[MDEV-19716] ASAN use-after-poison in Query_log_event::Query_log_event / THD::log_events_and_free_tmp_shares Created: 2019-06-08 Updated: 2020-12-08 Resolved: 2019-07-02 |
|
| Status: | Closed |
| Project: | MariaDB Server |
| Component/s: | Data Definition - Temporary, Replication |
| Affects Version/s: | 10.4 |
| Fix Version/s: | 10.4.7 |
| Type: | Bug | Priority: | Major |
| Reporter: | Elena Stepanova | Assignee: | Sujatha Sivakumar (Inactive) |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | None | ||
| Description |
|
Not reproducible on 10.3. |
| Comments |
| Comment by Sergei Petrunia [ 2019-06-14 ] | ||||||||||||||||||||||||||
|
The problem is caused by this sequence of events: Statement is run:
^ This creates a temporary table.
^ When running this statement, the following happens: 1. thd->lex->sql_command=SQLCOM_CREATE_TABLE
The connection is closed, so we drop the temporary table and try to binlog the The contents of thd->lex and thd->lex->sql_command remain the same We get here:
and execute this code:
This is apparently wrong. The code assumes that lex->sql_command describes the current command, but this is simply NOT TRUE . (The value of lex->sql_command describes whatever was the last command before the client disconnected, which should not have any effect on how we drop the temporary tables and binlog it) the value of lex->first_select_lex()->item_list.elements is not valid anymore, either. So if we are trying to read it, it's an error. | ||||||||||||||||||||||||||
| Comment by Sergei Petrunia [ 2019-06-14 ] | ||||||||||||||||||||||||||
|
The problem doesn't reproduce when I use mysql command line client and disconnect manually. When I do that, lex->sql_command=SQLCOM_END. The value of SQLCOM_END is set here in dispatch_command:
See the {{thd->lex->sql_command= SQLCOM_END; }} line above. | ||||||||||||||||||||||||||
| Comment by Sergei Petrunia [ 2019-06-14 ] | ||||||||||||||||||||||||||
|
I assume the fix here would be to set thd-lex->sql_command to SQLCOM_END in THD::cleanup(). But I would like to run this through somebody else knowledgeable in the server runtime module. | ||||||||||||||||||||||||||
| Comment by Sujatha Sivakumar (Inactive) [ 2019-06-18 ] | ||||||||||||||||||||||||||
|
Hello Andrei, Can you please review the changes for Please find the bb link: Thank you. | ||||||||||||||||||||||||||
| Comment by Andrei Elkin [ 2019-07-01 ] | ||||||||||||||||||||||||||
|
Thanks for a good piece of analysis, Sujatha! The patch is okay, just make sure we | ||||||||||||||||||||||||||
| Comment by Sujatha Sivakumar (Inactive) [ 2020-06-17 ] | ||||||||||||||||||||||||||
|
"rpl_drop_temp_table_invaid_lex.test" fails ocassionally on build bot with following symptoms. http://buildbot.askmonty.org/buildbot/builders/bld-p9-rhel7/builds/4201/steps/mtr/logs/stdio
| ||||||||||||||||||||||||||
| Comment by Sujatha Sivakumar (Inactive) [ 2020-06-25 ] | ||||||||||||||||||||||||||
|
Hello Elkin
I have implemented the changes. Please find the following patch. Patch: https://github.com/MariaDB/server/commit/9b8dd9690a9a3bcf5f1f6e7929860751e732091b Thank you. | ||||||||||||||||||||||||||
| Comment by Sujatha Sivakumar (Inactive) [ 2020-12-07 ] | ||||||||||||||||||||||||||
|
Hello alice Can you please review the changes to "rpl_drop_temp_table_invalid_lex.test".
Patch: https://github.com/MariaDB/server/commit/fa2505dbcccf5b6316a52e36596270d9fcb1f9c1 Thank you. | ||||||||||||||||||||||||||
| Comment by Sujatha Sivakumar (Inactive) [ 2020-12-08 ] | ||||||||||||||||||||||||||
|
Patch was reviewed and approved by alice. Test changes are pushed into 10.4.18. |