[MDEV-30410] SIGSEGV in ___pthread_mutex_lock from federatedx_txn::release_scan, ASAN heap-use-after-free in federatedx_txn::acquire Created: 2023-01-14  Updated: 2023-11-28

Status: Open
Project: MariaDB Server
Component/s: Storage Engine - Federated
Affects Version/s: 10.6, 10.7, 10.8, 10.9, 10.10, 10.11, 11.0
Fix Version/s: 10.6, 10.11

Type: Bug Priority: Major
Reporter: Roel Van de Paar Assignee: Oleksandr Byelkin
Resolution: Unresolved Votes: 0
Labels: ASAN, regression-10.6

Issue Links:
Relates
relates to MDEV-29214 ASAN errors in federatedx_txn::txn_co... Confirmed
relates to MDEV-30083 SIGSEGV's in federatedx_txn::sp_acqui... Open

 Description   

A bit similar to MDEV-29214 and MDEV-30083, however this specific issue is only present in optimized builds, and only in 10.6+. When running this testcase on other versions (debug or optimized) you will run into apparently unrelated MDEV-29214 and MDEV-30083 crashes. Run this testcase against 10.6+ optimized builds only to get this specific bug/issue.

INSTALL SONAME 'ha_federatedx.so';
CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE 'test',user 'federatedx',PASSWORD'');
CREATE TABLE t (c INT) ENGINE=InnoDB;
CREATE TABLE t2 CONNECTION='srv/t' ENGINE=FEDERATED;
SET GLOBAL table_open_cache=4;
XA START 'xa';
INSERT INTO t2 VALUES (0);
INSERT INTO t VALUES (0);
HELP 'a';
SHOW CREATE EVENT e;
DELETE FROM mysql.user;
SELECT * FROM information_schema.check_constraints;

Leads to:

11.0.1 b075191ba8598af6aff5549e6e19f6255aef258a (Optimized)

Core was generated by `/test/MD090123-mariadb-11.0.1-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  ___pthread_mutex_lock (mutex=0x98) at ./nptl/pthread_mutex_lock.c:80
[Current thread is 1 (Thread 0x153e12850640 (LWP 1931935))]
(gdb) bt
#0  ___pthread_mutex_lock (mutex=0x98) at ./nptl/pthread_mutex_lock.c:80
#1  0x0000153e127f6a20 in inline_mysql_mutex_lock (that=0x98) at /test/11.0_opt/include/mysql/psi/mysql_thread.h:752
#2  federatedx_txn::release_scan (this=<optimized out>) at /test/11.0_opt/storage/federatedx/federatedx_txn.cc:201
#3  0x0000153e127f6aa4 in federatedx_txn::release (this=<optimized out>, ioptr=ioptr@entry=0x153dc80b7f98) at /test/11.0_opt/storage/federatedx/federatedx_txn.cc:171
#4  0x0000153e127f25dd in ha_federatedx::open (this=0x153dc80b7a50, name=<optimized out>, mode=<optimized out>, test_if_locked=<optimized out>) at /test/11.0_opt/storage/federatedx/ha_federatedx.cc:1808
#5  0x000055f73265ffce in handler::ha_open (this=0x153dc80b7a50, table_arg=table_arg@entry=0x153dcc01a478, name=0x153dc8025040 "./test/t2", mode=mode@entry=2, test_if_locked=test_if_locked@entry=18, mem_root=mem_root@entry=0x0, partitions_to_open=0x0) at /test/11.0_opt/sql/handler.cc:3349
#6  0x000055f732502e17 in open_table_from_share (thd=thd@entry=0x153dc8000c68, share=share@entry=0x153dc8024b90, alias=alias@entry=0x153dc80a9fc8, db_stat=db_stat@entry=33, prgflag=prgflag@entry=8, ha_open_flags=18, outparam=0x153dcc01a478, is_create_table=false, partitions_to_open=0x0) at /test/11.0_opt/sql/table.cc:4443
#7  0x000055f7323a2fb1 in open_table (thd=0x153dc8000c68, table_list=0x153dc80a9f80, ot_ctx=0x153e1284a3f0) at /test/11.0_opt/sql/sql_base.cc:2178
#8  0x000055f7323a6392 in open_and_process_table (ot_ctx=0x153e1284a3f0, has_prelocking_list=false, prelocking_strategy=0x153e1284a488, flags=1346, counter=0x153e1284a484, tables=0x153dc80a9f80, thd=0x153dc8000c68) at /test/11.0_opt/sql/sql_base.cc:4108
#9  open_tables (thd=thd@entry=0x153dc8000c68, options=@0x153e1284be10: {m_options = DDL_options_st::OPT_NONE}, start=start@entry=0x153e1284a478, counter=counter@entry=0x153e1284a484, flags=1346, prelocking_strategy=prelocking_strategy@entry=0x153e1284a488) at /test/11.0_opt/sql/sql_base.cc:4595
#10 0x000055f7323a6d24 in open_tables (prelocking_strategy=0x153e1284a488, flags=<optimized out>, counter=0x153e1284a484, tables=0x153e1284a478, thd=0x153dc8000c68) at /test/11.0_opt/sql/sql_base.h:266
#11 open_normal_and_derived_tables (thd=thd@entry=0x153dc8000c68, tables=<optimized out>, tables@entry=0x153dc80a9f80, flags=<optimized out>, dt_phases=dt_phases@entry=3) at /test/11.0_opt/sql/sql_base.cc:5633
#12 0x000055f7323a6dbe in open_tables_only_view_structure (thd=thd@entry=0x153dc8000c68, table_list=table_list@entry=0x153dc80a9f80, can_deadlock=can_deadlock@entry=true) at /test/11.0_opt/sql/sql_base.cc:5684
#13 0x000055f73249144d in fill_schema_table_by_open (thd=0x153dc8000c68, mem_root=<optimized out>, is_show_fields_or_keys=<optimized out>, table=0x153dc809b2a0, schema_table=0x55f73338c0e0 <schema_tables+192>, orig_db_name=0x153dc80a6c70, orig_table_name=0x153dc80a77f8, open_tables_state_backup=0x153e1284c670, can_deadlock=true) at /test/11.0_opt/sql/sql_show.cc:4712
#14 0x000055f7324a830a in get_all_tables (thd=0x153dc8000c68, tables=0x153dc8010e50, cond=<optimized out>) at /test/11.0_opt/sql/sql_show.cc:5383
#15 0x000055f7324a9a7e in get_schema_tables_result (join=join@entry=0x153dc8012208, executed_place=executed_place@entry=PROCESSED_BY_JOIN_EXEC) at /test/11.0_opt/sql/sql_show.cc:9044
#16 0x000055f73248d237 in JOIN::exec_inner (this=0x153dc8012208) at /test/11.0_opt/sql/sql_select.cc:4779
#17 0x000055f73248db08 in JOIN::exec (this=this@entry=0x153dc8012208) at /test/11.0_opt/sql/sql_select.cc:4600
#18 0x000055f73248bc11 in mysql_select (thd=0x153dc8000c68, tables=0x153dc8010e50, fields=@0x153dc8010ad8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x153dc8010dd0, last = 0x153dc8013210, elements = 6}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x153dc80121e0, unit=0x153dc8004ce8, select_lex=0x153dc8010838) at /test/11.0_opt/sql/sql_select.cc:5080
#19 0x000055f73248c354 in handle_select (thd=thd@entry=0x153dc8000c68, lex=lex@entry=0x153dc8004c10, result=result@entry=0x153dc80121e0, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/11.0_opt/sql/sql_select.cc:581
#20 0x000055f732407b25 in execute_sqlcom_select (thd=0x153dc8000c68, all_tables=0x153dc8010e50) at /test/11.0_opt/sql/sql_parse.cc:6265
#21 0x000055f732416870 in mysql_execute_command (thd=0x153dc8000c68, is_called_from_prepared_stmt=<optimized out>) at /test/11.0_opt/sql/sql_parse.cc:3949
#22 0x000055f732418104 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x153dc8000c68) at /test/11.0_opt/sql/sql_parse.cc:8000
#23 mysql_parse (thd=0x153dc8000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/11.0_opt/sql/sql_parse.cc:7922
#24 0x000055f73241a6e2 in dispatch_command (command=COM_QUERY, thd=0x153dc8000c68, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/11.0_opt/sql/sql_parse.cc:1991
#25 0x000055f73241be80 in do_command (thd=0x153dc8000c68, blocking=blocking@entry=true) at /test/11.0_opt/sql/sql_parse.cc:1407
#26 0x000055f732531ab7 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55f735794358, put_in_cache=put_in_cache@entry=true) at /test/11.0_opt/sql/sql_connect.cc:1416
#27 0x000055f732531d8d in handle_one_connection (arg=0x55f735794358) at /test/11.0_opt/sql/sql_connect.cc:1318
#28 0x0000153e2f6e1b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#29 0x0000153e2f773a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

10.11.2 70be59913c90e93fe5136d6f6df03c4254aa515d (Optimized, UBASAN)

==3440860==ERROR: AddressSanitizer: heap-use-after-free on address 0x6210000dea58 at pc 0x152cff55077d bp 0x152cff64bf60 sp 0x152cff64bf50
READ of size 8 at 0x6210000dea58 thread T14
    #0 0x152cff55077c in federatedx_txn::acquire(st_federatedx_share*, void*, bool, federatedx_io**) /test/10.11_opt_san/storage/federatedx/federatedx_txn.cc:112
    #1 0x152cff52fb4f in ha_federatedx::open(char const*, int, unsigned int) /test/10.11_opt_san/storage/federatedx/ha_federatedx.cc:1800
    #2 0x5591bb336f36 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/10.11_opt_san/sql/handler.cc:3349
    #3 0x5591ba628e9e in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/10.11_opt_san/sql/table.cc:4443
    #4 0x5591b9a7ec1e in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/10.11_opt_san/sql/sql_base.cc:2178
    #5 0x5591b9a95849 in open_and_process_table /test/10.11_opt_san/sql/sql_base.cc:4108
    #6 0x5591b9a95849 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/10.11_opt_san/sql/sql_base.cc:4595
    #7 0x5591b9a9a914 in open_tables /test/10.11_opt_san/sql/sql_base.h:266
    #8 0x5591b9a9a914 in open_normal_and_derived_tables(THD*, TABLE_LIST*, unsigned int, unsigned int) /test/10.11_opt_san/sql/sql_base.cc:5633
    #9 0x5591b9a9b0f4 in open_tables_only_view_structure(THD*, TABLE_LIST*, bool) /test/10.11_opt_san/sql/sql_base.cc:5684
    #10 0x5591ba2da464 in fill_schema_table_by_open /test/10.11_opt_san/sql/sql_show.cc:4712
    #11 0x5591ba37d855 in get_all_tables(THD*, TABLE_LIST*, Item*) /test/10.11_opt_san/sql/sql_show.cc:5383
    #12 0x5591ba389cf5 in get_schema_tables_result(JOIN*, enum_schema_table_state) /test/10.11_opt_san/sql/sql_show.cc:9044
    #13 0x5591ba2991bc in JOIN::exec_inner() /test/10.11_opt_san/sql/sql_select.cc:4779
    #14 0x5591ba29fce3 in JOIN::exec() /test/10.11_opt_san/sql/sql_select.cc:4600
    #15 0x5591ba28dbfd in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /test/10.11_opt_san/sql/sql_select.cc:5080
    #16 0x5591ba291750 in handle_select(THD*, LEX*, select_result*, unsigned long long) /test/10.11_opt_san/sql/sql_select.cc:581
    #17 0x5591b9e3cc80 in execute_sqlcom_select /test/10.11_opt_san/sql/sql_parse.cc:6265
    #18 0x5591b9ea205c in mysql_execute_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:3949
    #19 0x5591b9eb2d82 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_opt_san/sql/sql_parse.cc:8000
    #20 0x5591b9ec07e5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_opt_san/sql/sql_parse.cc:1894
    #21 0x5591b9ec9f40 in do_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:1407
    #22 0x5591ba7a671c in do_handle_one_connection(CONNECT*, bool) /test/10.11_opt_san/sql/sql_connect.cc:1416
    #23 0x5591ba7a8d1c in handle_one_connection /test/10.11_opt_san/sql/sql_connect.cc:1318
    #24 0x152d21760b42 in start_thread nptl/pthread_create.c:442
    #25 0x152d217f29ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
 
0x6210000dea58 is located 344 bytes inside of 4112-byte region [0x6210000de900,0x6210000df910)
freed by thread T14 here:
    #0 0x5591b95de537 in free (/test/UBASAN_MD070123-mariadb-10.11.2-linux-x86_64-opt/bin/mariadbd+0x7a20537)
    #1 0x5591bd9e09e6 in root_free /test/10.11_opt_san/mysys/my_alloc.c:78
    #2 0x5591bd9e09e6 in free_root /test/10.11_opt_san/mysys/my_alloc.c:501
    #3 0x152cff517ef2 in free_server /test/10.11_opt_san/storage/federatedx/ha_federatedx.cc:1699
    #4 0x152cff53416b in free_share /test/10.11_opt_san/storage/federatedx/ha_federatedx.cc:1732
    #5 0x152cff53416b in ha_federatedx::close() /test/10.11_opt_san/storage/federatedx/ha_federatedx.cc:1866
    #6 0x5591ba5f7123 in closefrm(TABLE*) /test/10.11_opt_san/sql/table.cc:4547
    #7 0x5591badca54e in intern_close_table /test/10.11_opt_san/sql/table_cache.cc:225
    #8 0x5591badca54e in tc_remove_table /test/10.11_opt_san/sql/table_cache.cc:263
    #9 0x5591badcaed2 in tc_add_table(THD*, TABLE*) /test/10.11_opt_san/sql/table_cache.cc:363
    #10 0x5591b9a7ed9c in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/10.11_opt_san/sql/sql_base.cc:2209
    #11 0x5591b9a95849 in open_and_process_table /test/10.11_opt_san/sql/sql_base.cc:4108
    #12 0x5591b9a95849 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/10.11_opt_san/sql/sql_base.cc:4595
    #13 0x5591b9a999cc in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /test/10.11_opt_san/sql/sql_base.cc:5569
    #14 0x5591b9ac697a in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /test/10.11_opt_san/sql/sql_base.h:510
    #15 0x5591b9ac697a in open_system_tables_for_read(THD*, TABLE_LIST*) /test/10.11_opt_san/sql/sql_base.cc:9488
    #16 0x5591ba3a8326 in open_stat_tables /test/10.11_opt_san/sql/sql_statistics.cc:250
    #17 0x5591ba3e333a in read_statistics_for_tables(THD*, TABLE_LIST*) /test/10.11_opt_san/sql/sql_statistics.cc:3317
    #18 0x5591b9a99df8 in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /test/10.11_opt_san/sql/sql_base.cc:5583
    #19 0x5591b9bcb0e9 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /test/10.11_opt_san/sql/sql_base.h:510
    #20 0x5591b9bcb0e9 in mysql_delete(THD*, TABLE_LIST*, Item*, SQL_I_List<st_order>*, unsigned long long, unsigned long long, select_result*) /test/10.11_opt_san/sql/sql_delete.cc:341
    #21 0x5591b9e9a8bd in mysql_execute_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:4809
    #22 0x5591b9eb2d82 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_opt_san/sql/sql_parse.cc:8000
    #23 0x5591b9ec07e5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_opt_san/sql/sql_parse.cc:1894
    #24 0x5591b9ec9f40 in do_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:1407
    #25 0x5591ba7a671c in do_handle_one_connection(CONNECT*, bool) /test/10.11_opt_san/sql/sql_connect.cc:1416
    #26 0x5591ba7a8d1c in handle_one_connection /test/10.11_opt_san/sql/sql_connect.cc:1318
    #27 0x152d21760b42 in start_thread nptl/pthread_create.c:442
 
previously allocated by thread T14 here:
    #0 0x5591b95de887 in malloc (/test/UBASAN_MD070123-mariadb-10.11.2-linux-x86_64-opt/bin/mariadbd+0x7a20887)
    #1 0x5591bda03d14 in my_malloc /test/10.11_opt_san/mysys/my_malloc.c:90
    #2 0x5591bd9de041 in root_alloc /test/10.11_opt_san/mysys/my_alloc.c:66
    #3 0x5591bd9de041 in init_alloc_root /test/10.11_opt_san/mysys/my_alloc.c:174
    #4 0x152cff51f48b in get_server /test/10.11_opt_san/storage/federatedx/ha_federatedx.cc:1547
    #5 0x152cff524b99 in get_share /test/10.11_opt_san/storage/federatedx/ha_federatedx.cc:1653
    #6 0x152cff52f934 in ha_federatedx::open(char const*, int, unsigned int) /test/10.11_opt_san/storage/federatedx/ha_federatedx.cc:1792
    #7 0x5591bb336f36 in handler::ha_open(TABLE*, char const*, int, unsigned int, st_mem_root*, List<String>*) /test/10.11_opt_san/sql/handler.cc:3349
    #8 0x5591ba628e9e in open_table_from_share(THD*, TABLE_SHARE*, st_mysql_const_lex_string const*, unsigned int, unsigned int, unsigned int, TABLE*, bool, List<String>*) /test/10.11_opt_san/sql/table.cc:4443
    #9 0x5591b9a7ec1e in open_table(THD*, TABLE_LIST*, Open_table_context*) /test/10.11_opt_san/sql/sql_base.cc:2178
    #10 0x5591b9a95849 in open_and_process_table /test/10.11_opt_san/sql/sql_base.cc:4108
    #11 0x5591b9a95849 in open_tables(THD*, DDL_options_st const&, TABLE_LIST**, unsigned int*, unsigned int, Prelocking_strategy*) /test/10.11_opt_san/sql/sql_base.cc:4595
    #12 0x5591b9a999cc in open_and_lock_tables(THD*, DDL_options_st const&, TABLE_LIST*, bool, unsigned int, Prelocking_strategy*) /test/10.11_opt_san/sql/sql_base.cc:5569
    #13 0x5591b9ca50d4 in open_and_lock_tables(THD*, TABLE_LIST*, bool, unsigned int) /test/10.11_opt_san/sql/sql_base.h:510
    #14 0x5591b9ca50d4 in mysql_insert(THD*, TABLE_LIST*, List<Item>&, List<List<Item> >&, List<Item>&, List<Item>&, enum_duplicates, bool, select_result*) /test/10.11_opt_san/sql/sql_insert.cc:767
    #15 0x5591b9e922b1 in mysql_execute_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:4567
    #16 0x5591b9eb2d82 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_opt_san/sql/sql_parse.cc:8000
    #17 0x5591b9ec07e5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_opt_san/sql/sql_parse.cc:1894
    #18 0x5591b9ec9f40 in do_command(THD*, bool) /test/10.11_opt_san/sql/sql_parse.cc:1407
    #19 0x5591ba7a671c in do_handle_one_connection(CONNECT*, bool) /test/10.11_opt_san/sql/sql_connect.cc:1416
    #20 0x5591ba7a8d1c in handle_one_connection /test/10.11_opt_san/sql/sql_connect.cc:1318
    #21 0x152d21760b42 in start_thread nptl/pthread_create.c:442
 
Thread T14 created by T0 here:
    #0 0x5591b95826c5 in pthread_create (/test/UBASAN_MD070123-mariadb-10.11.2-linux-x86_64-opt/bin/mariadbd+0x79c46c5)
    #1 0x5591b9636cfe in create_thread_to_handle_connection(CONNECT*) /test/10.11_opt_san/sql/mysqld.cc:6102
    #2 0x5591b964912f in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/10.11_opt_san/sql/mysqld.cc:6223
    #3 0x5591b964a0b7 in handle_connections_sockets() /test/10.11_opt_san/sql/mysqld.cc:6347
    #4 0x5591b964d11d in mysqld_main(int, char**) /test/10.11_opt_san/sql/mysqld.cc:5997
    #5 0x152d216f5d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
 
SUMMARY: AddressSanitizer: heap-use-after-free /test/10.11_opt_san/storage/federatedx/federatedx_txn.cc:112 in federatedx_txn::acquire(st_federatedx_share*, void*, bool, federatedx_io**)
Shadow bytes around the buggy address:
  0x0c4280013cf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4280013d00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4280013d10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4280013d20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4280013d30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c4280013d40: fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd
  0x0c4280013d50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4280013d60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4280013d70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4280013d80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4280013d90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3440860==ABORTING
230114 16:50:21 [ERROR] mysqld got signal 6 ;

This specific bug confirmed present in:
MariaDB: 10.6.12 (opt), 10.7.8 (opt), 10.8.7 (opt), 10.9.5 (opt), 10.10.3 (opt), 10.11.2 (dbg), 10.11.2 (opt), 11.0.1 (opt)

This specific bug (or feature/syntax) confirmed not present in:
MariaDB: 10.3.38 (dbg), 10.3.38 (opt), 10.4.28 (dbg), 10.4.28 (opt), 10.5.19 (dbg), 10.5.19 (opt), 10.6.12 (dbg), 10.7.8 (dbg), 10.8.7 (dbg), 10.9.5 (dbg), 10.10.3 (dbg), 11.0.1 (dbg)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.40 (dbg), 5.7.40 (opt), 8.0.31 (dbg), 8.0.31 (opt)



 Comments   
Comment by Roel Van de Paar [ 2023-01-14 ]

How this testcase plays out against all releases dbg/opt. (10.3 and 10.4 are totally unaffected). [*] Marked entries are the specific bug described above.

MD070123-mariadb-10.5.19-linux-x86_64-opt: SIGSEGV|federatedx_txn::txn_rollback|federatedx_txn::txn_rollback|ha_rollback_trans|xa_trans_force_rollback
 
MD070123-mariadb-10.6.12-linux-x86_64-opt: SIGSEGV|___pthread_mutex_lock|inline_mysql_mutex_lock|federatedx_txn::release_scan|federatedx_txn::release [*]
MD070123-mariadb-10.7.8-linux-x86_64-opt:  SIGSEGV|___pthread_mutex_lock|inline_mysql_mutex_lock|federatedx_txn::release_scan|federatedx_txn::release [*]
MD070123-mariadb-10.8.7-linux-x86_64-opt:  SIGSEGV|___pthread_mutex_lock|inline_mysql_mutex_lock|federatedx_txn::release_scan|federatedx_txn::release [*]
MD070123-mariadb-10.9.5-linux-x86_64-opt:  SIGSEGV|___pthread_mutex_lock|inline_mysql_mutex_lock|federatedx_txn::release_scan|federatedx_txn::release [*]
MD070123-mariadb-10.10.3-linux-x86_64-opt: SIGSEGV|___pthread_mutex_lock|inline_mysql_mutex_lock|federatedx_txn::release_scan|federatedx_txn::release [*]
MD070123-mariadb-10.11.2-linux-x86_64-opt: SIGSEGV|___pthread_mutex_lock|inline_mysql_mutex_lock|federatedx_txn::release_scan|federatedx_txn::release [*]
MD090123-mariadb-11.0.1-linux-x86_64-opt:  SIGSEGV|___pthread_mutex_lock|inline_mysql_mutex_lock|federatedx_txn::release_scan|federatedx_txn::release [*]
 
MD070123-mariadb-10.5.19-linux-x86_64-dbg: server->io_count == 0|SIGABRT|free_server|free_share|ha_federatedx::close|handler::ha_close
MD070123-mariadb-10.6.12-linux-x86_64-dbg: server->io_count == 0|SIGABRT|free_server|free_share|ha_federatedx::close|handler::ha_close
MD070123-mariadb-10.7.8-linux-x86_64-dbg:  server->io_count == 0|SIGABRT|free_server|free_share|ha_federatedx::close|handler::ha_close
MD070123-mariadb-10.8.7-linux-x86_64-dbg:  server->io_count == 0|SIGABRT|free_server|free_share|ha_federatedx::close|handler::ha_close
MD070123-mariadb-10.9.5-linux-x86_64-dbg:  server->io_count == 0|SIGABRT|free_server|free_share|ha_federatedx::close|handler::ha_close
MD070123-mariadb-10.10.3-linux-x86_64-dbg: server->io_count == 0|SIGABRT|free_server|free_share|ha_federatedx::close|handler::ha_close
MD070123-mariadb-10.11.2-linux-x86_64-dbg: server->io_count == 0|SIGABRT|free_server|free_share|ha_federatedx::close|handler::ha_close
MD090123-mariadb-11.0.1-linux-x86_64-dbg:  server->io_count == 0|SIGABRT|free_server|free_share|ha_federatedx::close|handler::ha_close

Comment by Roel Van de Paar [ 2023-01-14 ]

MTR Testcase

--let $SOCKET= `SELECT @@global.socket`
--source include/have_innodb.inc
INSTALL SONAME 'ha_federatedx.so';
CREATE USER federatedx@localhost IDENTIFIED BY 'a';
GRANT ALL ON test.* TO federatedx@localhost;
eval CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET "$SOCKET",DATABASE 'test',user 'federatedx',PASSWORD'a');
CREATE TABLE t (c INT) ENGINE=InnoDB;
CREATE TABLE t2 CONNECTION='srv/t' ENGINE=FEDERATED;
SET GLOBAL table_open_cache=4;
XA START 'xa';
INSERT INTO t2 VALUES (0);
INSERT INTO t VALUES (0);
HELP 'a';
--error 1539
SHOW CREATE EVENT e;
DELETE FROM mysql.user;
SELECT * FROM information_schema.check_constraints;

Generated at Thu Feb 08 10:16:03 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.