Skip to content

Commit 25476ba

Browse files
MDEV-29027 ASAN errors in spider_db_free_result after partition DDL
Spider calls ha_spider::close() at least twice on ALTER TABLE ... ADD PARTITION. The first call frees wide_handler and the second call accesses wide_handler->trx->thd (heap-use-after-free). In general, there seems to be no problem with using THD obtained by the macro current_thd() except in background threads. Thus, we simply replace wide_handler->trx->thd with current_thd(). Original author: Nayuta Yanagasawa
1 parent 6d0c987 commit 25476ba

File tree

6 files changed

+96
-4
lines changed

6 files changed

+96
-4
lines changed
Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#
2+
# MDEV-29027 ASAN errors in spider_db_free_result after partition DDL
3+
#
4+
for master_1
5+
for child2
6+
child2_1
7+
child2_2
8+
child2_3
9+
for child3
10+
CREATE DATABASE auto_test_local;
11+
USE auto_test_local;
12+
CREATE TABLE tbl_a (
13+
c INT
14+
) ENGINE=Spider DEFAULT CHARSET=utf8 PARTITION BY HASH(c) (
15+
PARTITION pt1
16+
);
17+
ALTER TABLE tbl_a ADD PARTITION (PARTITION pt2);
18+
DROP DATABASE auto_test_local;
19+
for master_1
20+
for child2
21+
child2_1
22+
child2_2
23+
child2_3
24+
for child3
Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
for master_1
2+
for child2
3+
for child3
4+
set spider_same_server_link= 1;
5+
CREATE SERVER srv FOREIGN DATA WRAPPER mysql
6+
OPTIONS (SOCKET "$MASTER_1_MYSOCK", DATABASE 'test',user 'root');
7+
CREATE TABLE t1 (a INT);
8+
CREATE TABLE t_spider (a INT) ENGINE=SPIDER PARTITION BY HASH(a) (PARTITION p1 COMMENT = "wrapper 'mysql', srv 'srv', table 't1'");
9+
CREATE TABLE t2 (a INT);
10+
ALTER TABLE t_spider ADD PARTITION (PARTITION p2 COMMENT = "wrapper 'mysql', srv 'srv', table 't2'");
11+
DROP TABLE t_spider, t1, t2;
12+
drop server srv;
13+
for master_1
14+
for child2
15+
for child3
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
!include include/default_mysqld.cnf
2+
!include ../my_1_1.cnf
3+
!include ../my_2_1.cnf
Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
--echo #
2+
--echo # MDEV-29027 ASAN errors in spider_db_free_result after partition DDL
3+
--echo #
4+
5+
--disable_query_log
6+
--disable_result_log
7+
--source ../../t/test_init.inc
8+
--enable_result_log
9+
--enable_query_log
10+
11+
CREATE DATABASE auto_test_local;
12+
USE auto_test_local;
13+
14+
eval CREATE TABLE tbl_a (
15+
c INT
16+
) $MASTER_1_ENGINE $MASTER_1_CHARSET PARTITION BY HASH(c) (
17+
PARTITION pt1
18+
);
19+
20+
ALTER TABLE tbl_a ADD PARTITION (PARTITION pt2);
21+
22+
DROP DATABASE auto_test_local;
23+
24+
--disable_query_log
25+
--disable_result_log
26+
--source ../../t/test_deinit.inc
27+
--enable_result_log
28+
--enable_query_log
Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
--disable_query_log
2+
--disable_result_log
3+
--source ../../t/test_init.inc
4+
--enable_result_log
5+
--enable_query_log
6+
--source include/have_partition.inc
7+
set spider_same_server_link= 1;
8+
evalp CREATE SERVER srv FOREIGN DATA WRAPPER mysql
9+
OPTIONS (SOCKET "$MASTER_1_MYSOCK", DATABASE 'test',user 'root');
10+
11+
CREATE TABLE t1 (a INT);
12+
CREATE TABLE t_spider (a INT) ENGINE=SPIDER PARTITION BY HASH(a) (PARTITION p1 COMMENT = "wrapper 'mysql', srv 'srv', table 't1'");
13+
CREATE TABLE t2 (a INT);
14+
ALTER TABLE t_spider ADD PARTITION (PARTITION p2 COMMENT = "wrapper 'mysql', srv 'srv', table 't2'");
15+
16+
DROP TABLE t_spider, t1, t2;
17+
drop server srv;
18+
--disable_query_log
19+
--disable_result_log
20+
--source ../../t/test_deinit.inc
21+
--enable_result_log
22+
--enable_query_log

storage/spider/spd_db_conn.cc

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3406,7 +3406,7 @@ int spider_db_free_result(
34063406
SPIDER_RESULT *result;
34073407
SPIDER_RESULT *prev;
34083408
SPIDER_SHARE *share = spider->share;
3409-
SPIDER_TRX *trx = spider->wide_handler->trx;
3409+
THD *thd= current_thd;
34103410
SPIDER_POSITION *position;
34113411
int roop_count, error_num;
34123412
DBUG_ENTER("spider_db_free_result");
@@ -3423,10 +3423,10 @@ int spider_db_free_result(
34233423

34243424
if (
34253425
final ||
3426-
spider_param_reset_sql_alloc(trx->thd, share->reset_sql_alloc) == 1
3426+
spider_param_reset_sql_alloc(thd, share->reset_sql_alloc) == 1
34273427
) {
34283428
int alloc_size = final ? 0 :
3429-
(spider_param_init_sql_alloc_size(trx->thd, share->init_sql_alloc_size));
3429+
(spider_param_init_sql_alloc_size(thd, share->init_sql_alloc_size));
34303430
while (result)
34313431
{
34323432
position = result->first_position;
@@ -3469,7 +3469,7 @@ int spider_db_free_result(
34693469
{
34703470
ulong realloced = 0;
34713471
int init_sql_alloc_size =
3472-
spider_param_init_sql_alloc_size(trx->thd, share->init_sql_alloc_size);
3472+
spider_param_init_sql_alloc_size(thd, share->init_sql_alloc_size);
34733473
for (roop_count = 0; roop_count < (int) share->use_dbton_count;
34743474
roop_count++)
34753475
{

0 commit comments

Comments
 (0)