[MDEV-32347] Stack smashing/looping, ASAN use-after-poison in xid_t::eq/event_xid_t::serialize, SIGSEGV in serialize_xid and Assertion `is_async_xac || thd->lex->xid->eq(thd->transaction->xid_state.get_xid())' failed in binlog_rollback_flush_trx_cache upon LOAD INDEX Created: 2023-10-04  Updated: 2023-10-17  Resolved: 2023-10-14

Status: Closed
Project: MariaDB Server
Component/s: Binary Protocol, XA
Affects Version/s: N/A
Fix Version/s: N/A

Type: Bug Priority: Critical
Reporter: Roel Van de Paar Assignee: Roel Van de Paar
Resolution: Fixed Votes: 0
Labels: ASAN, affects-tests, memory_corruption, stack-looping, stack-smashing

Issue Links:
Blocks
blocks MDEV-31949 slow parallel replication of user xa In Review
Duplicate
is duplicated by MDEV-32463 SIGSEGV in __memmove_avx_unaligned_er... Closed
is duplicated by MDEV-32470 MDEV-31949: use-after-poison in xid_t... Closed
Problem/Incident
is caused by MDEV-31949 slow parallel replication of user xa In Review
Relates
relates to MDEV-32455 Implicit rollback by LOAD INDEX or CA... Confirmed

 Description    

--source include/have_binlog_format_row.inc
 
CREATE TABLE t (c INT KEY);
 
XA START 'a';
 
INSERT INTO t VALUES (1);
 
XA END 'a';
 
XA PREPARE 'a';
 
LOAD INDEX INTO CACHE c KEY(PRIMARY);

Leads to:

bb-10.6-MDEV-31949 3455be1b4a925f43a1e7170029abf3304122409f

 
mariadbd: /test/bb-10.6-MDEV-31949_PATCH3_dbg/sql/log.cc:1908: int binlog_rollback_flush_trx_cache(THD*, bool, binlog_cache_mngr*): Assertion `is_async_xac || thd->lex->xid->eq(thd->transaction->xid_state.get_xid())' failed.

bb-10.6-MDEV-31949 3455be1b4a925f43a1e7170029abf3304122409f

 
Core was generated by `/test/PATCH3_MD031023-mariadb-10.6.16-linux-x86_64-dbg/bin/mariadbd --defaults-'.
 
Program terminated with signal SIGABRT, Aborted.
 
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=23118334043712)
 
    at ./nptl/pthread_kill.c:44
 
[Current thread is 1 (Thread 0x1506a816a640 (LWP 2099466))]
 
(gdb) bt
 
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=23118334043712) at ./nptl/pthread_kill.c:44
 
#1  __pthread_kill_internal (signo=6, threadid=23118334043712) at ./nptl/pthread_kill.c:78
 
#2  __GI___pthread_kill (threadid=23118334043712, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
 
#3  0x00001506ad842476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
 
#4  0x00001506ad8287f3 in __GI_abort () at ./stdlib/abort.c:79
 
#5  0x00001506ad82871b in __assert_fail_base (fmt=0x1506ad9dd150 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x561808af9ef8 "is_async_xac || thd->lex->xid->eq(thd->transaction->xid_state.get_xid())", file=0x561808af57d0 "/test/bb-10.6-MDEV-31949_PATCH3_dbg/sql/log.cc", line=1908, function=<optimized out>) at ./assert/assert.c:92
 
#6  0x00001506ad839e96 in __GI___assert_fail (assertion=0x561808af9ef8 "is_async_xac || thd->lex->xid->eq(thd->transaction->xid_state.get_xid())", file=0x561808af57d0 "/test/bb-10.6-MDEV-31949_PATCH3_dbg/sql/log.cc", line=1908, function=0x561808af9f48 "int binlog_rollback_flush_trx_cache(THD*, bool, binlog_cache_mngr*)") at ./assert/assert.c:101
 
#7  0x000056180817ccc9 in binlog_rollback_flush_trx_cache (thd=thd@entry=0x15068c000d58, all=all@entry=true, cache_mngr=cache_mngr@entry=0x15068c053cb8) at /test/bb-10.6-MDEV-31949_PATCH3_dbg/sql/log.cc:1908
 
#8  0x000056180817d2c9 in binlog_rollback (hton=<optimized out>, thd=0x15068c000d58, all=<optimized out>) at /test/bb-10.6-MDEV-31949_PATCH3_dbg/sql/log.cc:2402
 
#9  0x000056180802e72c in ha_rollback_trans (thd=thd@entry=0x15068c000d58, all=all@entry=true) at /test/bb-10.6-MDEV-31949_PATCH3_dbg/sql/handler.cc:2224
 
#10 0x0000561807ed4841 in trans_rollback_implicit (thd=thd@entry=0x15068c000d58) at /test/bb-10.6-MDEV-31949_PATCH3_dbg/sql/transaction.cc:421
 
#11 0x0000561807ed288b in mysql_admin_table (thd=thd@entry=0x15068c000d58, tables=tables@entry=0x15068c0147c0, check_opt=check_opt@entry=0x0, operator_name=operator_name@entry=0x5618091e5160 <msg_preload_keys>, lock_type=lock_type@entry=TL_READ_NO_INSERT, org_open_for_modify=org_open_for_modify@entry=false, repair_table_use_frm=false, extra_open_options=0, prepare_func=0x0, operator_func=<optimized out>, view_operator_func=0x0, is_cmd_replicated=false) at /test/bb-10.6-MDEV-31949_PATCH3_dbg/sql/sql_admin.cc:1326
 
#12 0x0000561807ed32a5 in mysql_preload_keys (thd=thd@entry=0x15068c000d58, tables=tables@entry=0x15068c0147c0) at /test/bb-10.6-MDEV-31949_PATCH3_dbg/sql/sql_admin.cc:1470
 
#13 0x0000561807d756c8 in mysql_execute_command (thd=thd@entry=0x15068c000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/bb-10.6-MDEV-31949_PATCH3_dbg/sql/sql_parse.cc:4103
 
#14 0x0000561807d7c492 in mysql_parse (thd=thd@entry=0x15068c000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1506a81691f0) at /test/bb-10.6-MDEV-31949_PATCH3_dbg/sql/sql_parse.cc:8050
 
#15 0x0000561807d7e808 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x15068c000d58, packet=packet@entry=0x15068c00b0a9 "", packet_length=packet_length@entry=36, blocking=blocking@entry=true) at /test/bb-10.6-MDEV-31949_PATCH3_dbg/sql/sql_class.h:241
 
#16 0x0000561807d80925 in do_command (thd=0x15068c000d58, blocking=blocking@entry=true) at /test/bb-10.6-MDEV-31949_PATCH3_dbg/sql/sql_parse.cc:1409
 
#17 0x0000561807ebf76d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x56180ad28e78, put_in_cache=put_in_cache@entry=true) at /test/bb-10.6-MDEV-31949_PATCH3_dbg/sql/sql_connect.cc:1416
 
#18 0x0000561807ebfa62 in handle_one_connection (arg=arg@entry=0x56180ad28e78) at /test/bb-10.6-MDEV-31949_PATCH3_dbg/sql/sql_connect.cc:1318
 
#19 0x000056180830d4f6 in pfs_spawn_thread (arg=0x56180acbbb78) at /test/bb-10.6-MDEV-31949_PATCH3_dbg/storage/perfschema/pfs.cc:2201
 
#20 0x00001506ad894b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
 
#21 0x00001506ad926a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

bb-10.6-MDEV-31949 3455be1b4a925f43a1e7170029abf3304122409f

 
Core was generated by `/test/PATCH3_MD031023-mariadb-10.6.16-linux-x86_64-opt/bin/mariadbd --defaults-'.
 
Program terminated with signal SIGSEGV, Segmentation fault.
 
#0  0x000055fa07f38c2c in serialize_xid (dat=0x1490c4010b98 "c", 
    bln=22611996202680, gln=94532378857040, fmt=693719617, 
    buf=0x1490e08aea7c "X'630001c49014", '0' <repeats 36 times>, "980b01c49014000001", '0' <repeats 30 times>, "f80b01c490140000f80b01c49014000001", '0' <repeats 15 times>, "100000007140000146a5508fa55000007", '0' <repeats 14 times>, "508edc"...) at /test/bb-10.6-MDEV-31949_PATCH3_opt/sql/log_event.h:3166
 
[Current thread is 1 (LWP 2106500)]
 
(gdb) bt
 
#0  0x000055fa07f38c2c in serialize_xid (dat=0x1490c4010b98 "c", bln=22611996202680, gln=94532378857040, fmt=693719617, buf=0x1490e08aea7c "X'630001c49014", '0' <repeats 36 times>, "980b01c49014000001", '0' <repeats 30 times>, "f80b01c490140000f80b01c49014000001", '0' <repeats 15 times>, "100000007140000146a5508fa55000007", '0' <repeats 14 times>, "508edc"...) at /test/bb-10.6-MDEV-31949_PATCH3_opt/sql/log_event.h:3166
 
#1  event_xid_t::serialize (buf_arg=0x1490e08aea7c "X'630001c49014", '0' <repeats 36 times>, "980b01c49014000001", '0' <repeats 30 times>, "f80b01c490140000f80b01c49014000001", '0' <repeats 15 times>, "100000007140000146a5508fa55000007", '0' <repeats 14 times>, "508edc"..., this=0x1490c4010b80) at /test/bb-10.6-MDEV-31949_PATCH3_opt/sql/log_event.h:3215
 
#2  serialize_with_xid (q_len=12, query=0x1490e08aea63 "XA ROLLBACK ", buf=0x1490e08aea70 "XA ROLLBACK X'630001c49014", '0' <repeats 36 times>, "980b01c49014000001", '0' <repeats 30 times>, "f80b01c490140000f80b01c49014000001", '0' <repeats 15 times>, "100000007140000146a5508fa5500000700000000"..., xid=0x1490c4010b80) at /test/bb-10.6-MDEV-31949_PATCH3_opt/sql/log.cc:1838
 
#3  binlog_rollback_flush_trx_cache (thd=0x1490c4000c68, all=<optimized out>, cache_mngr=0x1490c403ea28) at /test/bb-10.6-MDEV-31949_PATCH3_opt/sql/log.cc:1910
 
#4  0x3030303030303030 in ?? ()
 
#5  0x3030303030303030 in ?? ()
 
#6  0x3030303030303030 in ?? ()
 
#7  0x3030303030303030 in ?? ()
 
#8  0x3030303030303030 in ?? ()
 
#9  0x3030303030303030 in ?? ()
 
...
 
#989 0x3030303030303030 in ?? ()
 
#990 0x3030303030303030 in ?? ()
 
#991 0x3030303030303030 in ?? ()
 
#992 0x3030303030303030 in ?? ()



 Comments   
Comment by Roel Van de Paar [ 2023-10-04 ]

Issues not present in 10.6 base, which however does produce this outcome:

bb-10.6-MDEV-31949 d13a57ae8181f2a8fbee86838d5476740e050d50 (Debug)

 
10.6.16-dbg>LOAD INDEX INTO CACHE c KEY(PRIMARY);
 
+--------+--------------+----------+-----------------------------------------------------------------------------------------------+
 
| Table  | Op           | Msg_type | Msg_text                                                                                      |
 
+--------+--------------+----------+-----------------------------------------------------------------------------------------------+
 
| test.c | preload_keys | Error    | XAER_RMFAIL: The command cannot be executed when global transaction is in the  PREPARED state |
 
| test.c | preload_keys | Error    | XAER_RMFAIL: The command cannot be executed when global transaction is in the  PREPARED state |
 
| test.c | preload_keys | error    | Corrupt                                                                                       |
 
+--------+--------------+----------+-----------------------------------------------------------------------------------------------+
 
3 rows in set (0.003 sec)

Same result on optimized builds.

Comment by Roel Van de Paar [ 2023-10-04 ]

Additional testcase yielding a ASAN use-after-poison in event_xid_t::serialize (optimized builds) and xid_t::eq and (debug builds):

--source include/have_binlog_format_row.inc
 
CREATE TABLE t (a INT);
 
XA START 'a';
 
INSERT INTO t VALUES (1);
 
XA END 'a';
 
XA PREPARE 'a';
 
--error ER_XAER_RMFAIL
 
XA START 'a';
 
LOAD INDEX INTO CACHE t IGNORE LEAVES;

Leads to:

bb-10.6-MDEV-31949 3455be1b4a925f43a1e7170029abf3304122409f (Optimized, UBASAN)

 
==3694900==ERROR: AddressSanitizer: use-after-poison on address 0x62b000093308 at pc 0x55aaebd597f0 bp 0x151854bdbb70 sp 0x151854bdbb60
 
READ of size 8 at 0x62b000093308 thread T6
 
    #0 0x55aaebd597ef in event_xid_t::serialize(char*) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/log_event.h:3215
 
    #1 0x55aaebd597ef in serialize_with_xid(xid_t*, char*, char const*, unsigned long) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/log.cc:1838
 
    #2 0x55aaebd597ef in binlog_rollback_flush_trx_cache /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/log.cc:1910
 
    #3 0x55aaebd5a080 in binlog_rollback /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/log.cc:2402
 
    #4 0x55aaeb172ed2 in ha_rollback_trans(THD*, bool) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/handler.cc:2224
 
    #5 0x55aaea698e8f in trans_rollback_implicit(THD*) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/transaction.cc:421
 
    #6 0x55aaea682a90 in mysql_admin_table /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_admin.cc:1326
 
    #7 0x55aaea693543 in mysql_preload_keys(THD*, TABLE_LIST*) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_admin.cc:1470
 
    #8 0x55aae9d8196e in mysql_execute_command(THD*, bool) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_parse.cc:4103
 
    #9 0x55aae9d971e2 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_parse.cc:8050
 
    #10 0x55aae9da3255 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_parse.cc:1896
 
    #11 0x55aae9dae630 in do_command(THD*, bool) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_parse.cc:1409
 
    #12 0x55aaea612bdc in do_handle_one_connection(CONNECT*, bool) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_connect.cc:1416
 
    #13 0x55aaea6151dc in handle_one_connection /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_connect.cc:1318
 
    #14 0x15185a494b42 in start_thread nptl/pthread_create.c:442
 
    #15 0x15185a5269ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
 
 
 
0x62b000093308 is located 264 bytes inside of 24624-byte region [0x62b000093200,0x62b000099230)
 
allocated by thread T6 here:
 
    #0 0x55aae96583f7 in __interceptor_malloc (/test/PATCH3_UBASAN_MD031023-mariadb-10.6.16-linux-x86_64-opt/bin/mariadbd+0x77113f7)
 
    #1 0x55aaed918644 in my_malloc /test/bb-10.6-MDEV-31949_PATCH3_opt_san/mysys/my_malloc.c:91
 
    #2 0x55aaed8f3d9f in reset_root_defaults /test/bb-10.6-MDEV-31949_PATCH3_opt_san/mysys/my_alloc.c:156
 
    #3 0x55aae9a4959e in THD::init_for_queries() /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_class.cc:1412
 
    #4 0x55aaea60d70e in prepare_new_connection_state(THD*) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_connect.cc:1245
 
    #5 0x55aaea60eff7 in thd_prepare_connection(THD*) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_connect.cc:1339
 
    #6 0x55aaea60eff7 in thd_prepare_connection(THD*) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_connect.cc:1328
 
    #7 0x55aaea611c77 in do_handle_one_connection(CONNECT*, bool) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_connect.cc:1406
 
    #8 0x55aaea6151dc in handle_one_connection /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_connect.cc:1318
 
    #9 0x15185a494b42 in start_thread nptl/pthread_create.c:442
 
 
 
Thread T6 created by T0 here:
 
    #0 0x55aae95fc215 in __interceptor_pthread_create (/test/PATCH3_UBASAN_MD031023-mariadb-10.6.16-linux-x86_64-opt/bin/mariadbd+0x76b5215)
 
    #1 0x55aae96ae11e in create_thread_to_handle_connection(CONNECT*) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/mysqld.cc:5996
 
    #2 0x55aae96bfc4f in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/mysqld.cc:6117
 
    #3 0x55aae96c0a97 in handle_connections_sockets() /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/mysqld.cc:6241
 
    #4 0x55aae96c3a6d in mysqld_main(int, char**) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/mysqld.cc:5891
 
    #5 0x15185a429d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
 
 
 
SUMMARY: AddressSanitizer: use-after-poison /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/log_event.h:3215 in event_xid_t::serialize(char*)
 
Shadow bytes around the buggy address:
 
  0x0c568000a610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c568000a620: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c568000a630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c568000a640: 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00
 
  0x0c568000a650: 00 00 00 00 00 00 04 f7 00 00 00 00 06 f7 00 00
 
=>0x0c568000a660: f7[02]f7 00 00 00 00 00 f7 00 00 00 f7 02 f7 00
 
  0x0c568000a670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c568000a680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c568000a690: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c568000a6a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c568000a6b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==3694900==ABORTING
 
231004 15:00:33 [ERROR] mysqld got signal 6 ;

bb-10.6-MDEV-31949 3455be1b4a925f43a1e7170029abf3304122409f (Debug, UBASAN)

 
==3316626==ERROR: AddressSanitizer: use-after-poison on address 0x62b000093300 at pc 0x55e9f8fcfc5d bp 0x1548ba0d3e50 sp 0x1548ba0d3e40
 
READ of size 8 at 0x62b000093300 thread T6
 
    #0 0x55e9f8fcfc5c in xid_t::eq(long, long, char const*) const /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/handler.h:894
 
    #1 0x55e9f8fcfc5c in xid_t::eq(xid_t*) const /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/handler.h:892
 
    #2 0x55e9f8fcfc5c in binlog_rollback_flush_trx_cache /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/log.cc:1908
 
    #3 0x55e9f8fd275b in binlog_rollback /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/log.cc:2402
 
    #4 0x55e9f825a5da in ha_rollback_trans(THD*, bool) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/handler.cc:2224
 
    #5 0x55e9f763f592 in trans_rollback_implicit(THD*) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/transaction.cc:421
 
    #6 0x55e9f762d49f in mysql_admin_table /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_admin.cc:1326
 
    #7 0x55e9f7635e63 in mysql_preload_keys(THD*, TABLE_LIST*) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_admin.cc:1470
 
    #8 0x55e9f6c377e9 in mysql_execute_command(THD*, bool) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_parse.cc:4103
 
    #9 0x55e9f6c61269 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_parse.cc:8050
 
    #10 0x55e9f6c70fcd in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_parse.cc:1896
 
    #11 0x55e9f6c7f04a in do_command(THD*, bool) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_parse.cc:1409
 
    #12 0x55e9f75a818d in do_handle_one_connection(CONNECT*, bool) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_connect.cc:1416
 
    #13 0x55e9f75a96a8 in handle_one_connection /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_connect.cc:1318
 
    #14 0x1548bfc94b42 in start_thread nptl/pthread_create.c:442
 
    #15 0x1548bfd269ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
 
 
 
0x62b000093300 is located 256 bytes inside of 24624-byte region [0x62b000093200,0x62b000099230)
 
allocated by thread T6 here:
 
    #0 0x55e9f64af387 in malloc (/test/PATCH3_UBASAN_MD031023-mariadb-10.6.16-linux-x86_64-dbg/bin/mariadbd+0x7647387)
 
    #1 0x55e9faaa2828 in my_malloc /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/mysys/my_malloc.c:91
 
    #2 0x55e9faa81be2 in reset_root_defaults /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/mysys/my_alloc.c:156
 
    #3 0x55e9f68db731 in THD::init_for_queries() /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_class.cc:1412
 
    #4 0x55e9f75a3ea4 in prepare_new_connection_state(THD*) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_connect.cc:1245
 
    #5 0x55e9f75a5652 in thd_prepare_connection(THD*) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_connect.cc:1339
 
    #6 0x55e9f75a8a0c in do_handle_one_connection(CONNECT*, bool) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_connect.cc:1406
 
    #7 0x55e9f75a96a8 in handle_one_connection /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_connect.cc:1318
 
    #8 0x1548bfc94b42 in start_thread nptl/pthread_create.c:442
 
 
 
Thread T6 created by T0 here:
 
    #0 0x55e9f64531a5 in pthread_create (/test/PATCH3_UBASAN_MD031023-mariadb-10.6.16-linux-x86_64-dbg/bin/mariadbd+0x75eb1a5)
 
    #1 0x55e9f6509084 in create_thread_to_handle_connection(CONNECT*) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/mysqld.cc:5996
 
    #2 0x55e9f6515002 in create_new_thread(CONNECT*) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/mysqld.cc:6055
 
    #3 0x55e9f651585e in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/mysqld.cc:6117
 
    #4 0x55e9f6516a7e in handle_connections_sockets() /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/mysqld.cc:6241
 
    #5 0x55e9f651d73e in mysqld_main(int, char**) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/mysqld.cc:5891
 
    #6 0x55e9f64f4f2a in main /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/main.cc:34
 
    #7 0x1548bfc29d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
 
 
 
SUMMARY: AddressSanitizer: use-after-poison /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/handler.h:894 in xid_t::eq(long, long, char const*) const
 
Shadow bytes around the buggy address:
 
  0x0c568000a610: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c568000a620: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c568000a630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c568000a640: 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00
 
  0x0c568000a650: 00 00 00 00 00 00 04 f7 00 00 00 00 06 f7 00 00
 
=>0x0c568000a660:[f7]02 f7 00 00 00 00 00 f7 00 00 00 f7 02 f7 00
 
  0x0c568000a670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c568000a680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c568000a690: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c568000a6a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c568000a6b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==3316626==ABORTING
 
231004 14:13:49 [ERROR] mysqld got signal 6 ;

Comment by Roel Van de Paar [ 2023-10-04 ]

All UniqueID's/stacks seen so far for this ticket:

is_async_xac || thd->lex->xid->eq(thd->transaction->xid_state.get_xid())|SIGABRT|binlog_rollback_flush_trx_cache|binlog_rollback|ha_rollback_trans|trans_rollback_implicit
 
SIGSEGV|serialize_xid|event_xid_t::serialize|serialize_with_xid|binlog_rollback_flush_trx_cache
 
ASAN|use-after-poison|sql/handler.h|xid_t::eq|xid_t::eq|binlog_rollback_flush_trx_cache|binlog_rollback
 
ASAN|use-after-poison|sql/log_event.h|event_xid_t::serialize|serialize_with_xid|binlog_rollback_flush_trx_cache|binlog_rollback
 
ASAN|use-after-poison|sql/handler.h|xid_t::is_null|xid_t::eq|xid_t::eq|binlog_rollback_flush_trx_cache
 
ASAN|use-after-poison|sql/log_event.h|serialize_xid|event_xid_t::serialize|serialize_with_xid|binlog_rollback_flush_trx_cache

Comment by Roel Van de Paar [ 2023-10-05 ]

Another ASAN stack observed on debug builds with this testcase. The issue could not be reproduced in MTR, in CLI only.

# mysqld options required for replay:  --log-bin
 
CREATE TABLE t1 (c INT);
 
ALTER TABLE t1 ADD c2 BLOB;
 
XA START 'a';
 
INSERT INTO t1 VALUES(0,0);
 
XA END 'a';
 
XA PREPARE 'a';
 
LOAD INDEX INTO CACHE t1 INDEX (`PRIMARY`);

Leads to:

bb-10.6-MDEV-31949 3455be1b4a925f43a1e7170029abf3304122409f (Debug, UBASAN)

 
==1986981==ERROR: AddressSanitizer: use-after-poison on address 0x62b0000b62f8 at pc 0x55f1cac99c44 bp 0x151d26778e50 sp 0x151d26778e40
 
READ of size 8 at 0x62b0000b62f8 thread T27
 
    #0 0x55f1cac99c43 in xid_t::is_null() const /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/handler.h:923
 
    #1 0x55f1cac99c43 in xid_t::eq(long, long, char const*) const /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/handler.h:894
 
    #2 0x55f1cac99c43 in xid_t::eq(xid_t*) const /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/handler.h:892
 
    #3 0x55f1cac99c43 in binlog_rollback_flush_trx_cache /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/log.cc:1908
 
    #4 0x55f1cac9c75b in binlog_rollback /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/log.cc:2402
 
    #5 0x55f1c9f245da in ha_rollback_trans(THD*, bool) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/handler.cc:2224
 
    #6 0x55f1c9309592 in trans_rollback_implicit(THD*) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/transaction.cc:421
 
    #7 0x55f1c92f749f in mysql_admin_table /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_admin.cc:1326
 
    #8 0x55f1c92ffe63 in mysql_preload_keys(THD*, TABLE_LIST*) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_admin.cc:1470
 
    #9 0x55f1c89017e9 in mysql_execute_command(THD*, bool) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_parse.cc:4103
 
    #10 0x55f1c892b269 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_parse.cc:8050
 
    #11 0x55f1c893afcd in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_parse.cc:1896
 
    #12 0x55f1c894904a in do_command(THD*, bool) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_parse.cc:1409
 
    #13 0x55f1c927218d in do_handle_one_connection(CONNECT*, bool) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_connect.cc:1416
 
    #14 0x55f1c92736a8 in handle_one_connection /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_connect.cc:1318
 
    #15 0x151d4a694ac2 in start_thread nptl/pthread_create.c:442
 
    #16 0x151d4a726a3f  (/lib/x86_64-linux-gnu/libc.so.6+0x126a3f)
 
 
 
0x62b0000b62f8 is located 248 bytes inside of 24624-byte region [0x62b0000b6200,0x62b0000bc230)
 
allocated by thread T27 here:
 
    #0 0x55f1c8179387 in malloc (/test/PATCH3_UBASAN_MD031023-mariadb-10.6.16-linux-x86_64-dbg/bin/mariadbd+0x7647387)
 
    #1 0x55f1cc76c828 in my_malloc /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/mysys/my_malloc.c:91
 
    #2 0x55f1cc74bbe2 in reset_root_defaults /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/mysys/my_alloc.c:156
 
    #3 0x55f1c85a5731 in THD::init_for_queries() /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_class.cc:1412
 
    #4 0x55f1c926dea4 in prepare_new_connection_state(THD*) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_connect.cc:1245
 
    #5 0x55f1c926f652 in thd_prepare_connection(THD*) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_connect.cc:1339
 
    #6 0x55f1c9272a0c in do_handle_one_connection(CONNECT*, bool) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_connect.cc:1406
 
    #7 0x55f1c92736a8 in handle_one_connection /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/sql_connect.cc:1318
 
    #8 0x151d4a694ac2 in start_thread nptl/pthread_create.c:442
 
 
 
Thread T27 created by T0 here:
 
    #0 0x55f1c811d1a5 in pthread_create (/test/PATCH3_UBASAN_MD031023-mariadb-10.6.16-linux-x86_64-dbg/bin/mariadbd+0x75eb1a5)
 
    #1 0x55f1c81d3084 in create_thread_to_handle_connection(CONNECT*) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/mysqld.cc:5996
 
    #2 0x55f1c81df002 in create_new_thread(CONNECT*) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/mysqld.cc:6055
 
    #3 0x55f1c81df85e in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/mysqld.cc:6117
 
    #4 0x55f1c81e0a7e in handle_connections_sockets() /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/mysqld.cc:6241
 
    #5 0x55f1c81e773e in mysqld_main(int, char**) /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/mysqld.cc:5891
 
    #6 0x55f1c81bef2a in main /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/main.cc:34
 
    #7 0x151d4a629d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
 
 
 
SUMMARY: AddressSanitizer: use-after-poison /test/bb-10.6-MDEV-31949_PATCH3_dbg_san/sql/handler.h:923 in xid_t::is_null() const
 
Shadow bytes around the buggy address:
 
  0x0c568000ec00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c568000ec10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c568000ec20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c568000ec30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c568000ec40: 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00
 
=>0x0c568000ec50: 00 00 00 00 00 00 00 01 f7 00 00 00 00 00 03[f7]
 
  0x0c568000ec60: 00 00 f7 03 f7 00 00 00 00 00 f7 00 00 00 f7 00
 
  0x0c568000ec70: f7 00 f7 00 00 00 f7 00 00 f7 03 f7 00 00 00 00
 
  0x0c568000ec80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c568000ec90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c568000eca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==1986981==ABORTING
 
231005 16:06:40 [ERROR] mysqld got signal 6 ;

Comment by Roel Van de Paar [ 2023-10-07 ]

Another testcase

--source include/have_binlog_format_row.inc
 
CREATE TABLE t (c INT);
 
XA START 'a';
 
INSERT INTO t VALUES (1);
 
XA END 'a';
 
XA PREPARE 'a';
 
SET collation_connection=utf32_unicode_ci;
 
--error ER_XAER_OUTSIDE  # ?
 
XA COMMIT 'a';
 
LOAD INDEX INTO CACHE c1;

As well as

--source include/have_binlog_format_row.inc
 
--source include/have_partition.inc
 
SET sql_mode='';
 
CREATE TABLE t (a BINARY (1),KEY(a)) PARTITION BY KEY(a) PARTITIONS 1;
 
XA START 'a';
 
INSERT INTO t VALUES (1);
 
XA END 'a';
 
XA PREPARE 'a';
 
CACHE INDEX t PARTITION (ALL) KEY(inx_b,PRIMARY) IN DEFAULT;

Both lead to stacks already listed above. However, in both cases the following, as yet unseen use-after-poison in serialize_xid bug was observed also:

bb-10.6-MDEV-31949 3455be1b4a925f43a1e7170029abf3304122409f

 
==62489==ERROR: AddressSanitizer: use-after-poison on address 0x62b0000c431a at pc 0x55f42612c34f bp 0x14da305c0a90 sp 0x14da305c0a80
 
READ of size 1 at 0x62b0000c431a thread T14
 
    #0 0x55f42612c34e in serialize_xid(char*, long, long, long, char const*) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/log_event.h:3166
 
    #1 0x55f42612c34e in event_xid_t::serialize(char*) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/log_event.h:3215
 
    #2 0x55f42612c34e in serialize_with_xid(xid_t*, char*, char const*, unsigned long) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/log.cc:1838
 
    #3 0x55f42612c34e in binlog_rollback_flush_trx_cache /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/log.cc:1910
 
    #4 0x55f42612d080 in binlog_rollback /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/log.cc:2402
 
    #5 0x55f425545ed2 in ha_rollback_trans(THD*, bool) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/handler.cc:2224
 
    #6 0x55f424a6be8f in trans_rollback_implicit(THD*) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/transaction.cc:421
 
    #7 0x55f424a55a90 in mysql_admin_table /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_admin.cc:1326
 
    #8 0x55f424a6618b in mysql_assign_to_keycache(THD*, TABLE_LIST*, st_mysql_const_lex_string const*) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_admin.cc:1442
 
    #9 0x55f424151620 in mysql_execute_command(THD*, bool) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_parse.cc:4092
 
    #10 0x55f42416a1e2 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_parse.cc:8050
 
    #11 0x55f424176255 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_parse.cc:1896
 
    #12 0x55f424181630 in do_command(THD*, bool) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_parse.cc:1409
 
    #13 0x55f4249e5bdc in do_handle_one_connection(CONNECT*, bool) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_connect.cc:1416
 
    #14 0x55f4249e81dc in handle_one_connection /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_connect.cc:1318
 
    #15 0x14da62894b42 in start_thread nptl/pthread_create.c:442
 
    #16 0x14da629269ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
 
 
 
0x62b0000c431a is located 282 bytes inside of 24624-byte region [0x62b0000c4200,0x62b0000ca230)
 
allocated by thread T14 here:
 
    #0 0x55f423a2b3f7 in __interceptor_malloc (/test/PATCH3_UBASAN_MD031023-mariadb-10.6.16-linux-x86_64-opt/bin/mariadbd+0x77113f7)
 
    #1 0x55f427ceb644 in my_malloc /test/bb-10.6-MDEV-31949_PATCH3_opt_san/mysys/my_malloc.c:91
 
    #2 0x55f427cc6d9f in reset_root_defaults /test/bb-10.6-MDEV-31949_PATCH3_opt_san/mysys/my_alloc.c:156
 
    #3 0x55f423e1c59e in THD::init_for_queries() /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_class.cc:1412
 
    #4 0x55f4249e070e in prepare_new_connection_state(THD*) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_connect.cc:1245
 
    #5 0x55f4249e1ff7 in thd_prepare_connection(THD*) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_connect.cc:1339
 
    #6 0x55f4249e1ff7 in thd_prepare_connection(THD*) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_connect.cc:1328
 
    #7 0x55f4249e4c77 in do_handle_one_connection(CONNECT*, bool) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_connect.cc:1406
 
    #8 0x55f4249e81dc in handle_one_connection /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/sql_connect.cc:1318
 
    #9 0x14da62894b42 in start_thread nptl/pthread_create.c:442
 
 
 
Thread T14 created by T0 here:
 
    #0 0x55f4239cf215 in __interceptor_pthread_create (/test/PATCH3_UBASAN_MD031023-mariadb-10.6.16-linux-x86_64-opt/bin/mariadbd+0x76b5215)
 
    #1 0x55f423a8111e in create_thread_to_handle_connection(CONNECT*) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/mysqld.cc:5996
 
    #2 0x55f423a92c4f in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/mysqld.cc:6117
 
    #3 0x55f423a93a97 in handle_connections_sockets() /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/mysqld.cc:6241
 
    #4 0x55f423a96a6d in mysqld_main(int, char**) /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/mysqld.cc:5891
 
    #5 0x14da62829d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
 
 
 
SUMMARY: AddressSanitizer: use-after-poison /test/bb-10.6-MDEV-31949_PATCH3_opt_san/sql/log_event.h:3166 in serialize_xid(char*, long, long, long, char const*)
 
Shadow bytes around the buggy address:
 
  0x0c5680010810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c5680010820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c5680010830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
 
  0x0c5680010840: 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00
 
  0x0c5680010850: 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 00
 
=>0x0c5680010860: 00 00 00[02]f7 07 f7 00 00 00 00 00 f7 00 00 00
 
  0x0c5680010870: f7 06 f7 00 00 f7 00 00 00 f7 00 00 f7 00 f7 00
 
  0x0c5680010880: 00 06 f7 00 00 00 f7 00 00 f7 03 f7 00 00 00 00
 
  0x0c5680010890: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c56800108a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
  0x0c56800108b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
Shadow byte legend (one shadow byte represents 8 application bytes):
 
  Addressable:           00
 
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
 
  Freed heap region:       fd
 
  Stack left redzone:      f1
 
  Stack mid redzone:       f2
 
  Stack right redzone:     f3
 
  Stack after return:      f5
 
  Stack use after scope:   f8
 
  Global redzone:          f9
 
  Global init order:       f6
 
  Poisoned by user:        f7
 
  Container overflow:      fc
 
  Array cookie:            ac
 
  Intra object redzone:    bb
 
  ASan internal:           fe
 
  Left alloca redzone:     ca
 
  Right alloca redzone:    cb
 
  Shadow gap:              cc
 
==62489==ABORTING
 
231004  9:34:59 [ERROR] mysqld got signal 6 ;

Comment by Andrei Elkin [ 2023-10-12 ]

The patch is in
7b0229771bd..4704c227714 HEAD > bb-10.6MDEV-31949

Comment by Andrei Elkin [ 2023-10-13 ]

Roel, to
> if the ASAN use-after-poison's, stack looping and stack smashing have been addressed?
it's been covered to not use THD::lex::xid which could be by a command that has nothing to do with XA transaction (like LOAD-INDEX).

Comment by Roel Van de Paar [ 2023-10-13 ]

> I've not seen these two myisam specific commands ...
While the LOAD INDEX and CACHE INDEX may be MyISAM/Aria specific, the issue described here happens with InnoDB also:

--source include/have_binlog_format_row.inc
 
--source include/have_innodb.inc
 
CREATE TABLE t (c INT KEY) ENGINE=InnoDB;
 
XA START 'a';
 
INSERT INTO t VALUES (1);
 
XA END 'a';
 
XA PREPARE 'a';
 
LOAD INDEX INTO CACHE c KEY(PRIMARY);

> we should not overhype MDEV-32455 significance.
I agree, based on your your findings there (i.e. no other DML/DDL creates the same issue).

Comment by Brandon Nesterenko [ 2023-10-13 ]

Hi Roel and Elkin!

I left a note on the patch for Andrei's consideration, but it generally looks good for testing as-is.

Comment by Roel Van de Paar [ 2023-10-14 ]

bnestere Thank you. I see this patch https://github.com/MariaDB/server/commit/6665e9a1c94881a8ab7519ea95ac3b7ccd48da74#diff-cd4de883246bcdf57f734aea6688c188bc386fc676789b2c1acc9f8079b1c7f7 - will it be merged to bb-10.6-MDEV-31949? What does it fix?
Elkin Please confirm if you will make the additional change to binlog_commit_flush_trx_cache as per bnestere's note? Thank you

Comment by Andrei Elkin [ 2023-10-14 ]

Roel, right, the Brandon's note is accounted now

bbaa623621a..79665710367  HEAD -> bb-10.6-MDEV-31949

The bb-10.6-MDEV-31949 is ready for re-testing.

Comment by Andrei Elkin [ 2023-10-14 ]

Fixed as part and in the branch of MDEV-31949.

Comment by Roel Van de Paar [ 2023-10-16 ]

bnestere ^ One question left for you above. Thanks

Comment by Brandon Nesterenko [ 2023-10-16 ]

Roel it was an alternative suggestion to Andrei's patch, but we discussed it over Zoom and decided against that approach, so i will delete the branch. Good observation, thanks for following up

Generated at Thu Feb 08 10:30:39 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.