Commit 25476ba1 authored by Yuchen Pei's avatar Yuchen Pei

MDEV-29027 ASAN errors in spider_db_free_result after partition DDL

Spider calls ha_spider::close() at least twice on ALTER TABLE ... ADD
PARTITION. The first call frees wide_handler and the second call
accesses wide_handler->trx->thd (heap-use-after-free).

In general, there seems to be no problem with using THD obtained by
the macro current_thd() except in background threads. Thus, we simply
replace wide_handler->trx->thd with current_thd().

Original author: Nayuta Yanagasawa
parent 6d0c9872
#
# MDEV-29027 ASAN errors in spider_db_free_result after partition DDL
#
for master_1
for child2
child2_1
child2_2
child2_3
for child3
CREATE DATABASE auto_test_local;
USE auto_test_local;
CREATE TABLE tbl_a (
c INT
) ENGINE=Spider DEFAULT CHARSET=utf8 PARTITION BY HASH(c) (
PARTITION pt1
);
ALTER TABLE tbl_a ADD PARTITION (PARTITION pt2);
DROP DATABASE auto_test_local;
for master_1
for child2
child2_1
child2_2
child2_3
for child3
for master_1
for child2
for child3
set spider_same_server_link= 1;
CREATE SERVER srv FOREIGN DATA WRAPPER mysql
OPTIONS (SOCKET "$MASTER_1_MYSOCK", DATABASE 'test',user 'root');
CREATE TABLE t1 (a INT);
CREATE TABLE t_spider (a INT) ENGINE=SPIDER PARTITION BY HASH(a) (PARTITION p1 COMMENT = "wrapper 'mysql', srv 'srv', table 't1'");
CREATE TABLE t2 (a INT);
ALTER TABLE t_spider ADD PARTITION (PARTITION p2 COMMENT = "wrapper 'mysql', srv 'srv', table 't2'");
DROP TABLE t_spider, t1, t2;
drop server srv;
for master_1
for child2
for child3
!include include/default_mysqld.cnf
!include ../my_1_1.cnf
!include ../my_2_1.cnf
--echo #
--echo # MDEV-29027 ASAN errors in spider_db_free_result after partition DDL
--echo #
--disable_query_log
--disable_result_log
--source ../../t/test_init.inc
--enable_result_log
--enable_query_log
CREATE DATABASE auto_test_local;
USE auto_test_local;
eval CREATE TABLE tbl_a (
c INT
) $MASTER_1_ENGINE $MASTER_1_CHARSET PARTITION BY HASH(c) (
PARTITION pt1
);
ALTER TABLE tbl_a ADD PARTITION (PARTITION pt2);
DROP DATABASE auto_test_local;
--disable_query_log
--disable_result_log
--source ../../t/test_deinit.inc
--enable_result_log
--enable_query_log
--disable_query_log
--disable_result_log
--source ../../t/test_init.inc
--enable_result_log
--enable_query_log
--source include/have_partition.inc
set spider_same_server_link= 1;
evalp CREATE SERVER srv FOREIGN DATA WRAPPER mysql
OPTIONS (SOCKET "$MASTER_1_MYSOCK", DATABASE 'test',user 'root');
CREATE TABLE t1 (a INT);
CREATE TABLE t_spider (a INT) ENGINE=SPIDER PARTITION BY HASH(a) (PARTITION p1 COMMENT = "wrapper 'mysql', srv 'srv', table 't1'");
CREATE TABLE t2 (a INT);
ALTER TABLE t_spider ADD PARTITION (PARTITION p2 COMMENT = "wrapper 'mysql', srv 'srv', table 't2'");
DROP TABLE t_spider, t1, t2;
drop server srv;
--disable_query_log
--disable_result_log
--source ../../t/test_deinit.inc
--enable_result_log
--enable_query_log
...@@ -3406,7 +3406,7 @@ int spider_db_free_result( ...@@ -3406,7 +3406,7 @@ int spider_db_free_result(
SPIDER_RESULT *result; SPIDER_RESULT *result;
SPIDER_RESULT *prev; SPIDER_RESULT *prev;
SPIDER_SHARE *share = spider->share; SPIDER_SHARE *share = spider->share;
SPIDER_TRX *trx = spider->wide_handler->trx; THD *thd= current_thd;
SPIDER_POSITION *position; SPIDER_POSITION *position;
int roop_count, error_num; int roop_count, error_num;
DBUG_ENTER("spider_db_free_result"); DBUG_ENTER("spider_db_free_result");
...@@ -3423,10 +3423,10 @@ int spider_db_free_result( ...@@ -3423,10 +3423,10 @@ int spider_db_free_result(
if ( if (
final || final ||
spider_param_reset_sql_alloc(trx->thd, share->reset_sql_alloc) == 1 spider_param_reset_sql_alloc(thd, share->reset_sql_alloc) == 1
) { ) {
int alloc_size = final ? 0 : int alloc_size = final ? 0 :
(spider_param_init_sql_alloc_size(trx->thd, share->init_sql_alloc_size)); (spider_param_init_sql_alloc_size(thd, share->init_sql_alloc_size));
while (result) while (result)
{ {
position = result->first_position; position = result->first_position;
...@@ -3469,7 +3469,7 @@ int spider_db_free_result( ...@@ -3469,7 +3469,7 @@ int spider_db_free_result(
{ {
ulong realloced = 0; ulong realloced = 0;
int init_sql_alloc_size = int init_sql_alloc_size =
spider_param_init_sql_alloc_size(trx->thd, share->init_sql_alloc_size); spider_param_init_sql_alloc_size(thd, share->init_sql_alloc_size);
for (roop_count = 0; roop_count < (int) share->use_dbton_count; for (roop_count = 0; roop_count < (int) share->use_dbton_count;
roop_count++) roop_count++)
{ {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment