[MDEV-29729] SUMMARY: AddressSanitizer: heap-use-after-free sql/scheduler.cc:103 in post_kill_notification(THD*) Created: 2022-10-06  Updated: 2023-11-27

Status: Open
Project: MariaDB Server
Component/s: Server
Affects Version/s: 10.6.11
Fix Version/s: 10.6

Type: Bug Priority: Major
Reporter: Matthias Leich Assignee: Sergei Golubchik
Resolution: Unresolved Votes: 0
Labels: None

Attachments: File serg.prt     File serg.tgz    
Issue Links:
Relates
relates to MDEV-13829 Server crash / ASAN errors in post_ki... Open

 Description   

ASAN failure found during RQG testing on
origin/st-10.6-merge 75fac34247eb600a1dd10f4b4941cce5aac57978
but on other development trees too. So its most probably in main trees.
 
==3979878==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000094958 at pc 0x55e8eeb554c5 bp 0x7f52353b5ef0 sp 0x7f52353b5ee0
READ of size 8 at 0x615000094958 thread T22
    #0 0x55e8eeb554c4 in post_kill_notification(THD*) /data/Server/st-10.6-merge/sql/scheduler.cc:103
    #1 0x55e8ee65523e in THD::awake_no_mutex(killed_state) /data/Server/st-10.6-merge/sql/sql_class.cc:1916
    #2 0x55e8ee78c3d3 in kill_one_thread(THD*, long long, killed_state, killed_type) /data/Server/st-10.6-merge/sql/sql_parse.cc:9263
    #3 0x55e8ee78cf74 in sql_kill /data/Server/st-10.6-merge/sql/sql_parse.cc:9397
    #4 0x55e8ee776c40 in mysql_execute_command(THD*, bool) /data/Server/st-10.6-merge/sql/sql_parse.cc:5529
    #5 0x55e8ee785fe8 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /data/Server/st-10.6-merge/sql/sql_parse.cc:8032
    #6 0x55e8ee75ea64 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /data/Server/st-10.6-merge/sql/sql_parse.cc:1896
    #7 0x55e8ee75bfd1 in do_command(THD*, bool) /data/Server/st-10.6-merge/sql/sql_parse.cc:1409
    #8 0x55e8eeb53e35 in do_handle_one_connection(CONNECT*, bool) /data/Server/st-10.6-merge/sql/sql_connect.cc:1416
    #9 0x55e8eeb537bd in handle_one_connection /data/Server/st-10.6-merge/sql/sql_connect.cc:1318
    #10 0x7f52451aa608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
    #11 0x7f5244d7d292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
 
Scenario:
Two till three (just for replaying faster) connections run within a loop
    KILL CONNECTION <id of some other connection>;
    if losing the connection because getting killed than just reconnect.



 Comments   
Comment by Marko Mäkelä [ 2022-10-07 ]

The contents of the tree as of the mentioned merge commit is identical with serg’s later merge commit that was pushed to 10.6 (along with a test case fixup) on September 30.

Generated at Thu Feb 08 10:10:50 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.