, 10.6, 10.7, 10.8
Fix Version/s: 10.4, 10.5, 10.6

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Sergei Golubchik
Resolution: Unresolved Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-20493 Server fails to produce a crash repor... Open
relates to MDEV-23686 ASAN heap-use-after-free or server cr... Confirmed
relates to MDEV-23679 Server crashes in base_list_iterator:... Confirmed

 Description    

--source include/have_innodb.inc
 
 
 
CREATE TABLE tx (pk INT PRIMARY KEY) ENGINE=InnoDB;
 
CREATE TABLE t1 (a INT, CONSTRAINT fk FOREIGN KEY (a) REFERENCES tx(pk)) ENGINE=InnoDB;
 
ALTER IGNORE TABLE t1 DROP FOREIGN KEY fk, DROP FOREIGN KEY fk, ALGORITHM=COPY;
 
 
 
# Cleanup
 
DROP TABLE t1, tx;

10.3 d5a2bc6a ASAN

 
==21826==ERROR: AddressSanitizer: use-after-poison on address 0x557aba8bd568 at pc 0x557ab775e79f bp 0x7f5597b04240 sp 0x7f5597b04238
 
READ of size 8 at 0x557aba8bd568 thread T27
 
    #0 0x557ab775e79e in base_list_iterator::next_fast() /data/src/10.3/sql/sql_list.h:433
 
    #1 0x557ab7c140d6 in List_iterator_fast<Alter_drop>::operator++(int) /data/src/10.3/sql/sql_list.h:554
 
    #2 0x557ab7c02708 in fk_prepare_copy_alter_table /data/src/10.3/sql/sql_table.cc:8770
 
    #3 0x557ab7c077b7 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:9771
 
    #4 0x557ab7d52ecd in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:494
 
    #5 0x557ab79ee21a in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6285
 
    #6 0x557ab79f90a9 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:8091
 
    #7 0x557ab79d31d1 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1857
 
    #8 0x557ab79d0227 in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1403
 
    #9 0x557ab7d43f7f in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1402
 
    #10 0x557ab7d4398b in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
 
    #11 0x557ab887a131 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1862
 
    #12 0x7f55a3660493 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x7493)
 
    #13 0x7f55a182e93e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe893e)
 
 
 
0x557aba8bd568 is located 8 bytes inside of global variable 'end_of_list' from '/data/src/10.3/sql/sql_list.cc' (0x557aba8bd560) of size 16
 
SUMMARY: AddressSanitizer: use-after-poison /data/src/10.3/sql/sql_list.h:433 base_list_iterator::next_fast()
 
Shadow bytes around the buggy address:
 
  0x0aafd750fa50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0aafd750fa60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0aafd750fa70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0aafd750fa80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0aafd750fa90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
=>0x0aafd750faa0: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f7[f7]f9 f9
 
  0x0aafd750fab0: f9 f9 f9 f9 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9
 
  0x0aafd750fac0: 01 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
 
  0x0aafd750fad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0aafd750fae0: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
 
  0x0aafd750faf0: 00 00 00 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Heap right redzone:      fb
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack partial redzone:   f4
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Contiguous container OOB:fc
 
  ASan internal:           fe
 
Thread T27 created by T0 here:
 
    #0 0x7f55a3899bba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
 
    #1 0x557ab887a6f9 in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1912
 
    #2 0x557ab773bb88 in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1268
 
    #3 0x557ab775151e in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6589
 
    #4 0x557ab7751c23 in create_new_thread /data/src/10.3/sql/mysqld.cc:6659
 
    #5 0x557ab7752c3a in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6934
 
    #6 0x557ab77509db in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6211
 
    #7 0x557ab7739c0f in main /data/src/10.3/sql/main.cc:25
 
    #8 0x7f55a17662b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
 
 
 
==21826==ABORTING

10.3 d5a2bc6a debug

 
#3  <signal handler called>
 
#4  0x0000559ff23c3e06 in fk_prepare_copy_alter_table (thd=0x7f9a70000b00, table=0x7f9a700a8690, alter_info=0x7f9abeb50be0, alter_ctx=0x7f9abeb500b0) at /data/src/10.3/sql/sql_table.cc:8773
 
#5  0x0000559ff23c6783 in mysql_alter_table (thd=0x7f9a70000b00, new_db=0x7f9a700051d0, new_name=0x7f9a70005590, create_info=0x7f9abeb50ca0, table_list=0x7f9a70014e30, alter_info=0x7f9abeb50be0, order_num=0, order=0x0, ignore=true) at /data/src/10.3/sql/sql_table.cc:9771
 
#6  0x0000559ff244e902 in Sql_cmd_alter_table::execute (this=0x7f9a700154d8, thd=0x7f9a70000b00) at /data/src/10.3/sql/sql_alter.cc:494
 
#7  0x0000559ff22ef4ca in mysql_execute_command (thd=0x7f9a70000b00) at /data/src/10.3/sql/sql_parse.cc:6285
 
#8  0x0000559ff22f456f in mysql_parse (thd=0x7f9a70000b00, rawbuf=0x7f9a70014ce8 "ALTER IGNORE TABLE t1 DROP FOREIGN KEY fk, DROP FOREIGN KEY fk, ALGORITHM=COPY", length=78, parser_state=0x7f9abeb525f0, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:8091
 
#9  0x0000559ff22e183e in dispatch_command (command=COM_QUERY, thd=0x7f9a70000b00, packet=0x7f9a70162261 "ALTER IGNORE TABLE t1 DROP FOREIGN KEY fk, DROP FOREIGN KEY fk, ALGORITHM=COPY", packet_length=78, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1857
 
#10 0x0000559ff22e0228 in do_command (thd=0x7f9a70000b00) at /data/src/10.3/sql/sql_parse.cc:1403
 
#11 0x0000559ff2448ec1 in do_handle_one_connection (connect=0x559ff4b9add0) at /data/src/10.3/sql/sql_connect.cc:1402
 
#12 0x0000559ff2448c45 in handle_one_connection (arg=0x559ff4b9add0) at /data/src/10.3/sql/sql_connect.cc:1308
 
#13 0x0000559ff28e5519 in pfs_spawn_thread (arg=0x559ff4ae0190) at /data/src/10.3/storage/perfschema/pfs.cc:1862
 
#14 0x00007f9acb6ff494 in start_thread (arg=0x7f9abeb53700) at pthread_create.c:333
 
#15 0x00007f9ac98cd93f in clone () from /lib/x86_64-linux-gnu/libc.so.6

Non-debug build doesn't crash on my machine, but since it's SIGSEGV, it might be the matter of luck.

 Comments   
Comment by Alice Sherepa [ 2021-02-18 ]

something related:

=================================================================
 
==27353==ERROR: AddressSanitizer: heap-use-after-free on address 0x61800024ed18 at pc 0x55642549e803 bp 0x7ff1d287e0d0 sp 0x7ff1d287e0c8
 
READ of size 8 at 0x61800024ed18 thread T34
 
    #0 0x55642549e802 in id_name_t::operator char const*() const /10.3/storage/innobase/include/dict0mem.h:520
 
    #1 0x55642547a327 in get_foreign_key_info /10.3/storage/innobase/handler/ha_innodb.cc:15084
 
    #2 0x55642547a9b0 in ha_innobase::get_foreign_key_list(THD*, List<st_foreign_key_info>*) /10.3/storage/innobase/handler/ha_innodb.cc:15127
 
    #3 0x55642495286b in fk_prepare_copy_alter_table /10.3/sql/sql_table.cc:8921
 
    #4 0x556424959f31 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /10.3/sql/sql_table.cc:9999
 
    #5 0x556424ad5427 in Sql_cmd_alter_table::execute(THD*) /10.3/sql/sql_alter.cc:512
 
    #6 0x5564246f3ef4 in mysql_execute_command(THD*) /10.3/sql/sql_parse.cc:6052
 
    #7 0x5564247007a6 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.3/sql/sql_parse.cc:7840
 
    #8 0x5564246d6e7b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.3/sql/sql_parse.cc:1852
 
    #9 0x5564246d35b6 in do_command(THD*) /10.3/sql/sql_parse.cc:1398
 
    #10 0x556424ac43cf in do_handle_one_connection(CONNECT*) /10.3/sql/sql_connect.cc:1403
 
    #11 0x556424ac3c87 in handle_one_connection /10.3/sql/sql_connect.cc:1308
 
    #12 0x7ff200e23fa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486
 
    #13 0x7ff2007a74ce in clone (/lib/x86_64-linux-gnu/libc.so.6+0xf94ce)
 
 
 
0x61800024ed18 is located 152 bytes inside of 792-byte region [0x61800024ec80,0x61800024ef98)
 
freed by thread T38 here:
 
    #0 0x7ff200f25fb0 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe8fb0)
 
    #1 0x556425641bc5 in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /10.3/storage/innobase/mem/mem0mem.cc:416
 
    #2 0x556425c27a14 in mem_heap_free /10.3/storage/innobase/include/mem0mem.ic:417
 
    #3 0x556425c31fd3 in dict_mem_index_free(dict_index_t*) /10.3/storage/innobase/dict/dict0mem.cc:1108
 
    #4 0x556425bd8718 in dict_index_remove_from_cache_low /10.3/storage/innobase/dict/dict0dict.cc:2202
 
    #5 0x556425bd8742 in dict_index_remove_from_cache(dict_table_t*, dict_index_t*) /10.3/storage/innobase/dict/dict0dict.cc:2213
 
    #6 0x5564257c50af in row_merge_drop_indexes(trx_t*, dict_table_t*, unsigned long) /10.3/storage/innobase/row/row0merge.cc:4002
 
    #7 0x55642550edd6 in innobase_rollback_sec_index /10.3/storage/innobase/handler/handler0alter.cc:7375
 
    #8 0x55642551c09a in ha_innobase::commit_inplace_alter_table(TABLE*, Alter_inplace_info*, bool) /10.3/storage/innobase/handler/handler0alter.cc:9802
 
    #9 0x556424eab123 in handler::ha_commit_inplace_alter_table(TABLE*, Alter_inplace_info*, bool) /10.3/sql/handler.cc:4602
 
    #10 0x5564249493b4 in mysql_inplace_alter_table /10.3/sql/sql_table.cc:7735
 
    #11 0x556424959d39 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /10.3/sql/sql_table.cc:9980
 
    #12 0x556424ad5427 in Sql_cmd_alter_table::execute(THD*) /10.3/sql/sql_alter.cc:512
 
    #13 0x5564246f3ef4 in mysql_execute_command(THD*) /10.3/sql/sql_parse.cc:6052
 
    #14 0x5564247007a6 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.3/sql/sql_parse.cc:7840
 
    #15 0x5564246d6e7b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.3/sql/sql_parse.cc:1852
 
    #16 0x5564246d35b6 in do_command(THD*) /10.3/sql/sql_parse.cc:1398
 
    #17 0x556424ac43cf in do_handle_one_connection(CONNECT*) /10.3/sql/sql_connect.cc:1403
 
    #18 0x556424ac3c87 in handle_one_connection /10.3/sql/sql_connect.cc:1308
 
    #19 0x7ff200e23fa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486
 
 
 
previously allocated by thread T38 here:
 
    #0 0x7ff200f26330 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe9330)
 
    #1 0x556425640caa in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /10.3/storage/innobase/mem/mem0mem.cc:277
 
    #2 0x5564256417f8 in mem_heap_add_block(mem_block_info_t*, unsigned long) /10.3/storage/innobase/mem/mem0mem.cc:378
 
    #3 0x556425c27363 in mem_heap_alloc /10.3/storage/innobase/include/mem0mem.ic:191
 
    #4 0x556425c27046 in mem_heap_zalloc /10.3/storage/innobase/include/mem0mem.ic:160
 
    #5 0x556425c2f5f3 in dict_mem_index_create(dict_table_t*, char const*, unsigned long, unsigned long) /10.3/storage/innobase/dict/dict0mem.cc:770
 
    #6 0x556425bdc066 in dict_index_build_internal_non_clust /10.3/storage/innobase/dict/dict0dict.cc:2672
 
    #7 0x556425bd72ea in dict_index_add_to_cache(dict_index_t*&, unsigned long, dict_add_v_col_t const*) /10.3/storage/innobase/dict/dict0dict.cc:2049
 
    #8 0x556425bb2806 in dict_create_index_step(que_thr_t*) /10.3/storage/innobase/dict/dict0crea.cc:1361
 
    #9 0x5564256ffe9d in que_thr_step /10.3/storage/innobase/que/que0que.cc:1048
 
    #10 0x5564257002e9 in que_run_threads_low /10.3/storage/innobase/que/que0que.cc:1100
 
    #11 0x55642570072e in que_run_threads(que_thr_t*) /10.3/storage/innobase/que/que0que.cc:1140
 
    #12 0x5564254f4bf1 in create_index_dict /10.3/storage/innobase/handler/handler0alter.cc:4904
 
    #13 0x5564254ff32c in prepare_inplace_alter_table_dict /10.3/storage/innobase/handler/handler0alter.cc:5770
 
    #14 0x55642550afe8 in ha_innobase::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.3/storage/innobase/handler/handler0alter.cc:6948
 
    #15 0x556424eaae29 in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.3/sql/handler.cc:4582
 
    #16 0x556424948b32 in mysql_inplace_alter_table /10.3/sql/sql_table.cc:7651
 
    #17 0x556424959d39 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /10.3/sql/sql_table.cc:9980
 
    #18 0x556424ad5427 in Sql_cmd_alter_table::execute(THD*) /10.3/sql/sql_alter.cc:512
 
    #19 0x5564246f3ef4 in mysql_execute_command(THD*) /10.3/sql/sql_parse.cc:6052
 
    #20 0x5564247007a6 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.3/sql/sql_parse.cc:7840
 
    #21 0x5564246d6e7b in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.3/sql/sql_parse.cc:1852
 
    #22 0x5564246d35b6 in do_command(THD*) /10.3/sql/sql_parse.cc:1398
 
    #23 0x556424ac43cf in do_handle_one_connection(CONNECT*) /10.3/sql/sql_connect.cc:1403
 
    #24 0x556424ac3c87 in handle_one_connection /10.3/sql/sql_connect.cc:1308
 
    #25 0x7ff200e23fa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486
 
 
 
Thread T34 created by T0 here:
 
    #0 0x7ff200e8ddb0 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x50db0)
 
    #1 0x55642646da23 in spawn_thread_noop /10.3/mysys/psi_noop.c:187
 
    #2 0x5564243e66f4 in inline_mysql_thread_create /10.3/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x5564243ffbad in create_thread_to_handle_connection(CONNECT*) /10.3/sql/mysqld.cc:6658
 
    #4 0x556424400302 in create_new_thread /10.3/sql/mysqld.cc:6728
 
    #5 0x556424401483 in handle_connections_sockets() /10.3/sql/mysqld.cc:6986
 
    #6 0x5564243fef21 in mysqld_main(int, char**) /10.3/sql/mysqld.cc:6280
 
    #7 0x5564243e4df4 in main /10.3/sql/main.cc:25
 
    #8 0x7ff2006d209a in __libc_start_main ../csu/libc-start.c:308
 
 
 
Thread T38 created by T0 here:
 
    #0 0x7ff200e8ddb0 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x50db0)
 
    #1 0x55642646da23 in spawn_thread_noop /10.3/mysys/psi_noop.c:187
 
    #2 0x5564243e66f4 in inline_mysql_thread_create /10.3/include/mysql/psi/mysql_thread.h:1275
 
    #3 0x5564243ffbad in create_thread_to_handle_connection(CONNECT*) /10.3/sql/mysqld.cc:6658
 
    #4 0x556424400302 in create_new_thread /10.3/sql/mysqld.cc:6728
 
    #5 0x556424401483 in handle_connections_sockets() /10.3/sql/mysqld.cc:6986
 
    #6 0x5564243fef21 in mysqld_main(int, char**) /10.3/sql/mysqld.cc:6280
 
    #7 0x5564243e4df4 in main /10.3/sql/main.cc:25
 
    #8 0x7ff2006d209a in __libc_start_main ../csu/libc-start.c:308
 
 
 
SUMMARY: AddressSanitizer: heap-use-after-free /10.3/storage/innobase/include/dict0mem.h:520 in id_name_t::operator char const*() const
 
Shadow bytes around the buggy address:
 
  0x0c3080041d50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3080041d60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3080041d70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3080041d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c3080041d90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
=>0x0c3080041da0: fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3080041db0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3080041dc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3080041dd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3080041de0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
 
  0x0c3080041df0: fd fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
==27353==ABORTING

Generated at Thu Feb 08 08:49:45 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.