Memory corruption with (M)aria storage engine and virtual columns

Bug #613408 reported by Philip Stoev
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
MariaDB
Fix Released
High
Michael Widenius

Bug Description

Using virtual columns with (M)aria storage engines causes easy memory corruptions with various stack traces including

#5 0x00c23424 in __kernel_vsyscall ()
#6 0x0089ed71 in raise () from /lib/libc.so.6
#7 0x008a064a in abort () from /lib/libc.so.6
#8 0x008dcd9d in __libc_message () from /lib/libc.so.6
#9 0x008e31e1 in malloc_printerr () from /lib/libc.so.6
#10 0x086fc3ff in my_no_flags_free (ptr=0xb5d6b3b0) at my_malloc.c:62
#11 0x086fcde3 in free_root (root=0x9fae860, MyFlags=1) at my_alloc.c:348
#12 0x0827cf7a in dispatch_command (command=COM_QUERY, thd=0x9fac8a8, packet=0x9fae889 "", packet_length=13) at sql_parse.cc:1633
#13 0x0827b288 in do_command (thd=0x9fac8a8) at sql_parse.cc:890
#14 0x08278420 in handle_one_connection (arg=0x9fac8a8) at sql_connect.cc:1153
#15 0x00a08919 in start_thread () from /lib/libpthread.so.0
#16 0x00951e5e in clone () from /lib/libc.so.6

Revision history for this message
Philip Stoev (pstoev-askmonty) wrote :

Test case:

CREATE TABLE IF NOT EXISTS X (
         f1 CHAR(255) BINARY ,
         f2 CHAR(255) BINARY NOT NULL DEFAULT '0',
         f3 CHAR(255) BINARY NOT NULL ,
         f4 CHAR(255) BINARY NOT NULL DEFAULT '0' ,
         v3 CHAR(255) BINARY AS ( ( f1 NOT LIKE '%' ) ) PERSISTENT ,
         KEY (v3)
) ENGINE=Maria;
INSERT INTO X ( f1 , f2 , f3 , f4 ) SELECT f1 , f4 , f1 , f4 FROM X;
DELETE FROM X;

Changed in maria:
importance: Undecided → High
assignee: nobody → Oleksandr "Sanja" Byelkin (sanja-byelkin)
milestone: none → 5.2
Changed in maria:
status: New → In Progress
Revision history for this message
Philip Stoev (pstoev-askmonty) wrote :
Download full text (61.1 KiB)

Valgrind output:

==2192== Thread 4:
==2192== Invalid write of size 4
==2192== at 0x8522CF6: ha_maria::external_lock(THD*, int) (ha_maria.cc:2436)
==2192== by 0x83A615F: handler::ha_external_lock(THD*, int) (handler.cc:4802)
==2192== by 0x8263C0D: lock_external(THD*, st_table**, unsigned int) (lock.cc:364)
==2192== by 0x8263828: mysql_lock_tables(THD*, st_table**, unsigned int, unsigned int, bool*) (lock.cc:260)
==2192== by 0x82CCABA: lock_tables(THD*, TABLE_LIST*, unsigned int, bool*) (sql_base.cc:5376)
==2192== by 0x82CBF82: open_and_lock_tables_derived(THD*, TABLE_LIST*, bool) (sql_base.cc:5061)
==2192== by 0x828DEFE: open_and_lock_tables(THD*, TABLE_LIST*) (mysql_priv.h:1611)
==2192== by 0x832F905: mysql_delete(THD*, TABLE_LIST*, Item*, st_sql_list*, unsigned long long, unsigned long long, bool) (sql_delete.cc:60)
==2192== by 0x8281777: mysql_execute_command(THD*) (sql_parse.cc:3338)
==2192== by 0x8289AA3: mysql_parse(THD*, char const*, unsigned int, char const**) (sql_parse.cc:6024)
==2192== by 0x827BD99: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1183)
==2192== by 0x827B287: do_command(THD*) (sql_parse.cc:890)
==2192== by 0x827841F: handle_one_connection (sql_connect.cc:1153)
==2192== by 0xA08918: start_thread (in /lib/libpthread-2.12.so)
==2192== by 0x951E5D: clone (in /lib/libc-2.12.so)
==2192== Address 0x5b621a8 is 64 bytes inside a block of size 120 free'd
==2192== at 0x40057F6: free (vg_replace_malloc.c:325)
==2192== by 0x86FC3FE: my_no_flags_free (my_malloc.c:62)
==2192== by 0x853F5BB: _ma_trnman_end_trans_hook (ma_state.c:510)
==2192== by 0x84F994A: trnman_end_trn (trnman.c:474)
==2192== by 0x85A624D: ma_commit (ma_commit.c:72)
==2192== by 0x85232E8: ha_maria::implicit_commit(THD*, bool) (ha_maria.cc:2603)
==2192== by 0x827CDEB: dispatch_command(enum_server_command, THD*, char*, unsigned int) (sql_parse.cc:1601)
==2192== by 0x827B287: do_command(THD*) (sql_parse.cc:890)
==2192== by 0x827841F: handle_one_connection (sql_connect.cc:1153)
==2192== by 0xA08918: start_thread (in /lib/libpthread-2.12.so)
==2192== by 0x951E5D: clone (in /lib/libc-2.12.so)
==2192== Invalid write of size 4
==2192== at 0x8522CFB: ha_maria::external_lock(THD*, int) (ha_maria.cc:2436)
==2192== by 0x83A615F: handler::ha_external_lock(THD*, int) (handler.cc:4802)
==2192== by 0x8263C0D: lock_external(THD*, st_table**, unsigned int) (lock.cc:364)
==2192== by 0x8263828: mysql_lock_tables(THD*, st_table**, unsigned int, unsigned int, bool*) (lock.cc:260)
==2192== by 0x82CCABA: lock_tables(THD*, TABLE_LIST*, unsigned int, bool*) (sql_base.cc:5376)
==2192== by 0x82CBF82: open_and_lock_tables_derived(THD*, TABLE_LIST*, bool) (sql_base.cc:5061)
==2192== by 0x828DEFE: open_and_lock_tables(THD*, TABLE_LIST*) (mysql_priv.h:1611)
==2192== by 0x832F905: mysql_delete(THD*, TABLE_LIST*, Item*, st_sql_list*, unsigned long long, unsigned long long, bool) (sql_delete.cc:60)
==2192== by 0x8281777: mysql_execute_command(THD*) (sql_parse.cc:3338)
==2192== by 0x8289AA3: mysql_parse(THD*, char const*, unsigned int, char const**) (sql_parse....

Changed in maria:
assignee: Oleksandr "Sanja" Byelkin (sanja-byelkin) → Michael Widenius (monty)
Michael Widenius (monty)
Changed in maria:
status: In Progress → Fix Committed
Michael Widenius (monty)
Changed in maria:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.