Skip to content

Commit 5563202

Browse files
andrelkinandrelkin
committed
MDEV-29322 ASAN heap-use-after-free in Query_log_event::do_apply_event
The ASAN report was made in the parallel slave execution of a query event and implicitly involved (so also parallelly run) Format-Description event. The Query actually had unexpected impossible dependency on a preceding "old" FD whose instance got destructed, to cause the ASAN error. The case is fixed with storing the FD's value into Query-log-event at its instantiating on slave. The stored value is from the very FD of the Query's original binlog so remains to be correct at the query event applying. The branch C. of a new rpl_parallel_29322.test also demonstrates (may need few --repeat though) the bug in its simple form of the same server version binlog.
1 parent 80cf7a4 commit 5563202

File tree

6 files changed

+416
-8
lines changed

6 files changed

+416
-8
lines changed

‎mysql-test/suite/rpl/include/rpl_parallel_29322.inc‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
# A "body" for rpl.rpl_parallel_29322 that runs having as input
2+
# the master and slave @@global.explicit_defaults_for_timestamp.
3+
#
4+
# The Key notes
5+
# -------------
6+
# On master: a sequence of binlog files is composed with
7+
# different server versions.
8+
# On slave: to first try enqueuing all master events.
9+
# Due to binlog files are from different version
10+
# servers when the new (of binlog 2) FD shows up the enqueuing
11+
# will hiccup as workers have to
12+
# process all events already scheduled (see wait_condition below).
13+
# This part proves of the different server version the binlogs
14+
# indeed are.
15+
# After the worker is unblocked the exection proceeds.
16+
#
17+
# In the end compare table definitions and print table data
18+
# to prove correctness.
19+
20+
--connection slave
21+
--source include/stop_slave.inc
22+
reset slave;
23+
24+
--connection master
25+
--let $datadir= `SELECT @@datadir`
26+
27+
reset master; # Master starts a new serious of binlog files
28+
29+
create table t2 (a timestamp, b int);
30+
show create table t2;
31+
--save_master_pos
32+
33+
--connection slave
34+
--source include/start_slave.inc
35+
--sync_with_master
36+
--source include/stop_slave.inc
37+
38+
# load for two $same_version_binlogs branches
39+
--connection master
40+
if (!$same_version_binlogs)
41+
{
42+
insert into t2 values (null, 1);
43+
flush binary logs;
44+
flush binary logs;
45+
insert into t2 values (null, 2);
46+
}
47+
if ($same_version_binlogs)
48+
{
49+
--disable_query_log
50+
--let $count=8
51+
while ($count)
52+
{
53+
--let $queries=4
54+
while ($queries)
55+
{
56+
insert into t2 values (null, 1);
57+
--dec $queries
58+
}
59+
flush binary logs;
60+
flush binary logs;
61+
--dec $count
62+
}
63+
--enable_query_log
64+
}
65+
--save_master_pos
66+
67+
if (!$same_version_binlogs)
68+
{
69+
--move_file $datadir/master-bin.000002 $datadir/master-bin.000002.sav
70+
--copy_file $MYSQL_TEST_DIR/std_data/mdev29078-mysql-bin.000001 $datadir/master-bin.000002
71+
--exec $MYSQL_BINLOG --short-form $datadir/master-bin.000002
72+
73+
# To demonstrate different version binlogs, hold back worker
74+
# until the SQL thread state shows waiting.
75+
--connection slave1
76+
lock table t2 write;
77+
}
78+
79+
--connection slave
80+
--source include/start_slave.inc
81+
82+
if (!$same_version_binlogs)
83+
{
84+
--let $slave_waits_for=Waiting for worker threads to be idle
85+
--let $wait_condition= SELECT COUNT(*) > 0 FROM information_schema.processlist WHERE state = "$slave_waits_for"
86+
--source include/wait_condition.inc
87+
88+
--connection slave1
89+
unlock tables;
90+
91+
--connection slave
92+
--sync_with_master
93+
show create table t1;
94+
set statement time_zone='+2:00' for select * from t1;
95+
drop table t1;
96+
97+
--connection master
98+
--remove_file $datadir/master-bin.000002
99+
--move_file $datadir/master-bin.000002.sav $datadir/master-bin.000002
100+
}
101+
102+
--connection slave
103+
--sync_with_master
104+
show create table t2;
105+
--let $diff_tables=master:t2,slave:t2
106+
--source include/diff_tables.inc
107+
108+
--connection master
109+
drop table t2;
110+
111+
--sync_slave_with_master

‎mysql-test/suite/rpl/r/rpl_parallel_29322.result‎

Lines changed: 238 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,238 @@
1+
#
2+
# MDEV-29322 ASAN use-after-free options_written_to_bin_log
3+
#
4+
include/master-slave.inc
5+
[connection master]
6+
# A. set the master and slave explicit_defaults_for_timestamp values crisscross to (1,0)
7+
connection master;
8+
set @sav.explicit_defaults_for_timestamp = @@session.explicit_defaults_for_timestamp;
9+
set @@session.explicit_defaults_for_timestamp = 1;
10+
connection slave;
11+
set @sav.explicit_defaults_for_timestamp = @@global.explicit_defaults_for_timestamp;
12+
set global explicit_defaults_for_timestamp = 0;
13+
set @sav.slave_parallel_workers = @@global.slave_parallel_workers;
14+
include/stop_slave.inc
15+
set @@global.slave_parallel_workers = 1;
16+
include/start_slave.inc
17+
connection slave;
18+
include/stop_slave.inc
19+
reset slave;
20+
connection master;
21+
reset master;
22+
create table t2 (a timestamp, b int);
23+
show create table t2;
24+
Table Create Table
25+
t2 CREATE TABLE `t2` (
26+
`a` timestamp NULL DEFAULT NULL,
27+
`b` int(11) DEFAULT NULL
28+
) ENGINE=MyISAM DEFAULT CHARSET=latin1
29+
connection slave;
30+
include/start_slave.inc
31+
include/stop_slave.inc
32+
connection master;
33+
insert into t2 values (null, 1);
34+
flush binary logs;
35+
flush binary logs;
36+
insert into t2 values (null, 2);
37+
/*!50530 SET @@SESSION.PSEUDO_SLAVE_MODE=1*/;
38+
/*!40019 SET @@session.max_insert_delayed_threads=0*/;
39+
/*!50003 SET @OLD_COMPLETION_TYPE=@@COMPLETION_TYPE,COMPLETION_TYPE=0*/;
40+
DELIMITER /*!*/;
41+
ROLLBACK/*!*/;
42+
use `test`/*!*/;
43+
SET TIMESTAMP=1658586280/*!*/;
44+
SET @@session.pseudo_thread_id=999999999/*!*/;
45+
SET @@session.foreign_key_checks=1, @@session.sql_auto_is_null=0, @@session.unique_checks=1, @@session.autocommit=1, @@session.check_constraint_checks=1/*!*/;
46+
SET @@session.sql_mode=1411383296/*!*/;
47+
SET @@session.auto_increment_increment=1, @@session.auto_increment_offset=1/*!*/;
48+
/*!\C utf8 *//*!*/;
49+
SET @@session.character_set_client=33,@@session.collation_connection=33,@@session.collation_server=8/*!*/;
50+
SET @@session.lc_time_names=0/*!*/;
51+
SET @@session.collation_database=DEFAULT/*!*/;
52+
create table t1 (f1 timestamp, f2 timestamp)
53+
/*!*/;
54+
START TRANSACTION
55+
/*!*/;
56+
SET TIMESTAMP=1658586288/*!*/;
57+
insert t1 values (NULL, NULL)
58+
/*!*/;
59+
SET TIMESTAMP=1658586288/*!*/;
60+
COMMIT
61+
/*!*/;
62+
START TRANSACTION
63+
/*!*/;
64+
SET TIMESTAMP=1658586335/*!*/;
65+
insert t1 () values ()
66+
/*!*/;
67+
SET TIMESTAMP=1658586335/*!*/;
68+
COMMIT
69+
/*!*/;
70+
DELIMITER ;
71+
# End of log file
72+
ROLLBACK /* added by mysqlbinlog */;
73+
/*!50003 SET COMPLETION_TYPE=@OLD_COMPLETION_TYPE*/;
74+
/*!50530 SET @@SESSION.PSEUDO_SLAVE_MODE=0*/;
75+
connection slave1;
76+
lock table t2 write;
77+
connection slave;
78+
include/start_slave.inc
79+
connection slave1;
80+
unlock tables;
81+
connection slave;
82+
show create table t1;
83+
Table Create Table
84+
t1 CREATE TABLE `t1` (
85+
`f1` timestamp NULL DEFAULT NULL,
86+
`f2` timestamp NULL DEFAULT NULL
87+
) ENGINE=MyISAM DEFAULT CHARSET=latin1
88+
set statement time_zone='+2:00' for select * from t1;
89+
f1 f2
90+
NULL NULL
91+
NULL NULL
92+
drop table t1;
93+
connection master;
94+
connection slave;
95+
show create table t2;
96+
Table Create Table
97+
t2 CREATE TABLE `t2` (
98+
`a` timestamp NULL DEFAULT NULL,
99+
`b` int(11) DEFAULT NULL
100+
) ENGINE=MyISAM DEFAULT CHARSET=latin1
101+
include/diff_tables.inc [master:t2,slave:t2]
102+
connection master;
103+
drop table t2;
104+
connection slave;
105+
# B. alternate the master and slave vars' values to (0,1)
106+
connection master;
107+
set @@session.explicit_defaults_for_timestamp = 0;
108+
connection slave;
109+
set @@global.explicit_defaults_for_timestamp = 1;
110+
connection slave;
111+
include/stop_slave.inc
112+
reset slave;
113+
connection master;
114+
reset master;
115+
create table t2 (a timestamp, b int);
116+
show create table t2;
117+
Table Create Table
118+
t2 CREATE TABLE `t2` (
119+
`a` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
120+
`b` int(11) DEFAULT NULL
121+
) ENGINE=MyISAM DEFAULT CHARSET=latin1
122+
connection slave;
123+
include/start_slave.inc
124+
include/stop_slave.inc
125+
connection master;
126+
insert into t2 values (null, 1);
127+
flush binary logs;
128+
flush binary logs;
129+
insert into t2 values (null, 2);
130+
/*!50530 SET @@SESSION.PSEUDO_SLAVE_MODE=1*/;
131+
/*!40019 SET @@session.max_insert_delayed_threads=0*/;
132+
/*!50003 SET @OLD_COMPLETION_TYPE=@@COMPLETION_TYPE,COMPLETION_TYPE=0*/;
133+
DELIMITER /*!*/;
134+
ROLLBACK/*!*/;
135+
use `test`/*!*/;
136+
SET TIMESTAMP=1658586280/*!*/;
137+
SET @@session.pseudo_thread_id=999999999/*!*/;
138+
SET @@session.foreign_key_checks=1, @@session.sql_auto_is_null=0, @@session.unique_checks=1, @@session.autocommit=1, @@session.check_constraint_checks=1/*!*/;
139+
SET @@session.sql_mode=1411383296/*!*/;
140+
SET @@session.auto_increment_increment=1, @@session.auto_increment_offset=1/*!*/;
141+
/*!\C utf8 *//*!*/;
142+
SET @@session.character_set_client=33,@@session.collation_connection=33,@@session.collation_server=8/*!*/;
143+
SET @@session.lc_time_names=0/*!*/;
144+
SET @@session.collation_database=DEFAULT/*!*/;
145+
create table t1 (f1 timestamp, f2 timestamp)
146+
/*!*/;
147+
START TRANSACTION
148+
/*!*/;
149+
SET TIMESTAMP=1658586288/*!*/;
150+
insert t1 values (NULL, NULL)
151+
/*!*/;
152+
SET TIMESTAMP=1658586288/*!*/;
153+
COMMIT
154+
/*!*/;
155+
START TRANSACTION
156+
/*!*/;
157+
SET TIMESTAMP=1658586335/*!*/;
158+
insert t1 () values ()
159+
/*!*/;
160+
SET TIMESTAMP=1658586335/*!*/;
161+
COMMIT
162+
/*!*/;
163+
DELIMITER ;
164+
# End of log file
165+
ROLLBACK /* added by mysqlbinlog */;
166+
/*!50003 SET COMPLETION_TYPE=@OLD_COMPLETION_TYPE*/;
167+
/*!50530 SET @@SESSION.PSEUDO_SLAVE_MODE=0*/;
168+
connection slave1;
169+
lock table t2 write;
170+
connection slave;
171+
include/start_slave.inc
172+
connection slave1;
173+
unlock tables;
174+
connection slave;
175+
show create table t1;
176+
Table Create Table
177+
t1 CREATE TABLE `t1` (
178+
`f1` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
179+
`f2` timestamp NOT NULL DEFAULT '0000-00-00 00:00:00'
180+
) ENGINE=MyISAM DEFAULT CHARSET=latin1
181+
set statement time_zone='+2:00' for select * from t1;
182+
f1 f2
183+
2022-07-23 16:24:48 2022-07-23 16:24:48
184+
2022-07-23 16:25:35 0000-00-00 00:00:00
185+
drop table t1;
186+
connection master;
187+
connection slave;
188+
show create table t2;
189+
Table Create Table
190+
t2 CREATE TABLE `t2` (
191+
`a` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
192+
`b` int(11) DEFAULT NULL
193+
) ENGINE=MyISAM DEFAULT CHARSET=latin1
194+
include/diff_tables.inc [master:t2,slave:t2]
195+
connection master;
196+
drop table t2;
197+
connection slave;
198+
# C. the bug case on the same version binlogs also to demo on the patch's base
199+
include/stop_slave.inc
200+
set @@global.slave_parallel_workers = 4;
201+
include/start_slave.inc
202+
connection slave;
203+
include/stop_slave.inc
204+
reset slave;
205+
connection master;
206+
reset master;
207+
create table t2 (a timestamp, b int);
208+
show create table t2;
209+
Table Create Table
210+
t2 CREATE TABLE `t2` (
211+
`a` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
212+
`b` int(11) DEFAULT NULL
213+
) ENGINE=MyISAM DEFAULT CHARSET=latin1
214+
connection slave;
215+
include/start_slave.inc
216+
include/stop_slave.inc
217+
connection master;
218+
connection slave;
219+
include/start_slave.inc
220+
connection slave;
221+
show create table t2;
222+
Table Create Table
223+
t2 CREATE TABLE `t2` (
224+
`a` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
225+
`b` int(11) DEFAULT NULL
226+
) ENGINE=MyISAM DEFAULT CHARSET=latin1
227+
include/diff_tables.inc [master:t2,slave:t2]
228+
connection master;
229+
drop table t2;
230+
connection slave;
231+
connection master;
232+
set @@session.explicit_defaults_for_timestamp = @sav.explicit_defaults_for_timestamp;
233+
connection slave;
234+
set @@global.explicit_defaults_for_timestamp = @sav.explicit_defaults_for_timestamp;
235+
include/stop_slave.inc
236+
set @@global.slave_parallel_workers = @sav.slave_parallel_workers;
237+
include/start_slave.inc
238+
include/rpl_end.inc

0 commit comments

Comments
 (0)